GIAC CYBER THREAT INTELLIGENCE (GCTI) – QUESTIONS AND ANSWERS | VERIFIED AND WELL
DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED PASS | LATEST EXAM UPDATE
Core Domains
1. Cyber Threat Intelligence (CTI) Fundamentals and Concepts
2. Intelligence Lifecycle and Methodologies (DIRT Model)
3. Threat Modeling, Profiling, and Adversary Emulation
4. Strategic, Operational, and Tactical Intelligence
5. Indicators of Compromise (IOCs) and Indicator Management
6. Intelligence Collection, Analysis, and Production
7. Cyber Threat Frameworks (MITRE ATT&CK, Cyber Kill Chain, Diamond Model)
8. Legal, Ethical, and Privacy Considerations in CTI
9. Intelligence Sharing, Communication, and Reporting
10. Vulnerability, Risk, and Impact Assessment in CTI
Introduction
This comprehensive assessment is designed to rigorously evaluate a candidate's mastery of the GIAC
Cyber Threat Intelligence (GCTI) body of knowledge. It covers foundational theories, the complete
intelligence lifecycle, and practical application of threat frameworks. The examination consists of 200
multiple-choice questions, divided into two sections, that integrate theoretical understanding with
scenario-based problem-solving. The questions emphasize real-world decision-making, analytical
reasoning, and the professional application of intelligence to enhance an organization's security
posture. This practice test is a vital tool for exam preparation, ensuring candidates are well-versed in
all critical subject areas and can confidently apply their knowledge in a professional context.
SECTION ONE: QUESTIONS 1 – 100
1. What is the primary goal of Cyber Threat Intelligence?
A. To collect as much data as possible about potential threats.
B. To provide a comprehensive historical log of all cyber incidents.
C. To reduce uncertainty about potential threats and inform decisions.
D. To ensure all security tools are updated with the latest signatures.
🟢 C. To reduce uncertainty about potential threats and inform decisions.
🔴 Explanation: The primary goal of CTI is to reduce uncertainty about the capabilities, intentions,
and activities of adversaries, enabling informed and proactive security decisions. While collection
and updates are part of the process, they are not the ultimate goal.
2. The term 'Raw Data' in the context of CTI refers to:
A. Intelligence that has been processed and analyzed for a specific audience.
B. Unprocessed information or observations from various sources.
C. The final report delivered to senior leadership.
D. Classified information from government agencies.
🟢 B. Unprocessed information or observations from various sources.
,🔴 Explanation: Raw data is the foundational, unprocessed input that feeds into the intelligence
cycle. It is not yet intelligence; it requires processing and analysis to add context, relevance, and
value.
3. Which of the following best describes the concept of the 'Intelligence Cycle'?
A. A linear process that ends with the dissemination of a report.
B. A continuous, iterative process for collecting, processing, and disseminating intelligence.
C. A set of rules for classifying different types of cyber threats.
D. A framework for assigning blame to specific threat actors.
🟢 B. A continuous, iterative process for collecting, processing, and disseminating intelligence.
🔴 Explanation: The Intelligence Cycle is a continuous, closed-loop process that includes planning,
collection, processing, analysis, dissemination, and feedback. It is iterative, with each step informing
the next, ensuring the intelligence remains relevant and timely.
4. At what stage of the intelligence lifecycle is 'Data' transformed into 'Information'?
A. Direction
B. Collection
C. Processing
D. Analysis
🟢 C. Processing
🔴 Explanation: The processing stage is where raw data is translated, filtered, and aggregated into
a more usable format, effectively transforming it into information. Analysis then further transforms
this information into intelligence.
5. Which type of intelligence focuses on long-term strategic goals and the overall threat
landscape?
A. Operational Intelligence
B. Tactical Intelligence
C. Strategic Intelligence
D. Technical Intelligence
🟢 C. Strategic Intelligence
🔴 Explanation: Strategic Intelligence is broad in scope and is used by senior management to
understand the long-term business risks and the threat landscape. It focuses on high-level trends,
motivations, and capabilities of adversaries.
6. An intelligence analyst is tasked with creating a report for a Security Operations Center (SOC)
analyst. What type of intelligence is most useful?
A. Strategic Intelligence
B. Tactical Intelligence
C. Operational Intelligence
D. Executive Intelligence
🟢 B. Tactical Intelligence
🔴 Explanation: Tactical Intelligence is focused on providing specific Indicators of Compromise
(IOCs) and TTPs to be directly used by security operations personnel like SOC analysts, incident
, responders, and network defenders.
7. What does the acronym 'PIR' stand for in the context of intelligence?
A. Primary Intelligence Requirement
B. Priority Intelligence Request
C. Proactive Intelligence Response
D. Priority Information Requirement
🟢 D. Priority Information Requirement
🔴 Explanation: Priority Information Requirement (PIR) is a critical intelligence gap that a
commander or decision-maker identifies as essential to making a decision. It is a key component of
the Direction phase.
8. A threat actor is known for using phishing emails to gain initial access. According to the Cyber
Kill Chain, which phase does this represent?
A. Reconnaissance
B. Weaponization
C. Delivery
D. Exploitation
🟢 C. Delivery
🔴 Explanation: The Delivery phase of the Cyber Kill Chain involves the transmission of the
weaponized payload to the target, which can be done via email (phishing), web, or removable
media.
9. An attacker has successfully established a foothold inside a network and is moving laterally to
other systems. In the Cyber Kill Chain, this is known as:
A. Installation
B. Command and Control (C2)
C. Reconnaissance
D. Actions on Objectives
🟢 A. Installation
🔴 Explanation: Installation is the phase where the attacker establishes a persistent presence within
the network, often by installing a backdoor or other malware, enabling further actions like lateral
movement.
10. The 'Diamond Model' of intrusion analysis uses four core features to analyze an intrusion
event. Which of the following is NOT one of them?
A. Adversary
B. Capability
C. Infrastructure
D. Motivation
🟢 D. Motivation
🔴 Explanation: The four core features of the Diamond Model are Adversary, Capability,
Infrastructure, and Victim. Motivation is considered a meta-feature or an attribute of the Adversary,
not a core feature itself.
DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED PASS | LATEST EXAM UPDATE
Core Domains
1. Cyber Threat Intelligence (CTI) Fundamentals and Concepts
2. Intelligence Lifecycle and Methodologies (DIRT Model)
3. Threat Modeling, Profiling, and Adversary Emulation
4. Strategic, Operational, and Tactical Intelligence
5. Indicators of Compromise (IOCs) and Indicator Management
6. Intelligence Collection, Analysis, and Production
7. Cyber Threat Frameworks (MITRE ATT&CK, Cyber Kill Chain, Diamond Model)
8. Legal, Ethical, and Privacy Considerations in CTI
9. Intelligence Sharing, Communication, and Reporting
10. Vulnerability, Risk, and Impact Assessment in CTI
Introduction
This comprehensive assessment is designed to rigorously evaluate a candidate's mastery of the GIAC
Cyber Threat Intelligence (GCTI) body of knowledge. It covers foundational theories, the complete
intelligence lifecycle, and practical application of threat frameworks. The examination consists of 200
multiple-choice questions, divided into two sections, that integrate theoretical understanding with
scenario-based problem-solving. The questions emphasize real-world decision-making, analytical
reasoning, and the professional application of intelligence to enhance an organization's security
posture. This practice test is a vital tool for exam preparation, ensuring candidates are well-versed in
all critical subject areas and can confidently apply their knowledge in a professional context.
SECTION ONE: QUESTIONS 1 – 100
1. What is the primary goal of Cyber Threat Intelligence?
A. To collect as much data as possible about potential threats.
B. To provide a comprehensive historical log of all cyber incidents.
C. To reduce uncertainty about potential threats and inform decisions.
D. To ensure all security tools are updated with the latest signatures.
🟢 C. To reduce uncertainty about potential threats and inform decisions.
🔴 Explanation: The primary goal of CTI is to reduce uncertainty about the capabilities, intentions,
and activities of adversaries, enabling informed and proactive security decisions. While collection
and updates are part of the process, they are not the ultimate goal.
2. The term 'Raw Data' in the context of CTI refers to:
A. Intelligence that has been processed and analyzed for a specific audience.
B. Unprocessed information or observations from various sources.
C. The final report delivered to senior leadership.
D. Classified information from government agencies.
🟢 B. Unprocessed information or observations from various sources.
,🔴 Explanation: Raw data is the foundational, unprocessed input that feeds into the intelligence
cycle. It is not yet intelligence; it requires processing and analysis to add context, relevance, and
value.
3. Which of the following best describes the concept of the 'Intelligence Cycle'?
A. A linear process that ends with the dissemination of a report.
B. A continuous, iterative process for collecting, processing, and disseminating intelligence.
C. A set of rules for classifying different types of cyber threats.
D. A framework for assigning blame to specific threat actors.
🟢 B. A continuous, iterative process for collecting, processing, and disseminating intelligence.
🔴 Explanation: The Intelligence Cycle is a continuous, closed-loop process that includes planning,
collection, processing, analysis, dissemination, and feedback. It is iterative, with each step informing
the next, ensuring the intelligence remains relevant and timely.
4. At what stage of the intelligence lifecycle is 'Data' transformed into 'Information'?
A. Direction
B. Collection
C. Processing
D. Analysis
🟢 C. Processing
🔴 Explanation: The processing stage is where raw data is translated, filtered, and aggregated into
a more usable format, effectively transforming it into information. Analysis then further transforms
this information into intelligence.
5. Which type of intelligence focuses on long-term strategic goals and the overall threat
landscape?
A. Operational Intelligence
B. Tactical Intelligence
C. Strategic Intelligence
D. Technical Intelligence
🟢 C. Strategic Intelligence
🔴 Explanation: Strategic Intelligence is broad in scope and is used by senior management to
understand the long-term business risks and the threat landscape. It focuses on high-level trends,
motivations, and capabilities of adversaries.
6. An intelligence analyst is tasked with creating a report for a Security Operations Center (SOC)
analyst. What type of intelligence is most useful?
A. Strategic Intelligence
B. Tactical Intelligence
C. Operational Intelligence
D. Executive Intelligence
🟢 B. Tactical Intelligence
🔴 Explanation: Tactical Intelligence is focused on providing specific Indicators of Compromise
(IOCs) and TTPs to be directly used by security operations personnel like SOC analysts, incident
, responders, and network defenders.
7. What does the acronym 'PIR' stand for in the context of intelligence?
A. Primary Intelligence Requirement
B. Priority Intelligence Request
C. Proactive Intelligence Response
D. Priority Information Requirement
🟢 D. Priority Information Requirement
🔴 Explanation: Priority Information Requirement (PIR) is a critical intelligence gap that a
commander or decision-maker identifies as essential to making a decision. It is a key component of
the Direction phase.
8. A threat actor is known for using phishing emails to gain initial access. According to the Cyber
Kill Chain, which phase does this represent?
A. Reconnaissance
B. Weaponization
C. Delivery
D. Exploitation
🟢 C. Delivery
🔴 Explanation: The Delivery phase of the Cyber Kill Chain involves the transmission of the
weaponized payload to the target, which can be done via email (phishing), web, or removable
media.
9. An attacker has successfully established a foothold inside a network and is moving laterally to
other systems. In the Cyber Kill Chain, this is known as:
A. Installation
B. Command and Control (C2)
C. Reconnaissance
D. Actions on Objectives
🟢 A. Installation
🔴 Explanation: Installation is the phase where the attacker establishes a persistent presence within
the network, often by installing a backdoor or other malware, enabling further actions like lateral
movement.
10. The 'Diamond Model' of intrusion analysis uses four core features to analyze an intrusion
event. Which of the following is NOT one of them?
A. Adversary
B. Capability
C. Infrastructure
D. Motivation
🟢 D. Motivation
🔴 Explanation: The four core features of the Diamond Model are Adversary, Capability,
Infrastructure, and Victim. Motivation is considered a meta-feature or an attribute of the Adversary,
not a core feature itself.
