Sharing Intelligence GCTI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst at a mid-sized company wants to share a new malware signature with a peer organization that uses a different SIEM platform. The analyst has the malware's file hash, C2 domain, and a YARA rule. Which approach best enables automated, structured sharing between the two organizations?

   • AExport the indicators in the company's SIEM proprietary format and send the file to the peer.
   • BPublish the indicators as STIX 2.1 objects and exchange them via a TAXII 2.1 server.
   • CPost the indicators on a public paste site and hope the peer finds them.
   • DEmail the file hash and domain to the peer's analyst, who will manually enter them into their SIEM.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A multinational corporation participates in an ISAO that shares threat intelligence across industries. The ISAO's sharing agreement includes a 'safe harbor' clause that protects members from liability when sharing indicators in good faith. The corporation's legal team is concerned about sharing data that may include personal information of customers. The security team wants to share a set of IP addresses and domain names associated with a recent phishing campaign. What is the most appropriate action?

   • AShare only the domain names, not the IP addresses, because IP addresses are always personal data.
   • BShare the indicators after pseudonymizing any embedded personal data and confirming the safe harbor clause covers good-faith sharing.
   • CShare the raw indicators without review because the safe harbor clause eliminates all liability.
   • DRefuse to share any indicators because of potential GDPR violations.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A government agency wants to share threat intelligence with private sector companies in critical infrastructure sectors. Which model is most appropriate for this public-private collaboration?

   • ACreate a private forum with no formal rules or agreements.
   • BEstablish a public-private partnership that includes formal agreements and regular information exchange.
   • CShare intelligence only through public press releases.
   • DRequire companies to sign non-disclosure agreements individually before any sharing.
   Reveal Solution Discussion Select an answer first
5. 34expert · medium

   A large enterprise receives a high-volume STIX feed from an ISAC. The SOC wants to use this feed to block malicious IPs at the firewall, but the firewall has a limited rule capacity. The feed contains many IPs with varying confidence levels. What is the best approach to maximize protection while avoiding firewall rule exhaustion?

   • APush all IPs from the feed to the firewall regardless of confidence.
   • BIngest the feed into a TIP, filter indicators by confidence and relevance, and push only high-confidence IPs to the firewall.
   • CManually review the feed daily and add the most recent IPs to the firewall.
   • DBlock the entire IP ranges from which the feed originates.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company receives a TAXII feed with indicators of a new exploit kit. The security team wants to use this intelligence to proactively block the exploit kit's delivery domains. What is the most effective way to operationalize this intelligence?

   • ASend the domains to the marketing team for awareness.
   • BAutomatically push the domains to the DNS sinkhole and web proxy blocklists.
   • CManually add the domains to a text file for reference.
   • DWait for the exploit kit to be seen in the network before acting.
   Reveal Solution Discussion Select an answer first