ESTUDY
SANS FOR578 | 2025 UPDATE QUESTIONS WITH
VERIFIED ANSWERS AND RATIONALES
1. What is the primary focus of Kent's Analytical Doctrine?
a) Personal policy agenda
b) Policymaker concerns
c) Policymaker concerns
d) Adversary neutralization
Rationale: Kent's Analytical Doctrine emphasizes focusing on the concerns of policymakers to
ensure intelligence is actionable and relevant.
2. Which of the following is NOT a source of intelligence?
a) HUMINT
b) GEOINT
c) MASINT
d) COUNTERINT
Rationale: COUNTERINT refers to counterintelligence activities, not a source of intelligence.
3. What is the purpose of counterintelligence?
a) Collecting information from adversaries
b) Identifying, assessing, neutralizing, and exploiting adversary intelligence activities
c) Analyzing data for policymaker concerns
d) Disseminating intelligence to customers
Rationale: Counterintelligence focuses on identifying and neutralizing adversary intelligence
efforts.
4. Which intelligence source involves human-derived information?
a) HUMINT
b) SIGINT
c) OSINT
d) GEOINT
Rationale: HUMINT (Human Intelligence) involves information collected from human sources.
5. What is the final step in the Intelligence Cycle?
a) Collection
b) Analysis and Production
c) Dissemination
d) Processing and Exploitation
Rationale: Dissemination is the final step where intelligence is distributed to customers.
6. Which of the following is an example of OSINT?
a) Satellite imagery
,ESTUDY
b) Intercepted communications
c) Social media posts
d) Human informants
Rationale: OSINT (Open Source Intelligence) includes publicly available information like social
media posts.
7. What is the main goal of data-driven analysis?
a) Addressing complex, undefined problems
b) Drawing inferences based on the intrinsic structure of data
c) Using mental models for interpretation
d) Relying on intuition and experience
Rationale: Data-driven analysis focuses on structured data and logical inferences.
8. Which type of analysis is better suited for incomplete information?
a) Template matching
b) Prototype matching
c) Data-driven analysis
d) System I thinking
Rationale: Prototype matching is more flexible and works well with incomplete information.
9. What is System I thinking?
a) Slow, methodical, and conscious
b) Intuitive, fast, and prone to errors
c) Analytical and structured
d) Based on scientific methods
Rationale: System I thinking is fast and intuitive but can lead to errors.
10. Which family of Structured Analytical Techniques involves breaking problems into
components?
a) Reframing Techniques
b) Getting Organized
c) Exploration Techniques
d) Decision Support Techniques
Rationale: Getting Organized involves decomposition, breaking problems into smaller parts.
11. What is the role of working memory?
a) Long-term storage of information
b) Processing inputs and encoding them for storage
c) Matching information to templates
d) Analyzing complex concepts
Rationale: Working memory processes inputs and determines their importance for storage.
12. Which cognitive process matches external information to stored templates?
a) Prototype matching
, ESTUDY
b) Pattern recognition
c) Top-down processing
d) System II thinking
Rationale: Pattern recognition matches external information to stored templates in long-term
memory.
13. What is template matching?
a) Searching for an average template in memory
b) Matching current situations to exact stored templates
c) Using contextual knowledge to fill gaps
d) Relying on intuition for decision-making
Rationale: Template matching involves matching situations to exact stored templates.
14. Which cognitive process is more flexible for incomplete information?
a) Template matching
b) Prototype matching
c) Pattern recognition
d) System I thinking
Rationale: Prototype matching uses average or similar templates, making it more flexible.
15. What is top-down processing?
a) Using data to draw inferences
b) Using prior knowledge to fill gaps in information
c) Matching information to exact templates
d) Relying on intuition for analysis
Rationale: Top-down processing uses prior knowledge to interpret incomplete information.
16. Which step in the Intelligence Cycle involves identifying intelligence gaps?
a) Collection
b) Planning and Direction
c) Processing and Exploitation
d) Dissemination
Rationale: Planning and Direction involves identifying and prioritizing intelligence gaps.
17. What is the purpose of the Analysis and Production step?
a) Collecting raw data
b) Evaluating processed information to fill intelligence gaps
c) Distributing intelligence to customers
d) Filtering and transforming data
Rationale: Analysis and Production involves evaluating information to meet intelligence
requirements.
18. Which of the following is an example of Field of View Bias?
a) A security firm in the US and EU seeing the same threats
SANS FOR578 | 2025 UPDATE QUESTIONS WITH
VERIFIED ANSWERS AND RATIONALES
1. What is the primary focus of Kent's Analytical Doctrine?
a) Personal policy agenda
b) Policymaker concerns
c) Policymaker concerns
d) Adversary neutralization
Rationale: Kent's Analytical Doctrine emphasizes focusing on the concerns of policymakers to
ensure intelligence is actionable and relevant.
2. Which of the following is NOT a source of intelligence?
a) HUMINT
b) GEOINT
c) MASINT
d) COUNTERINT
Rationale: COUNTERINT refers to counterintelligence activities, not a source of intelligence.
3. What is the purpose of counterintelligence?
a) Collecting information from adversaries
b) Identifying, assessing, neutralizing, and exploiting adversary intelligence activities
c) Analyzing data for policymaker concerns
d) Disseminating intelligence to customers
Rationale: Counterintelligence focuses on identifying and neutralizing adversary intelligence
efforts.
4. Which intelligence source involves human-derived information?
a) HUMINT
b) SIGINT
c) OSINT
d) GEOINT
Rationale: HUMINT (Human Intelligence) involves information collected from human sources.
5. What is the final step in the Intelligence Cycle?
a) Collection
b) Analysis and Production
c) Dissemination
d) Processing and Exploitation
Rationale: Dissemination is the final step where intelligence is distributed to customers.
6. Which of the following is an example of OSINT?
a) Satellite imagery
,ESTUDY
b) Intercepted communications
c) Social media posts
d) Human informants
Rationale: OSINT (Open Source Intelligence) includes publicly available information like social
media posts.
7. What is the main goal of data-driven analysis?
a) Addressing complex, undefined problems
b) Drawing inferences based on the intrinsic structure of data
c) Using mental models for interpretation
d) Relying on intuition and experience
Rationale: Data-driven analysis focuses on structured data and logical inferences.
8. Which type of analysis is better suited for incomplete information?
a) Template matching
b) Prototype matching
c) Data-driven analysis
d) System I thinking
Rationale: Prototype matching is more flexible and works well with incomplete information.
9. What is System I thinking?
a) Slow, methodical, and conscious
b) Intuitive, fast, and prone to errors
c) Analytical and structured
d) Based on scientific methods
Rationale: System I thinking is fast and intuitive but can lead to errors.
10. Which family of Structured Analytical Techniques involves breaking problems into
components?
a) Reframing Techniques
b) Getting Organized
c) Exploration Techniques
d) Decision Support Techniques
Rationale: Getting Organized involves decomposition, breaking problems into smaller parts.
11. What is the role of working memory?
a) Long-term storage of information
b) Processing inputs and encoding them for storage
c) Matching information to templates
d) Analyzing complex concepts
Rationale: Working memory processes inputs and determines their importance for storage.
12. Which cognitive process matches external information to stored templates?
a) Prototype matching
, ESTUDY
b) Pattern recognition
c) Top-down processing
d) System II thinking
Rationale: Pattern recognition matches external information to stored templates in long-term
memory.
13. What is template matching?
a) Searching for an average template in memory
b) Matching current situations to exact stored templates
c) Using contextual knowledge to fill gaps
d) Relying on intuition for decision-making
Rationale: Template matching involves matching situations to exact stored templates.
14. Which cognitive process is more flexible for incomplete information?
a) Template matching
b) Prototype matching
c) Pattern recognition
d) System I thinking
Rationale: Prototype matching uses average or similar templates, making it more flexible.
15. What is top-down processing?
a) Using data to draw inferences
b) Using prior knowledge to fill gaps in information
c) Matching information to exact templates
d) Relying on intuition for analysis
Rationale: Top-down processing uses prior knowledge to interpret incomplete information.
16. Which step in the Intelligence Cycle involves identifying intelligence gaps?
a) Collection
b) Planning and Direction
c) Processing and Exploitation
d) Dissemination
Rationale: Planning and Direction involves identifying and prioritizing intelligence gaps.
17. What is the purpose of the Analysis and Production step?
a) Collecting raw data
b) Evaluating processed information to fill intelligence gaps
c) Distributing intelligence to customers
d) Filtering and transforming data
Rationale: Analysis and Production involves evaluating information to meet intelligence
requirements.
18. Which of the following is an example of Field of View Bias?
a) A security firm in the US and EU seeing the same threats
