Data Analysis Techniques CTIA Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   What is the primary purpose of data visualization in threat intelligence?

   • ATo store large amounts of threat data
   • BTo communicate analysis findings effectively
   • CTo automate data collection
   • DTo encrypt sensitive intelligence
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A threat intelligence team is analyzing a malware campaign. They have the following data: a C2 domain that resolves to an IP address, a malware sample that connects to that domain, and a phishing email that delivered the sample. The team wants to produce a visual that clearly shows how these entities are connected and highlights the central node that ties the campaign together. Which visualization and analysis approach is most appropriate?

   • ACreate a bar chart showing the number of connections each entity has, and use the tallest bar to identify the central node.
   • BCreate a timeline of when each entity was first observed and infer the central node as the one that appeared earliest.
   • CCreate a heatmap of the IP address's open ports and use the port with the most activity as the central node.
   • DCreate a node-link diagram with entities as nodes and relationships as edges, then use centrality measures to identify the most connected entity.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   An analyst is investigating a series of attacks that appear to originate from IP addresses in several countries. The analyst wants to determine if these attacks are coordinated or independent. What is the most effective first step?

   • ACalculate the average number of attacks per country.
   • BCorrelate the attack timestamps with the countries' local business hours.
   • CPlot the attack origins on a map and look for geographic clustering.
   • DPerform malware analysis on the attack tools used.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A threat intelligence team is correlating data from multiple sources: a commercial threat feed, an open-source intelligence (OSINT) collection, and internal DNS logs. The commercial feed reports a specific domain as malicious, but the OSINT collection has no record of it, and the internal DNS logs show only one query to that domain from a single host. The team must decide whether to block the domain. Which consideration is most important when evaluating the correlation results?

   • AThe single internal DNS query is strong evidence of a real infection, so the domain should be blocked immediately.
   • BThe team should block the domain because any indication of maliciousness, regardless of source, is enough to act.
   • CThe lack of corroboration from OSINT and the low internal prevalence suggest the commercial feed may have a false positive, so the team should investigate further before blocking.
   • DThe commercial feed is a paid, reputable source, so its report should be trusted over OSINT and internal logs.
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   Which sequence correctly represents the typical steps in the threat intelligence data analysis process?

   • AData collection → Data processing → Data analysis → Intelligence dissemination
   • BData processing → Data collection → Data analysis → Intelligence dissemination
   • CData collection → Data analysis → Data processing → Intelligence dissemination
   • DData analysis → Data collection → Data processing → Intelligence dissemination
   Reveal Solution Discussion Select an answer first