A small business wants to share threat intelligence with other small businesses in its region, but lacks the resources to join a formal ISAC. What is a practical alternative?

Purchase a commercial threat intelligence feed instead of sharing.

Create a private Facebook group to share indicators.

Join a local ISAO that focuses on small businesses and provides a lighter-weight sharing framework.

Wait until the business grows before sharing intelligence.

A company receives a STIX bundle from an ISAC containing indicators of compromise (IOCs) for a new ransomware campaign. The security team wants to proactively block the C2 domains and file hashes across their network. What is the first step to operationalize this intelligence?

Validate and de-duplicate the indicators before pushing them to the firewall and endpoint protection systems.

Immediately block all indicators without review to minimize risk.

Share the bundle with other organizations before using it internally.

Store the STIX bundle in a folder for future reference.

An organization uses a TIP that supports STIX 2.1. A partner sends a STIX 1.2 bundle. The TIP cannot parse STIX 1.2. What is the best way to incorporate the partner's intelligence?

Manually recreate the indicators in the TIP based on the STIX 1.2 data.

Ask the partner to send the data in a proprietary format instead.

Ignore the STIX 1.2 bundle and wait for the partner to upgrade.

Use a conversion tool to translate the STIX 1.2 bundle to STIX 2.1 before importing it into the TIP.

What is a primary benefit of sharing cyber threat intelligence across organizations?

It guarantees that all organizations will have identical security controls

It automatically blocks all malicious activity without human intervention

It eliminates the need for internal threat detection capabilities

It provides early warning of emerging threats and reduces the impact of attacks

A government agency and a private critical infrastructure company are forming a public-private partnership to share cyber threat intelligence. The company is hesitant to share detailed incident data due to concerns about public disclosure and competitive disadvantage. The agency wants to ensure timely sharing of actionable indicators. What is the most effective way to build trust and encourage sharing?

Require the company to share all incident details immediately, without any restrictions.

Establish a formal information sharing agreement with clear data handling, confidentiality, and usage restrictions.

Rely on informal personal relationships between the agency and company staff.

Share only anonymized data publicly to avoid any risk.

GIAC Cyber Threat Intelligence

Domain 6Objective 1

Sharing Intelligence GCTI Practice Questions (Page 3)

Part of the Intelligence Sharing domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 11–15

11application · medium
A small business wants to share threat intelligence with other small businesses in its region, but lacks the resources to join a formal ISAC. What is a practical alternative?
Select an answer first
12application · medium
A company receives a STIX bundle from an ISAC containing indicators of compromise (IOCs) for a new ransomware campaign. The security team wants to proactively block the C2 domains and file hashes across their network. What is the first step to operationalize this intelligence?
Select an answer first
13expert · medium
An organization uses a TIP that supports STIX 2.1. A partner sends a STIX 1.2 bundle. The TIP cannot parse STIX 1.2. What is the best way to incorporate the partner's intelligence?
Select an answer first
14foundation · easy
What is a primary benefit of sharing cyber threat intelligence across organizations?
Select an answer first
15expert · hard
A government agency and a private critical infrastructure company are forming a public-private partnership to share cyber threat intelligence. The company is hesitant to share detailed incident data due to concerns about public disclosure and competitive disadvantage. The agency wants to ensure timely sharing of actionable indicators. What is the most effective way to build trust and encourage sharing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.