GIAC CYBER THREAT INTELLIGENCE (GCTI)
EXAMINATION COMPLETE QUESTIONS AND DETAILED
SOLUTIONS LATEST UPDATE THIS YEAR JUST RELEASED
1. Which characteristic most clearly distinguishes cyber threat intelligence
from raw cybersecurity data collected from security monitoring systems?
A. Intelligence contains only technical indicators such as IP addresses and
hashes.
B. Intelligence provides analyzed context that supports a specific decision or
action.
C. Intelligence is always generated automatically by security information
systems.
D. Intelligence must originate exclusively from classified government
sources.
Answer: B
Rationale: Raw data becomes intelligence when it is processed, analyzed,
contextualized, and connected to a decision or intelligence requirement.
2. An organization wants intelligence that helps executives understand
how a geopolitical conflict could affect its cyber risk exposure. Which
intelligence level is most appropriate?
A. Tactical intelligence
B. Technical intelligence
C. Strategic intelligence
D. Operational telemetry
,Answer: C
Rationale: Strategic intelligence addresses broad trends, geopolitical
developments, business risks, and long-term decisions.
3. A threat intelligence analyst receives an unfamiliar malware hash
without any additional information. What should the analyst do first
before treating it as meaningful intelligence?
A. Immediately block the hash throughout the enterprise
B. Determine the hash's provenance, context, and associated activity
C. Attribute the malware to the most sophisticated known threat actor
D. Publish the hash in an external intelligence report
Answer: B
Rationale: An isolated indicator has limited meaning. Provenance and
context help determine whether it is relevant, current, and trustworthy.
4. Which statement best describes an intelligence requirement within a
mature cyber threat intelligence program?
A. A list of every security event generated by endpoint systems
B. A question whose answer supports a defined organizational decision or
mission
C. A collection of malware samples obtained from external researchers
D. A database containing all known vulnerabilities
Answer: B
Rationale: Intelligence requirements define what decision-makers need to
know and guide collection and analysis activities.
,5. An intelligence team repeatedly provides reports containing technically
accurate information that executives never use. Which improvement
would most directly address the problem?
A. Increase the number of indicators in every report
B. Align intelligence products with stakeholder decisions and requirements
C. Remove all analytical judgments from the reports
D. Replace human analysts with automated enrichment systems
Answer: B
Rationale: Intelligence should be decision-driven. Understanding
stakeholder requirements makes reporting more relevant and actionable.
6. Which intelligence discipline focuses most heavily on adversary actions,
campaigns, capabilities, and likely objectives?
A. Operational intelligence
B. Strategic accounting
C. Financial auditing
D. Asset inventory intelligence
Answer: A
Rationale: Operational intelligence examines campaigns, threat actors,
intent, capabilities, and activities over meaningful operational timeframes.
7. Why is source evaluation particularly important when analysts use
publicly available information for cyber threat intelligence?
, A. Public sources are always inaccurate.
B. Public information can vary substantially in reliability, provenance, bias,
and timeliness.
C. Public information cannot contain technical indicators.
D. Public information is automatically classified once collected by analysts.
Answer: B
Rationale: OSINT can be extremely valuable, but analysts must evaluate
source reliability, corroboration, bias, and currency.
8. Which situation represents the strongest example of intelligence
enrichment?
A. Copying an IP address into a spreadsheet
B. Adding WHOIS, passive DNS, malware, and campaign context to an IP
address
C. Increasing the number of indicators in a blocklist
D. Reformatting a threat report into PDF format
Answer: B
Rationale: Enrichment adds contextual information that helps analysts
interpret the significance of an indicator.
9. A threat actor repeatedly uses the same unusual phishing infrastructure
across several campaigns. What analytical concept can help identify this
recurring behavior?
A. Behavioral pattern analysis
B. Data normalization only
EXAMINATION COMPLETE QUESTIONS AND DETAILED
SOLUTIONS LATEST UPDATE THIS YEAR JUST RELEASED
1. Which characteristic most clearly distinguishes cyber threat intelligence
from raw cybersecurity data collected from security monitoring systems?
A. Intelligence contains only technical indicators such as IP addresses and
hashes.
B. Intelligence provides analyzed context that supports a specific decision or
action.
C. Intelligence is always generated automatically by security information
systems.
D. Intelligence must originate exclusively from classified government
sources.
Answer: B
Rationale: Raw data becomes intelligence when it is processed, analyzed,
contextualized, and connected to a decision or intelligence requirement.
2. An organization wants intelligence that helps executives understand
how a geopolitical conflict could affect its cyber risk exposure. Which
intelligence level is most appropriate?
A. Tactical intelligence
B. Technical intelligence
C. Strategic intelligence
D. Operational telemetry
,Answer: C
Rationale: Strategic intelligence addresses broad trends, geopolitical
developments, business risks, and long-term decisions.
3. A threat intelligence analyst receives an unfamiliar malware hash
without any additional information. What should the analyst do first
before treating it as meaningful intelligence?
A. Immediately block the hash throughout the enterprise
B. Determine the hash's provenance, context, and associated activity
C. Attribute the malware to the most sophisticated known threat actor
D. Publish the hash in an external intelligence report
Answer: B
Rationale: An isolated indicator has limited meaning. Provenance and
context help determine whether it is relevant, current, and trustworthy.
4. Which statement best describes an intelligence requirement within a
mature cyber threat intelligence program?
A. A list of every security event generated by endpoint systems
B. A question whose answer supports a defined organizational decision or
mission
C. A collection of malware samples obtained from external researchers
D. A database containing all known vulnerabilities
Answer: B
Rationale: Intelligence requirements define what decision-makers need to
know and guide collection and analysis activities.
,5. An intelligence team repeatedly provides reports containing technically
accurate information that executives never use. Which improvement
would most directly address the problem?
A. Increase the number of indicators in every report
B. Align intelligence products with stakeholder decisions and requirements
C. Remove all analytical judgments from the reports
D. Replace human analysts with automated enrichment systems
Answer: B
Rationale: Intelligence should be decision-driven. Understanding
stakeholder requirements makes reporting more relevant and actionable.
6. Which intelligence discipline focuses most heavily on adversary actions,
campaigns, capabilities, and likely objectives?
A. Operational intelligence
B. Strategic accounting
C. Financial auditing
D. Asset inventory intelligence
Answer: A
Rationale: Operational intelligence examines campaigns, threat actors,
intent, capabilities, and activities over meaningful operational timeframes.
7. Why is source evaluation particularly important when analysts use
publicly available information for cyber threat intelligence?
, A. Public sources are always inaccurate.
B. Public information can vary substantially in reliability, provenance, bias,
and timeliness.
C. Public information cannot contain technical indicators.
D. Public information is automatically classified once collected by analysts.
Answer: B
Rationale: OSINT can be extremely valuable, but analysts must evaluate
source reliability, corroboration, bias, and currency.
8. Which situation represents the strongest example of intelligence
enrichment?
A. Copying an IP address into a spreadsheet
B. Adding WHOIS, passive DNS, malware, and campaign context to an IP
address
C. Increasing the number of indicators in a blocklist
D. Reformatting a threat report into PDF format
Answer: B
Rationale: Enrichment adds contextual information that helps analysts
interpret the significance of an indicator.
9. A threat actor repeatedly uses the same unusual phishing infrastructure
across several campaigns. What analytical concept can help identify this
recurring behavior?
A. Behavioral pattern analysis
B. Data normalization only
