Sharing Intelligence GCTI Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which protocol is specifically designed for the transport and exchange of cyber threat intelligence?

   • AHTTPS
   • BMISP
   • CTAXII
   • DSTIX
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to improve its detection of targeted attacks by leveraging shared intelligence. Which approach best achieves this goal?

   • AIntegrate shared indicators into the SIEM and EDR to create detection rules and alerts.
   • BStore all shared intelligence in a document repository for future reference.
   • CShare the organization's own indicators with partners but not ingest theirs.
   • DReview shared intelligence reports monthly and manually check logs for matching activity.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A regional bank joins a financial-sector ISAC to receive timely threat indicators. The bank's security team wants to operationalize the shared intelligence by automatically ingesting it into their SIEM. However, the ISAC only provides indicators in STIX 2.1 via a TAXII 2.1 feed. The bank's SIEM currently ingests CSV and JSON via API. What should the team do first to enable automated ingestion?

   • AManually copy indicators from the TAXII feed into the SIEM each day.
   • BAsk the ISAC to switch to a CSV feed because the SIEM cannot handle STIX.
   • CBuild a middleware connector that translates STIX 2.1 objects into the SIEM's native JSON format and pushes them via the API.
   • DSubscribe to a commercial threat intel feed that uses CSV instead of the ISAC feed.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization receives a STIX bundle containing a new malware signature. The SOC wants to ensure that the signature is used to detect the malware across all endpoints. What is the most effective action?

   • AStore the STIX bundle in a shared folder for analysts to review manually.
   • BAdd the STIX bundle to the ticketing system as a reference.
   • CConvert the STIX indicator into the EDR's native IOC format and deploy it to all endpoints.
   • DEmail the STIX bundle to all endpoint users for awareness.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst wants to share a new phishing campaign's indicators with a partner organization that uses a different threat intelligence platform. The analyst has the indicators in STIX 2.1 format. What is the most interoperable way to share this data?

   • AConvert the STIX bundle to a PDF and email it.
   • BSend the STIX 2.1 bundle via a TAXII 2.1 server.
   • CUpload the STIX bundle to a public file-sharing service.
   • DCopy the indicators into a spreadsheet and send it.
   Reveal Solution Discussion Select an answer first