Sharing Intelligence GCTI Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary role of an Information Sharing and Analysis Organization (ISAO)?

   • ATo enforce mandatory reporting of cyber incidents to the government
   • BTo provide a flexible framework for any group to share threat intelligence
   • CTo sell threat intelligence to private companies
   • DTo replace all other sharing mechanisms with a single global standard
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company's threat intelligence team wants to justify participation in an intelligence sharing community to senior management. Which benefit is most directly tied to improving the organization's security posture?

   • AEliminating the risk of cyber attacks entirely.
   • BReducing the need for internal security monitoring.
   • CSatisfying regulatory requirements for all industries.
   • DGaining early warning of emerging threats and attack patterns from other members.
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   An organization uses MISP to share intelligence with partners. The SOC wants to automatically block indicators in the firewall but is concerned about false positives causing business disruption. What is the best way to balance automation and risk?

   • AConfigure MISP to push only indicators with a high confidence level and a low false-positive rate to the firewall.
   • BBlock all IPs from the same /8 subnet as any indicator.
   • CDisable automatic sharing and manually review every indicator before blocking.
   • DPush all indicators to the firewall automatically to ensure maximum protection.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations center (SOC) receives a STIX 2.1 bundle from a partner organization. The SOC's SIEM cannot natively parse STIX. What is the most efficient way to operationalize the indicators in the SIEM?

   • AManually copy the indicator values from the STIX JSON into the SIEM's detection rules.
   • BUse a TAXII client to pull the bundle and a STIX-to-SIEM converter to transform indicators into the SIEM's native format.
   • CAsk the partner to resend the indicators in a CSV file.
   • DImport the STIX bundle directly into the SIEM without any transformation.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A regional bank is considering joining a financial-sector Information Sharing and Analysis Center (ISAC) to improve its threat visibility. The bank's compliance team is concerned about sharing sensitive indicators with other members. Which approach best addresses the compliance concern while still benefiting from the ISAC?

   • ARefuse to share any data but subscribe to the ISAC's public threat feed.
   • BShare only anonymized indicators and participate in the ISAC's threat briefings and analysis calls.
   • CShare all indicators directly with the ISAC's legal counsel for review before distribution.
   • DJoin the ISAC but only share indicators that are already publicly available from open-source feeds.
   Reveal Solution Discussion Select an answer first