SANS FOR578 – CYBER THREAT INTELLIGENCE (2025 UPDATE) – QUESTIONS
WITH VERIFIED ANSWERS AND STUDY GUIDE
intelligence - (answers)Collection, processing and analysis of information - Both process and product
Intelligence Sources - (answers)HUMINT
GEOINT
MASINT
SIGINT
OSINT
Counterintelligence - (answers)Identification, assesment, neutralization and exploitation of intell
activities of adversary
Kent´s analytical doctrine - (answers)1) Focus on policmaker concern
2) Avoidance of a personal policy Agenda
3) Intellectual rigor
4) Conscious effort to avoid analytical biases
5) Willingness to consider other Judgements
6) Systematic use of outside expertise
7) Collective responsibility for judgement
8) Effective communication of policy-support information and judgements
9) Candid admission of mistakes
Analysis - (answers)A detailed examination of the elements or structure of something.
, Data driven analysis - (answers)Drawing inferences based on examination of the intrinsic structure of
data.
Requires good datasets and straightforward problems.
Is logically driven and easily replicated.
Conceptually driven analysis - (answers)Numerous unknowns and undefined variables and
relationsships.
Often immidiate interpretation of complex concepts.
Accuracy driven by mental models and feedback over time.
Working memory - (answers)System that processes inputs and determines whether or not they are
important, encoding them for long-term or short-term memory storage
Pattern recognition - (answers)Cognitive process that matches information from external sources to
information that is stored in long-term memory.
Template matching - (answers)Every object and experience is processed by brain and stored as a
template in long-term memory. When presented with situation, long-term memory is searched for
matching template from the past.
Prototype matching - (answers)When presented with situation, long-term memory is searched for
AVERAGE or similiar templates reffered as a "prototype". More flexible then template matching and
better for working with incomplete information.
Top Down - (answers)Using previous knowledge (could be contextual) to fill in gaps when we do not have
complete information.
System I thinking - (answers)Intiutive thinking, fast, effective, often accurate but prone to errors. Draws
on available knowledge and experience and existing mental modes.
WITH VERIFIED ANSWERS AND STUDY GUIDE
intelligence - (answers)Collection, processing and analysis of information - Both process and product
Intelligence Sources - (answers)HUMINT
GEOINT
MASINT
SIGINT
OSINT
Counterintelligence - (answers)Identification, assesment, neutralization and exploitation of intell
activities of adversary
Kent´s analytical doctrine - (answers)1) Focus on policmaker concern
2) Avoidance of a personal policy Agenda
3) Intellectual rigor
4) Conscious effort to avoid analytical biases
5) Willingness to consider other Judgements
6) Systematic use of outside expertise
7) Collective responsibility for judgement
8) Effective communication of policy-support information and judgements
9) Candid admission of mistakes
Analysis - (answers)A detailed examination of the elements or structure of something.
, Data driven analysis - (answers)Drawing inferences based on examination of the intrinsic structure of
data.
Requires good datasets and straightforward problems.
Is logically driven and easily replicated.
Conceptually driven analysis - (answers)Numerous unknowns and undefined variables and
relationsships.
Often immidiate interpretation of complex concepts.
Accuracy driven by mental models and feedback over time.
Working memory - (answers)System that processes inputs and determines whether or not they are
important, encoding them for long-term or short-term memory storage
Pattern recognition - (answers)Cognitive process that matches information from external sources to
information that is stored in long-term memory.
Template matching - (answers)Every object and experience is processed by brain and stored as a
template in long-term memory. When presented with situation, long-term memory is searched for
matching template from the past.
Prototype matching - (answers)When presented with situation, long-term memory is searched for
AVERAGE or similiar templates reffered as a "prototype". More flexible then template matching and
better for working with incomplete information.
Top Down - (answers)Using previous knowledge (could be contextual) to fill in gaps when we do not have
complete information.
System I thinking - (answers)Intiutive thinking, fast, effective, often accurate but prone to errors. Draws
on available knowledge and experience and existing mental modes.
