SANS FOR578 EXAM QUESTIONS AND
ANSWERS
School of Thought - Answers -A perspective of a group with common opinions and
disciplines
Natural School of Thought - Answers -A school of thought in which the analyst identifies
a pattern in similar data.
Law Enforcement Agency School of Thought - Answers -A school of thought in which
you generate intelligence based on who did a crime. Focuses on attribution.
Intelligence Agency School of Thought - Answers -A school of thought based on the
classic intelligence life cycle and applying requirements.
Moonlight Maze - Answers -A case study that offers an early look at CTI tradecraft.
Showed the importance of analyzing the larger picture over a series of intrusions.
Artifacts and indicators may prove useful years after.
Cyber - Answers -A living system
Intelligence - Answers -The collection, processing, and analysis of information about a
competitive entity and its agents, needed by an organization or group for its security and
well-being.
GEOINT - Answers -Geospatial intelligence collection from satellites.
MASINT - Answers -Measurement and signature intelligence from radar signatures,
nuclear detonation signatures.
Confirmation Bias - Answers -The tendency to include or reject evidence based on its
alignment to a preferred hypothesis.
Congruence Bias - Answers -Form of confirmation bias with the failure to adequately
present and test alternative competing hypothesis, and instead find different ways to
present data that tests and existing hypothesis.
Hindsight Bias - Answers -The tendency to see an unpredictable event as an obvious
result of a set of conditions or parameters
, SIGINT - Answers -Intelligence derived from signal intercepts, such as cell phone
communications or tapping of communications lines.
Counterintelligence - Answers -The identification, assessment, neutralization, and
exploitation of intelligence activities of adversarial entities.
Operation Bodyguard - Answers -A case study showcasing the complexity involved in
counterintelligence. Allies spread disinformation that D-Day invasions were occurring
later than reality and at different locations than Normandy in order to confuse
adversaries.
Sherman Kent - Answers -Considered the father of intelligence analysis. Argued that it
is important to give information with an assessment, since leaders do not have the time
or expertise to make good decisions on the data alone.
Richards J. Heuer Jr. - Answers -A intelligence analyst focused on structuring analysis,
analysis types, critical thinking models and approaches, and overcoming biases that
hinder analyst thought processes.
Analysis - Answers -A detailed examination of the elements or structure of something.;
Breaking something down into its constituent parts to understand its operation.
Synthesis - Answers -Pulling in data from other sources aside from the event we are
analyzing, including historical information from both the targeted organization as well as
outside entities, and reaching out to other digital forensics and IR fields such as
malware analysis and forensics.
Analytical Judgement - Answers -Going beyond the facts to assess what the information
signifies and how it impacts whatever organization they are supporting. It is made to
meet a specific intelligence requirement and is based off of available data and
information while acknowledging the information gaps and remaining uncertainties.
Data-Driven Analysis - Answers -A type of analysis driven by pre-existing or previously
developed analytic models and is based on the assumptions that both the data and the
model are accurate and applicable.
Conceptually-Driven Analysis - Answers -A type of analysis driven is analysis based on
numerous unknowns and undefined variables and relationships. It is often immediate
interpretation of complex concepts and accuracy is driven by mental models and
feedback over time.
Working Memory - Answers -The system that processes inputs and determines whether
or not they are important, encoding them either for long-term memory storage or short-
term memory. Tells your brain what to focus on and retain.
ANSWERS
School of Thought - Answers -A perspective of a group with common opinions and
disciplines
Natural School of Thought - Answers -A school of thought in which the analyst identifies
a pattern in similar data.
Law Enforcement Agency School of Thought - Answers -A school of thought in which
you generate intelligence based on who did a crime. Focuses on attribution.
Intelligence Agency School of Thought - Answers -A school of thought based on the
classic intelligence life cycle and applying requirements.
Moonlight Maze - Answers -A case study that offers an early look at CTI tradecraft.
Showed the importance of analyzing the larger picture over a series of intrusions.
Artifacts and indicators may prove useful years after.
Cyber - Answers -A living system
Intelligence - Answers -The collection, processing, and analysis of information about a
competitive entity and its agents, needed by an organization or group for its security and
well-being.
GEOINT - Answers -Geospatial intelligence collection from satellites.
MASINT - Answers -Measurement and signature intelligence from radar signatures,
nuclear detonation signatures.
Confirmation Bias - Answers -The tendency to include or reject evidence based on its
alignment to a preferred hypothesis.
Congruence Bias - Answers -Form of confirmation bias with the failure to adequately
present and test alternative competing hypothesis, and instead find different ways to
present data that tests and existing hypothesis.
Hindsight Bias - Answers -The tendency to see an unpredictable event as an obvious
result of a set of conditions or parameters
, SIGINT - Answers -Intelligence derived from signal intercepts, such as cell phone
communications or tapping of communications lines.
Counterintelligence - Answers -The identification, assessment, neutralization, and
exploitation of intelligence activities of adversarial entities.
Operation Bodyguard - Answers -A case study showcasing the complexity involved in
counterintelligence. Allies spread disinformation that D-Day invasions were occurring
later than reality and at different locations than Normandy in order to confuse
adversaries.
Sherman Kent - Answers -Considered the father of intelligence analysis. Argued that it
is important to give information with an assessment, since leaders do not have the time
or expertise to make good decisions on the data alone.
Richards J. Heuer Jr. - Answers -A intelligence analyst focused on structuring analysis,
analysis types, critical thinking models and approaches, and overcoming biases that
hinder analyst thought processes.
Analysis - Answers -A detailed examination of the elements or structure of something.;
Breaking something down into its constituent parts to understand its operation.
Synthesis - Answers -Pulling in data from other sources aside from the event we are
analyzing, including historical information from both the targeted organization as well as
outside entities, and reaching out to other digital forensics and IR fields such as
malware analysis and forensics.
Analytical Judgement - Answers -Going beyond the facts to assess what the information
signifies and how it impacts whatever organization they are supporting. It is made to
meet a specific intelligence requirement and is based off of available data and
information while acknowledging the information gaps and remaining uncertainties.
Data-Driven Analysis - Answers -A type of analysis driven by pre-existing or previously
developed analytic models and is based on the assumptions that both the data and the
model are accurate and applicable.
Conceptually-Driven Analysis - Answers -A type of analysis driven is analysis based on
numerous unknowns and undefined variables and relationships. It is often immediate
interpretation of complex concepts and accuracy is driven by mental models and
feedback over time.
Working Memory - Answers -The system that processes inputs and determines whether
or not they are important, encoding them either for long-term memory storage or short-
term memory. Tells your brain what to focus on and retain.
