GCTI Domain 2: Kill Chain, Diamond Model, and Courses of Action Matrix (varies) - Complete Study Guide 2027

Kill Chain Fundamentals

Domain 2 of the GCTI certification focuses on three critical analytical frameworks that form the backbone of modern cyber threat intelligence: the Kill Chain, Diamond Model, and Courses of Action Matrix. These frameworks provide structured approaches for understanding, analyzing, and responding to cyber threats. Mastering this domain is essential for success on the GCTI exam, as it appears across multiple question types including the challenging CyberLive hands-on components.

The Cyber Kill Chain, originally developed by Lockheed Martin, provides a framework for understanding the phases of a cyberattack from initial reconnaissance through final objectives. The seven-stage model includes:

• Reconnaissance: Target identification and research
• Weaponization: Exploit and payload creation
• Delivery: Transmission of weaponized bundle
• Exploitation: Code execution on victim system
• Installation: Persistence mechanism establishment
• Command and Control (C2): Remote access channel creation
• Actions on Objectives: Goal achievement and data exfiltration

Understanding each phase is crucial for GCTI candidates, as exam questions frequently test your ability to identify indicators of compromise (IoCs) at specific kill chain stages and recommend appropriate defensive measures. The GCTI Study Guide 2027: How to Pass on Your First Attempt provides additional context on how kill chain analysis integrates with other certification domains.

Advanced kill chain analysis extends beyond basic phase identification to include temporal analysis, adversary capability assessment, and defensive gap identification. GCTI exam questions often present real-world scenarios requiring candidates to map observed activities to kill chain phases and identify the most effective intervention points.

Kill Chain Variations and Extensions

The GCTI exam covers several kill chain variations, including the MITRE ATT&CK framework integration and industry-specific adaptations. Understanding how traditional kill chain models map to ATT&CK tactics and techniques is essential for comprehensive threat analysis.

Kill Chain Phase	MITRE ATT&CK Tactic	Key Indicators
Reconnaissance	Reconnaissance	WHOIS queries, DNS enumeration, social media research
Weaponization	Resource Development	Malware compilation, exploit kit preparation
Delivery	Initial Access	Phishing emails, drive-by downloads, removable media
Exploitation	Execution	Vulnerability exploitation, code execution
Installation	Persistence	Registry modifications, scheduled tasks, backdoors
Command and Control	Command and Control	C2 beacons, encrypted channels, proxy usage
Actions on Objectives	Impact	Data exfiltration, system manipulation, destruction

Diamond Model Analysis Framework

The Diamond Model of Intrusion Analysis provides a complementary framework to the kill chain, focusing on the relationships between four core elements: Adversary, Infrastructure, Capability, and Victim. This model emphasizes the interconnected nature of threat intelligence and enables analysts to pivot between different data points to build comprehensive threat pictures.

Each vertex of the Diamond Model contains specific attributes and sub-elements that GCTI candidates must understand in detail:

Adversary Vertex

The adversary vertex encompasses threat actor attribution, motivation analysis, and behavioral patterns. GCTI exam questions frequently test your ability to categorize adversaries based on sophistication levels, target preferences, and operational patterns. Key adversary attributes include:

• Threat actor type (nation-state, cybercriminal, hacktivist, insider)
• Sophistication level and resource availability
• Motivation and strategic objectives
• Operational patterns and tradecraft
• Geographic origin and operational zones

Infrastructure Vertex

Infrastructure analysis focuses on the technical resources adversaries use to conduct operations. This includes both physical and virtual infrastructure components. Understanding infrastructure patterns is crucial for threat hunting and attribution efforts.

Infrastructure categories include command and control servers, compromised systems used as proxies, domain registration patterns, hosting providers, and communication channels. The GCTI Domain 6: Pivoting and Expanding Intelligence guide provides detailed coverage of infrastructure pivoting techniques frequently tested on the exam.

Capability Vertex

Capability analysis examines the tools, techniques, and procedures (TTPs) employed by threat actors. This vertex connects closely with MITRE ATT&CK framework knowledge and malware analysis skills covered in other GCTI domains.

Victim Vertex

Victim analysis goes beyond simple target identification to include victimology patterns, organizational vulnerabilities, and attack surface analysis. Understanding why specific victims are targeted provides crucial intelligence for defensive planning and threat prioritization.

Courses of Action Matrix

The Courses of Action (COA) Matrix provides a structured approach for developing defensive and offensive responses to identified threats. This framework is particularly important for GCTI candidates as it bridges the gap between threat analysis and operational response.

The COA Matrix typically includes six primary categories of actions:

1. Detect: Capabilities for identifying threat presence
2. Deny: Preventing adversary access or success
3. Disrupt: Interfering with adversary operations
4. Degrade: Reducing adversary capability effectiveness
5. Deceive: Misleading adversaries about defensive capabilities
6. Destroy: Eliminating adversary capabilities or infrastructure

Each category requires specific implementation approaches and success metrics. GCTI exam questions often present threat scenarios and ask candidates to recommend appropriate COA categories or specific implementation tactics.

COA Development Process

Developing effective courses of action requires systematic analysis of threat intelligence, organizational capabilities, and strategic objectives. The process typically includes:

• Threat characterization and impact assessment
• Capability gap analysis and resource evaluation
• Risk tolerance and strategic objective alignment
• Timeline and implementation feasibility analysis
• Success metrics and evaluation criteria definition

Understanding this development process is crucial for answering scenario-based GCTI questions that require comprehensive threat response planning. The practice test platform includes numerous COA Matrix scenarios that mirror actual exam content.

Practical Application and Integration

Domain 2 success requires more than theoretical knowledge—candidates must demonstrate practical application skills through CyberLive components and complex scenario analysis. These hands-on elements test your ability to apply kill chain, Diamond Model, and COA Matrix concepts in realistic threat intelligence scenarios.

Practical application areas include:

Threat Campaign Analysis

Combining all three frameworks to analyze complex, multi-stage threat campaigns. This involves mapping observed activities to kill chain phases, identifying Diamond Model relationships, and developing comprehensive response strategies using the COA Matrix.

Intelligence Product Development

Creating structured intelligence products that incorporate framework analysis for executive and technical audiences. This skill connects to Domain 7: Intelligence Storage, Sharing, and Reporting content areas.

Attribution and Clustering

Using Diamond Model analysis to support threat actor attribution and campaign clustering decisions. This advanced skill requires understanding of how infrastructure, capability, and victimology patterns support attribution confidence levels.

Domain 2 Exam Preparation Strategies

Effective Domain 2 preparation requires balanced focus on theoretical knowledge and practical application skills. Given the complexity of framework integration, structured study approaches yield better results than isolated topic review.

Key preparation strategies include:

Framework Memorization Techniques

Develop reliable memory aids for kill chain phases, Diamond Model vertices, and COA Matrix categories. Many successful candidates use acronyms, visual diagrams, or narrative scenarios to reinforce framework knowledge.

Scenario-Based Practice

Focus heavily on scenario-based practice questions that require framework application rather than simple recall. The Best GCTI Practice Questions 2027 guide provides additional resources for this type of preparation.

Integration Exercises

Practice combining all three frameworks in comprehensive threat analysis exercises. This skill is frequently tested in higher-level exam questions and CyberLive components.

Understanding the question distribution helps focus study time effectively. The majority of Domain 2 questions require framework integration skills rather than isolated knowledge of individual models.

Common Pitfalls and How to Avoid Them

Domain 2 presents several common challenge areas that frequently trip up GCTI candidates. Understanding these pitfalls and developing specific strategies to avoid them significantly improves exam performance.

Framework Confusion

The most common error involves confusing framework elements or mixing concepts between different models. This typically occurs under exam pressure when candidates rely on partial knowledge rather than comprehensive understanding.

Prevention strategies include creating clear mental maps for each framework, practicing with mixed-framework questions, and developing verification techniques for framework element identification.

Linear Thinking

Many candidates approach kill chain analysis with overly linear thinking, missing the iterative and parallel aspects of modern cyber operations. Real-world attacks rarely follow perfectly sequential kill chain progression.

Incomplete COA Development

Candidates frequently recommend single-category courses of action rather than comprehensive, multi-faceted response strategies. Effective COA development typically requires coordinated actions across multiple matrix categories.

Essential Study Resources

Domain 2 preparation benefits from diverse resource utilization, combining theoretical study materials with practical application tools. The complexity of framework integration requires multiple learning approaches for comprehensive understanding.

Primary study resources include:

Official SANS Materials

The SANS FOR578 course provides the foundational content for Domain 2, including detailed framework explanations, case studies, and practical exercises. While not required, most successful candidates utilize this comprehensive training program.

Framework Documentation

Original framework documentation from Lockheed Martin (Kill Chain) and the Center for Cyber Intelligence Analysis and Threat Research (Diamond Model) provides authoritative reference material for detailed understanding.

Practice Platforms

Interactive practice environments, including the comprehensive GCTI practice test platform, offer realistic scenario-based questions that mirror actual exam content and difficulty levels.

The How Hard Is the GCTI Exam? Complete Difficulty Guide 2027 provides additional context on Domain 2 difficulty levels and preparation requirements.

Community Resources

Professional communities, study groups, and online forums provide valuable perspectives on framework application and exam preparation strategies. Many candidates benefit from discussing complex scenarios with peers and practicing collaborative analysis techniques.

Budget considerations are important for resource selection, as comprehensive preparation can involve significant investment. The GCTI Certification Cost 2027: Complete Pricing Breakdown provides detailed cost analysis for various preparation approaches.