Data Analysis Techniques CTIA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is an Indicator of Compromise (IoC)?

   • AA type of firewall rule that blocks malicious traffic
   • BA tool used to analyze malware behavior
   • CA report that summarizes threat intelligence findings
   • DA piece of evidence that indicates a system may have been compromised
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is starting a new threat intelligence analysis project. The project involves collecting data from internal logs, external feeds, and open-source reports. The analyst needs to ensure that the analysis is systematic and reproducible. Which sequence of steps best follows the data analysis process?

   • AAnalyze the data immediately, then collect more data if needed, and report at the end.
   • BCollect data first, then define the objective, and then analyze without processing.
   • CReport findings first, then collect data to support them.
   • DDefine the objective, collect data, process and normalize the data, analyze, and then report findings.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A threat intelligence analyst is reviewing six months of phishing email reports. They notice that the volume of phishing emails targeting the finance department spikes every month around the 25th, which coincides with the company's payroll processing. The analyst wants to quantify this pattern to support a recommendation for additional security controls. Which approach best applies statistical and temporal analysis to this situation?

   • ACalculate the mean and standard deviation of daily phishing volumes, then compare the 25th of each month against the overall distribution to confirm the spike is statistically significant.
   • BCount the total number of phishing emails over the six months and divide by six to get a monthly average, then use that as the expected value for every day.
   • CUse a correlation coefficient between the day of the month and phishing volume, but only for the finance department's emails.
   • DPlot the phishing volumes on a time-series chart and visually identify the spike around the 25th without performing any calculations.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence analyst needs to present the frequency of different malware families observed over the past year to a non-technical executive audience. The data includes counts per family per month. Which visualization is most effective for this purpose?

   • AA stacked area chart showing the monthly counts of each malware family.
   • BA bar chart of the total count for each family, sorted descending.
   • CA scatter plot of individual malware samples by file size and date.
   • DA pie chart showing the total count for each family across the year.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is starting a new threat intelligence analysis project. The analyst has collected raw logs, threat feeds, and open-source reports. According to the standard data analysis process, what should the analyst do first?

   • AClean and normalize the data to ensure consistency and remove noise.
   • BCorrelate the data with external threat intelligence feeds.
   • CCreate visualizations to identify patterns immediately.
   • DWrite a final report summarizing the findings.
   Reveal Solution Discussion Select an answer first