A security operations center (SOC) uses MISP to share and correlate threat intelligence with partner organizations. The SOC wants to automatically enrich their SIEM alerts with context from MISP, such as related campaigns and attack patterns. What is the most effective way to achieve this integration?

Ask partners to email new indicators to the SOC each day.

Use MISP's REST API to query indicators and enrich alerts in the SIEM via a custom integration.

Replace MISP with a commercial threat intel platform that has a built-in SIEM connector.

Export MISP events to STIX and manually review them weekly.

A SOC receives a MISP event containing a YARA rule for a new malware family. The SOC wants to use this rule to detect the malware on endpoints. What is the most appropriate action?

Ignore the rule because it is not from a trusted source.

Convert the YARA rule to a different format before using it.

Test the YARA rule in a sandbox environment before deploying it to production endpoints.

Deploy the rule immediately to all endpoints to maximize coverage.

Which of the following is a characteristic of an Information Sharing and Analysis Center (ISAC)?

It is a commercial vendor that sells threat intelligence feeds

It is a standards body that develops sharing protocols

It is a non-profit that focuses on a specific critical infrastructure sector

It is a government agency that regulates cybersecurity practices

GIAC Cyber Threat Intelligence

Domain 6Objective 1

Sharing Intelligence GCTI Practice Questions (Page 10)

Part of the Intelligence Sharing domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 46–48

46application · medium
A security operations center (SOC) uses MISP to share and correlate threat intelligence with partner organizations. The SOC wants to automatically enrich their SIEM alerts with context from MISP, such as related campaigns and attack patterns. What is the most effective way to achieve this integration?
Select an answer first
47application · medium
A SOC receives a MISP event containing a YARA rule for a new malware family. The SOC wants to use this rule to detect the malware on endpoints. What is the most appropriate action?
Select an answer first
48foundation · easy
Which of the following is a characteristic of an Information Sharing and Analysis Center (ISAC)?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Sharing Intelligence GCTI Practice Questions (Page 10)

Questions 46–48

A SOC receives a MISP event containing a YARA rule for a new malware family. The SOC wants to use this rule to detect the malware on endpoints. What is the most appropriate action?

Which of the following is a characteristic of an Information Sharing and Analysis Center (ISAC)?

Keep studying — Intelligence Sharing