Data Analysis Techniques CTIA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   An analyst is examining the frequency of a specific malware signature in network traffic over the past 30 days. The analyst wants to determine whether the daily count of detections is unusually high on a particular day. Which statistical method is most appropriate?

   • APlot the counts on a pie chart to see the proportion of the day's count.
   • BCompare the day's count to the maximum count in the previous 30 days.
   • CUse the median of the daily counts and compare the day's count to the median.
   • DCalculate the mean and standard deviation of the daily counts, then determine if the day's count is more than two standard deviations above the mean.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A threat intelligence team is preparing a report for the board. They have two types of data: (1) a survey of security analysts' opinions about the most likely next attack vector, and (2) the actual number of phishing emails blocked per month. The team wants to present both types of data appropriately. Which statement correctly distinguishes the two types of analysis?

   • AThe survey is qualitative data, and the blocked email counts are quantitative data.
   • BThe survey is quantitative data, and the blocked email counts are qualitative data.
   • CBoth are quantitative because they can be counted.
   • DBoth are qualitative because they are used to inform decisions.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   An analyst is correlating data from network logs, endpoint detection, and threat intelligence feeds to identify a potential advanced persistent threat (APT). The network logs show a series of outbound connections to a low-reputation IP, but the endpoint logs show no signs of compromise. The threat feed flags the IP as a known C2 server. What is the most appropriate conclusion?

   • AThe IP is benign because the endpoint logs show no compromise.
   • BThe IP is a false positive from the threat feed, and no action is needed.
   • CThe IP is definitely a C2 server, and the organization is compromised.
   • DThe IP is likely a C2 server, but the lack of endpoint compromise suggests the connections may be benign or the endpoint detection is incomplete.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   An analyst has a malware sample that is packed and obfuscated. Static analysis reveals very little because the strings are encrypted and the imports are hidden. The analyst needs to understand the malware's behavior, but the sandbox environment is unable to execute the sample because it detects the sandbox and exits. Which combination of techniques is most appropriate to overcome this challenge?

   • ARely solely on static analysis and try to decode the strings manually.
   • BRun the sample on a production host with EDR monitoring to capture its behavior.
   • CUse a combination of unpacking, dynamic analysis with a custom sandbox that mimics a real user environment, and memory forensics to capture the unpacked code in memory.
   • DSubmit the sample to a public sandbox and hope it does not detect the sandbox.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A threat intelligence team needs to present a year-long analysis of phishing campaigns to the board. The data includes the number of phishing emails per month, the industries targeted, and the malware families used. The board is most interested in the overall trend and the shift in targeted industries. Which visualization approach would best communicate this?

   • AA line chart of monthly phishing counts with a stacked bar chart showing industry distribution by quarter.
   • BA heat map of phishing emails by month and industry.
   • CA single pie chart showing the total phishing emails per industry.
   • DA scatter plot of phishing emails by date and malware family.
   Reveal Solution Discussion Select an answer first