Cybersecurity cert-prep add-on

GIAC Cyber Threat Intelligence (GCTI) Exam Prep Add-On

Convert Threat Intelligence Fundamentals into a GCTI ramp aligned to SANS FOR578 outcomes.

$147 add-on50h additional studyTarget exam: GCTI (GIAC Cyber Threat Intelligence)Exam fee: $999

What the add-on ships

++Domain reviews mapped to the official GIAC GCTI exam outline
++Open-book index development support, including index template and indexing methodology guide
++Three full-length 75-question mock exams aligned to the GIAC scenario format
++ICD 203 analytic tradecraft and structured analytic techniques review
++Direct link to the official GIAC GCTI exam outline as the canonical reference

Built on the parent course

++Threat Intelligence Fundamentals seven-module curriculum grounded in MITRE ATT&CK, the Diamond Model, the Cyber Kill Chain, STIX/TAXII, and SANS CTI maturity
++Collection, analysis, dissemination, and analytic-tradecraft practice from the parent course

Parent course: threat intelligence fundamentals

Best for

++CTI analysts moving from junior to senior with a SANS-track credential as the validating signal
++Threat hunters specializing in attribution, kill chain, and Diamond Model analysis
++Detection engineers cross-training into CTI for analyst-tradecraft fluency

Practice surface

++Three 75-question mock exams with GIAC scenario format
++Open-book index template and methodology for exam-day reference building
++Targeted weak-area question drilling per GIAC GCTI domain weighting

Buy the add-on

$147 on top of the threat intelligence fundamentals parent course. Lifetime access to the practice materials, mock exams, and exam-day worksheets.

See the parent course

Exam summary

GIAC Cyber Threat Intelligence (GCTI) covers the CTI lifecycle, threat actor analysis, kill chain and Diamond Model analysis, structured analytic techniques, and intelligence report writing. The exam is open-book; the candidate's hand-built index is the working reference. 75 scenario-style multiple-choice questions; pass score is published per-exam by GIAC.

Domain reviews

CTI Lifecycle and Tradecraft

Direction, collection, processing, analysis, dissemination, feedback.

++Priority Intelligence Requirements (PIRs) and the SANS CTI lifecycle
++Collection management: HUMINT, SIGINT, OSINT, technical telemetry
++Processing: deduplication, normalization, enrichment
++Analytic tradecraft (ICD 203 standards): accuracy, source citation, expression of uncertainty
++Dissemination: tactical, operational, strategic audiences

Primary sources:

Models and Frameworks

Kill chain, Diamond Model, MITRE ATT&CK, F3EAD.

++Cyber Kill Chain (Hutchins et al. 2011): reconnaissance, weaponization, delivery, exploitation, installation, C2, actions
++Diamond Model: adversary, infrastructure, capability, victim
++MITRE ATT&CK Tactics, Techniques, Sub-techniques, Mitigations
++F3EAD (Find, Fix, Finish, Exploit, Analyze, Disseminate) for IR-aligned CTI
++Pyramid of Pain: indicators by adversary cost to change

Primary sources:

Threat Actor Analysis and Attribution

Tracking and characterizing threat actors over time.

++Naming conventions across vendors (APT-NNN, BLIZZARD, SPIDER, BEAR, PANDA, etc.)
++Attribution levels of confidence
++Threat actor profiles: motivations, capabilities, infrastructure
++Campaign tracking and cluster analysis
++Sharing standards: STIX 2.1, TAXII 2.1, MISP

Primary sources:

Analytic Techniques

Structured analytic techniques to fight cognitive bias.

++Analysis of Competing Hypotheses (Heuer)
++Key Assumptions Check
++Quality of Information Check
++Devil's Advocacy and Red Team analysis
++Heuer's cognitive biases catalog (anchoring, mirror imaging, satisficing)

Primary sources:

Heuer, Pherson: Structured Analytic Techniques for Intelligence Analysis (CIA / CQ Press)

Reporting and Dissemination

Writing intelligence reports that decision-makers can use.

++BLUF (bottom line up front) structure
++Source citation and confidence statements
++Estimative language standards (ICD 203, NIPF probability table)
++Audience-specific products: technical IOC feeds, tactical reports, strategic briefs
++TLP (Traffic Light Protocol) sharing labels

Primary sources:

Practice scenarios (6)

Practice scenarios are scenario-based learning, not exam-question mimicry. Each scenario maps to a specific exam domain and includes a worked explanation plus a primary-source citation. Reproducing actual exam items would violate the cert body's NDA; the format here exercises the same underlying concepts under different surface phrasing.

Preview scenario 1 of 6 · Models and Frameworksfree preview

An analyst is mapping a phishing-driven intrusion to the Cyber Kill Chain. The threat actor sent a spear-phishing email with a malicious attachment that, when opened, exploited a Word vulnerability and dropped a beacon. Which Kill Chain phase covers the act of opening the attachment and triggering the exploit?

A. Reconnaissance
B. Delivery
C. Exploitation
D. Actions on Objectives

Answer: C

Exploitation is the phase where the weaponized payload's exploit fires against the target. Delivery is the phase that gets the weaponized payload to the target (the email arrival). Reconnaissance is pre-attack target research. Actions on Objectives is the post-installation goal pursuit.

Reference: Hutchins et al. Intelligence-Driven Computer Network Defense (2011)

Unlock the rest

5 more practice scenarios with full explanations and primary-source citations

The remaining scenarios cover every exam domain at the same depth as the preview above. Includes the exam-day strategy guide and additional study resources. $147 one-time, lifetime access.

Exam-day strategy

++Build your open-book index against the SANS FOR578 material plus the primary sources above. Pre-tab pages so you can find ATT&CK technique IDs, Kill Chain phases, Diamond Model vertices, and ICD 203 elements in under 30 seconds.
++On every question, identify the framework first (Kill Chain vs Diamond vs ATT&CK vs Heuer). The right answer almost always lives in one specific framework's vocabulary.
++Watch for distractors that confuse Kill Chain phases (delivery vs exploitation vs installation) and Diamond Model vertices (capability vs infrastructure).
++On structured-analytic-technique questions, the correct technique is the one that specifically addresses the cognitive bias the scenario sets up.
++Pace at roughly 2 minutes 30 seconds per question. The 4-hour GIAC exam window is generous; resist the temptation to over-research each question.

Additional resources

Sources

Official GCTI (GIAC Cyber Threat Intelligence) exam page (certifying body)

Exam fee and blueprint last verified 2026-05-22. Confirm current values with the certifying body before scheduling the exam.

What the add-on ships

++Domain reviews mapped to the official GIAC GCTI exam outline

++Open-book index development support, including index template and indexing methodology guide

++Three full-length 75-question mock exams aligned to the GIAC scenario format

++ICD 203 analytic tradecraft and structured analytic techniques review

++Direct link to the official GIAC GCTI exam outline as the canonical reference

Built on the parent course

++Threat Intelligence Fundamentals seven-module curriculum grounded in MITRE ATT&CK, the Diamond Model, the Cyber Kill Chain, STIX/TAXII, and SANS CTI maturity

++Collection, analysis, dissemination, and analytic-tradecraft practice from the parent course

Exam summary

Domain reviews

CTI Lifecycle and Tradecraft

Direction, collection, processing, analysis, dissemination, feedback.

++Priority Intelligence Requirements (PIRs) and the SANS CTI lifecycle
++Collection management: HUMINT, SIGINT, OSINT, technical telemetry
++Processing: deduplication, normalization, enrichment
++Analytic tradecraft (ICD 203 standards): accuracy, source citation, expression of uncertainty
++Dissemination: tactical, operational, strategic audiences

Primary sources:

Models and Frameworks

Kill chain, Diamond Model, MITRE ATT&CK, F3EAD.

++Cyber Kill Chain (Hutchins et al. 2011): reconnaissance, weaponization, delivery, exploitation, installation, C2, actions
++Diamond Model: adversary, infrastructure, capability, victim
++MITRE ATT&CK Tactics, Techniques, Sub-techniques, Mitigations
++F3EAD (Find, Fix, Finish, Exploit, Analyze, Disseminate) for IR-aligned CTI
++Pyramid of Pain: indicators by adversary cost to change

Primary sources:

Threat Actor Analysis and Attribution

Tracking and characterizing threat actors over time.

++Naming conventions across vendors (APT-NNN, BLIZZARD, SPIDER, BEAR, PANDA, etc.)
++Attribution levels of confidence
++Threat actor profiles: motivations, capabilities, infrastructure
++Campaign tracking and cluster analysis
++Sharing standards: STIX 2.1, TAXII 2.1, MISP

Primary sources:

Analytic Techniques

Structured analytic techniques to fight cognitive bias.

++Analysis of Competing Hypotheses (Heuer)
++Key Assumptions Check
++Quality of Information Check
++Devil's Advocacy and Red Team analysis
++Heuer's cognitive biases catalog (anchoring, mirror imaging, satisficing)

Primary sources:

Heuer, Pherson: Structured Analytic Techniques for Intelligence Analysis (CIA / CQ Press)

Reporting and Dissemination

Writing intelligence reports that decision-makers can use.

++BLUF (bottom line up front) structure
++Source citation and confidence statements
++Estimative language standards (ICD 203, NIPF probability table)
++Audience-specific products: technical IOC feeds, tactical reports, strategic briefs
++TLP (Traffic Light Protocol) sharing labels

Primary sources:

Practice scenarios (6)

Preview scenario 1 of 6 · Models and Frameworksfree preview

A. Reconnaissance
B. Delivery
C. Exploitation
D. Actions on Objectives

Answer: C

Reference: Hutchins et al. Intelligence-Driven Computer Network Defense (2011)

Unlock the rest

5 more practice scenarios with full explanations and primary-source citations

The remaining scenarios cover every exam domain at the same depth as the preview above. Includes the exam-day strategy guide and additional study resources. $147 one-time, lifetime access.

Exam-day strategy

++Build your open-book index against the SANS FOR578 material plus the primary sources above. Pre-tab pages so you can find ATT&CK technique IDs, Kill Chain phases, Diamond Model vertices, and ICD 203 elements in under 30 seconds.

++On every question, identify the framework first (Kill Chain vs Diamond vs ATT&CK vs Heuer). The right answer almost always lives in one specific framework's vocabulary.

++Watch for distractors that confuse Kill Chain phases (delivery vs exploitation vs installation) and Diamond Model vertices (capability vs infrastructure).

++On structured-analytic-technique questions, the correct technique is the one that specifically addresses the cognitive bias the scenario sets up.

++Pace at roughly 2 minutes 30 seconds per question. The 4-hour GIAC exam window is generous; resist the temptation to over-research each question.