Which of the following best describes a core principle of sharing cyber threat intelligence?

Sharing only with organizations that have signed a formal legal contract

Sharing to meet regulatory requirements, even if the intelligence is not actionable

Sharing to enable collective defense and improve security posture across the community

Sharing only after an incident has been fully contained to avoid exposing vulnerabilities

A company is invited to join a new ISAO. The company's legal team is concerned about the liability of sharing sensitive information. What should the company do before joining?

Review the ISAO's information sharing agreement and ensure it includes liability protections and data handling policies.

Join but share only non-sensitive information.

Refuse to join any ISAO due to legal risks.

Join immediately and share all information to build trust.

A company is deciding whether to join an ISAC or an ISAO. The company's main goal is to receive sector-specific threat intelligence and participate in a formal, established community. Which factor most strongly favors joining an ISAC?

ISACs are typically organized around a specific sector and have established relationships with government agencies.

ISACs do not require any information sharing from members.

ISAOs are always more expensive than ISACs.

ISAOs are only for non-profit organizations.

A security team is using MISP to share intelligence with partners. They want to automate the ingestion of MISP events into their SIEM, but the SIEM does not have a native MISP integration. The team has development resources available. What is the most efficient approach?

Use TAXII to export MISP events and then import them into the SIEM.

Replace MISP with a commercial platform that has a built-in SIEM connector.

Manually export MISP events to CSV and import them into the SIEM daily.

Develop a custom script that uses MISP's REST API to pull events and push them to the SIEM's API.

GIAC Cyber Threat Intelligence

Domain 6Objective 1

Sharing Intelligence GCTI Practice Questions (Page 1)

Part of the Intelligence Sharing domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 1–5

1foundation · easy
Which of the following best describes a core principle of sharing cyber threat intelligence?
Select an answer first
2application · medium
A company is invited to join a new ISAO. The company's legal team is concerned about the liability of sharing sensitive information. What should the company do before joining?
Select an answer first
3expert · medium
A company is deciding whether to join an ISAC or an ISAO. The company's main goal is to receive sector-specific threat intelligence and participate in a formal, established community. Which factor most strongly favors joining an ISAC?
Select an answer first
4expert · hard
A security team is using MISP to share intelligence with partners. They want to automate the ingestion of MISP events into their SIEM, but the SIEM does not have a native MISP integration. The team has development resources available. What is the most efficient approach?
Select an answer first
5foundation · easy
Which of the following is a standard for representing cyber threat intelligence in a structured format?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.