Data Analysis Techniques CTIA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of data correlation in threat intelligence?

   • ATo combine multiple data sources to validate and enrich intelligence
   • BTo store data in a centralized repository
   • CTo visualize data on a map
   • DTo automate the collection of threat data
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A CTI analyst is preparing a report on a new APT group. The analyst has collected data on the group's TTPs, victimology, and the malware they use. The analyst wants to include both quantitative and qualitative analysis in the report. Which combination best represents this approach?

   • AQuantitative: narrative of the attack timeline; Qualitative: number of victims.
   • BQuantitative: count of malware samples; Qualitative: description of the group's motivations.
   • CQuantitative: description of malware capabilities; Qualitative: frequency of attacks.
   • DQuantitative: list of TTPs; Qualitative: map of victim locations.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which type of data is most relevant for spatial analysis?

   • AEmail addresses of threat actors
   • BIP addresses and geolocation data
   • CMalware hash values
   • DTimestamps of security events
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is correlating a suspicious IP address from firewall logs with threat intelligence feeds. The IP is flagged by one feed as a known C2 server, but another feed lists it as a legitimate content delivery network. The analyst also finds that the IP has a historical relationship with several malware samples. What should the analyst do to make the most informed decision?

   • AIgnore the IP because the CDN classification indicates it is likely benign and the malware association is coincidental.
   • BCorrelate the IP with additional context such as domain history, SSL certificates, and recent behavioral data before concluding.
   • CImmediately block the IP to prevent potential compromise, regardless of the conflicting feed data.
   • DTreat the IP as malicious because it is flagged by at least one feed and has malware associations.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst has extracted a list of IP addresses from a malware sample's configuration file. The analyst wants to determine which of these IPs are known command-and-control (C2) servers. Which approach is most effective?

   • APing each IP to see if it is alive.
   • BCross-reference the IPs with threat intelligence feeds and check for any historical associations with C2 activity.
   • CPerform a reverse DNS lookup on each IP to see the domain name.
   • DCheck if the IP is in the same subnet as the organization's own servers.
   Reveal Solution Discussion Select an answer first