Sharing Intelligence GCTI Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small company's security team is considering joining a local ISAO to share threat intelligence. The team is concerned about the time required to participate and the risk of exposing sensitive internal information. What is the primary benefit that justifies participation?

   • AGuaranteed immunity from legal liability for any shared information.
   • BA requirement to share all internal incident data without restriction.
   • CAccess to a broader set of indicators and attack patterns that can improve the company's detection and response capabilities.
   • DFree access to commercial threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How can an organization operationalize shared threat intelligence to improve detection?

   • ABy manually reviewing the intelligence on a monthly basis
   • BBy storing the intelligence in a separate database for future reference only
   • CBy sharing the intelligence with external partners without internal use
   • DBy integrating indicators of compromise (IOCs) into security monitoring tools
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is part of an ISAO that uses MISP for sharing. They notice that some members are not sharing high-quality indicators, and the team is spending too much time validating low-value data. They want to improve the quality of shared intelligence without discouraging participation. What is the best approach?

   • AIgnore low-quality indicators and only use high-quality ones.
   • BBan members who submit low-quality indicators.
   • CEstablish a quality scoring system and provide feedback to members on the usefulness of their submissions.
   • DRestrict sharing to only a few trusted members.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A SOC receives a TAXII feed containing indicators from multiple sources with conflicting confidence levels. The SOC needs to prioritize which indicators to investigate first. What is the most effective prioritization strategy?

   • APrioritize indicators from the source with the most data, regardless of confidence.
   • BCorrelate indicators across multiple sources and prioritize those with high confidence and corroboration.
   • CInvestigate indicators in the order they arrive in the feed.
   • DIgnore all indicators with low confidence to save time.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is evaluating how to share threat intelligence with partners. They need to support both real-time indicator exchange and rich contextual data (e.g., attack patterns, campaigns). They also want to minimize the number of different protocols to maintain. Which approach best meets these needs?

   • AUse MISP for indicators and email for contextual narratives.
   • BUse STIX 2.1 for all data and TAXII 2.1 for transport, which supports both indicators and rich relationships.
   • CUse only CSV files shared via SFTP.
   • DUse TAXII 1.x for indicators and a custom API for context.
   Reveal Solution Discussion Select an answer first