GIAC Cyber Threat Intelligence (GCTI) practice questions.

An analyst is mapping a phishing-driven intrusion to the Cyber Kill Chain. The threat actor sent a spear-phishing email with a malicious attachment that, when opened, exploited a Word vulnerability and dropped a beacon. Which Kill Chain phase covers the act of opening the attachment and triggering the exploit?

In the Diamond Model, an analyst links a campaign across multiple victims using a shared C2 domain registered to the same email address. Which Diamond Model vertex did the analyst use as the pivot?

Two vendors publish reports on a campaign with overlapping techniques. CrowdStrike refers to the group as 'COZY BEAR' and Microsoft refers to it as 'MIDNIGHT BLIZZARD' (formerly 'NOBELIUM'). Which framework consolidates these naming conventions and provides a vendor-neutral identifier?

An analyst is testing two competing hypotheses about the actor behind a campaign. Which structured analytic technique is designed specifically to weigh evidence against multiple hypotheses without anchoring on the first plausible one?

An analyst writes a strategic-level intelligence report. The executive summary states: 'We assess with high confidence that the threat actor will continue targeting financial-sector firms over the next 6 to 12 months.' Which ICD 203 element does the phrase 'with high confidence' satisfy?

A new CTI program is establishing Priority Intelligence Requirements (PIRs). Which option best describes what PIRs are?