An analyst has a malicious email address used in a phishing campaign. The analyst wants to find other domains that may be registered by the same actor. Which pivot technique is most appropriate?

Email-to-actor pivoting by searching WHOIS records for the email address.

Temporal pivoting to find domains registered on the same day.

Hash-to-sample pivoting using the phishing email attachment hash.

IP-to-domain pivoting using the IP of the email server.

GIAC Cyber Threat Intelligence

Domain 5Objective 1

Pivoting GCTI Practice Questions (Page 8)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 36–38

36foundation · easy
An analyst has identified an email address used in a phishing campaign. Which type of pivoting would be most appropriate to find other infrastructure associated with the same threat actor?
Select an answer first
37application · medium
An analyst has a malicious email address used in a phishing campaign. The analyst wants to find other domains that may be registered by the same actor. Which pivot technique is most appropriate?
Select an answer first
38foundation · easy
An analyst has a known malicious IP address. Which pivot technique would directly yield the domains that resolve to that IP?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Pivoting GCTI Practice Questions (Page 8)

Questions 36–38

An analyst has identified an email address used in a phishing campaign. Which type of pivoting would be most appropriate to find other infrastructure associated with the same threat actor?

An analyst has a malicious email address used in a phishing campaign. The analyst wants to find other domains that may be registered by the same actor. Which pivot technique is most appropriate?

An analyst has a known malicious IP address. Which pivot technique would directly yield the domains that resolve to that IP?

Keep studying — Advanced Analysis Techniques