GIAC GCTI Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Cyber Threat Intelligence (GCTI) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCTI certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCTI Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Cyber Threat Intelligence (GCTI) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Cyber Threat Intelligence exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCTI Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCTI Sample Questions:
01. Reviewing a junior analyst's work at a retail chain, the intel lead finds one Diamond event covering a whole intrusion. Its capability field lists a phishing document, an exploit, a backdoor and an archiving tool; its infrastructure field lists a sender address, a download site and two C2 domains; its phase reads Delivery through Actions on Objectives.
What is wrong with this record?
a) Nothing is wrong, because all four core features are filled with intrusion evidence
b) It merges several phase-specific events into one, so it should be split and linked in a thread
c) It lacks meta-features, so adding direction, methodology and resources would complete it
d) It should be recast as an activity group, which can hold every tool and address the intrusion used
02. The morning after news breaks of a breach at its payroll provider, a retail chain's CFO emails the CTI team: "Are we affected, and what should we do today?" The question is not on the team's requirements list.
How should the team classify the CFO's message?
a) A new priority intelligence requirement
b) Feedback on a delivered intelligence product
c) An entry for the team's collection plan
d) A request for information
03. A law firm's mail gateway blocks a spear-phishing e-mail because its sender address matches a known indicator. Nobody received or opened the message.
Why should the CTI analyst still detonate and analyze the quarantined attachment?
a) To confirm the gateway block ended the intrusion so the case can be closed
b) To name the responsible actor before any detection content is updated
c) To recover exploit and backdoor indicators for later-phase defenses
d) To count the block toward the gateway's success metric in the monthly report
04. Over one year, a county government's response team handled three intrusions by the same adversary. Each time it patched the exploited vulnerability and closed the case, and each time the adversary returned with a different exploit but recognizable lures and infrastructure.
Which assumption in the team's approach let the intrusions repeat?
a) That each compromise was a fixable flaw, to be handled after the fact
b) That the adversary had to be named before the team could act
c) That more vulnerability scanning would find the next flaw
d) That patches had to be deployed faster, before the adversary could exploit each flaw
05. Analysts at a managed security provider track a group they call AMBER LYNX. With the registrar's cooperation, they redirect one of the group's expired C2 domains to a sinkhole server they operate, which logs every incoming connection.
What does the sinkhole log most directly add to the team's intelligence?
a) The operator's identity, taken from the registration record the domain now carries
b) Sibling domains from reverse passive DNS on the sinkhole
c) The exploit and lure used for initial access
d) The victim systems that are still sending beacons to the domain
06. Hunting in sensor data at a defense supplier, an analyst pivots on the JA3 of a confirmed implant session and finds no other matches. Inspection shows the implant's TLS client shuffles the order of its extensions on every connection, and its destinations are all the same type of HTTPS server.
Which fingerprint should the analyst pivot on to find the implant's other sessions?
a) The JA4 client fingerprint, which builds its hashes from sorted cipher and extension lists
b) The issuer name on the server's certificate
c) The JA3S fingerprint of the server's response
d) JA3 recomputed after removing GREASE values, which discards the random filler entries
07. After a briefing on the Pyramid of Pain, a telecom's security manager proposes removing every hash and IP address indicator from the blocking and alerting tools and relying on behavior detections instead.
How should the CTI lead respond?
a) Agree, and accept the higher false-positive rate that comes with relying only on the more durable behavior detections
b) Keep them alongside behavior detections, since adversaries do not always change them and they are precise
c) Keep only the domain names, since they sit between hashes and TTPs on the pyramid
d) Agree, since hashes and IP addresses cost the adversary so little to change that they add no detection value
08. Credential-phishing domains aimed at a logistics firm's staff stay live for about two days each. Every one serves the same login page, which loads /assets/lx-auth-91c.js.
Which two pivots are most likely to find new domains of this operation in internet scan or crawl data?
(Choose two.)
a) The large registrar used for all of the domains
b) A structural hash of the login page's HTML tag layout
c) The resource path /assets/lx-auth-91c.js
d) The top-level domain the domains are registered under
e) The hosting provider's ASN that each of the current domains sits in
09. Sector reporting shows that several intrusions at peer plants began through a maintenance vendor's standing remote access account. A regional water utility uses the same vendor, which holds an always-on VPN account into the utility's plant network.
Which two actions should the utility's CTI team recommend in response to this reporting?
(Choose two.)
a) Make vendor access per session and time limited
b) Patch the vendor's application servers and record the risk as closed
c) Log the vendor's sessions as a collection source and add its access paths to the threat model
d) Exclude the vendor's sessions from monitoring as routine noise
e) Accept the vendor's annual security attestation and contract terms as assurance in place of monitoring its account activity
10. Midway through an investigation, a defense supplier's CTI analyst wants to send trust-community partners a set of indicators, observed data and a campaign object. The analyst wants the STIX content itself to state that these objects belong to one ongoing analysis that partners are invited to examine; no finished intelligence product exists yet.
Which STIX object fits this need?
a) A Grouping that references the objects
b) A Report that references each of the objects
c) A Campaign object linked to every other object
d) A Bundle holding the objects
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: d |
Question: 03 Answer: c |
Question: 04 Answer: a |
Question: 05 Answer: d |
|
Question: 06 Answer: a |
Question: 07 Answer: b |
Question: 08 Answer: b, c |
Question: 09 Answer: a, c |
Question: 10 Answer: a |
Note: For any error in GIAC Cyber Threat Intelligence (GCTI) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
