Data Analysis Techniques CTIA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An analyst is investigating a series of attacks that appear to originate from a specific country based on IP geolocation. However, the analyst notices that many of the source IPs are registered to a cloud provider that offers services globally. The analyst wants to avoid the pitfall of attributing the attacks to the wrong country. Which approach is most appropriate?

   • AIgnore the geolocation data entirely and focus only on the malware analysis.
   • BCorrelate the IP geolocation with other indicators, such as the language of the malware and the timing of the attacks, before making attribution claims.
   • CTreat the geolocation as definitive because the IP is registered in that country.
   • DAssume the attacks are state-sponsored because they come from a cloud provider.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team has recorded the number of intrusion attempts per day for 30 days. The mean is 50, and the standard deviation is 5. On day 31, the team records 70 attempts. What is the most appropriate conclusion?

   • AThe increase is statistically significant because 70 is more than two standard deviations above the mean.
   • BThe increase is within normal variation because the standard deviation is small.
   • CThe increase is not significant because the mean is 50.
   • DThe increase is significant only if the data follows a normal distribution.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small security team needs to automate the collection of indicators from multiple open-source feeds, correlate them with their internal logs, and generate a daily report. They have limited budget and no dedicated data science staff. Which tool or platform is most appropriate for this task?

   • AA custom Python script that fetches feeds and writes to a CSV file, with no correlation or reporting.
   • BA commercial threat intelligence platform with a high annual cost and a steep learning curve.
   • CA commercial SIEM with built-in threat intelligence feeds, but no automation or reporting capabilities.
   • DAn open-source threat intelligence platform (TIP) such as OpenCTI or MISP, with built-in feed ingestion and correlation features.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary goal of the data processing step in the threat intelligence analysis process?

   • ATo identify patterns and trends in the data
   • BTo share the final intelligence with stakeholders
   • CTo clean, normalize, and structure the data for analysis
   • DTo collect raw data from various sources
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence team is mapping the relationships between email addresses, domains, and malware hashes from a phishing campaign. They want to identify which email address is the most central in the campaign's communication network. Which analysis technique should they use?

   • AUse a pivot table to summarize the data by email address.
   • BPerform a time-series analysis of when each email was sent.
   • CCount the number of emails sent from each address and rank them.
   • DConstruct a graph with email addresses, domains, and hashes as nodes, and use degree centrality to find the node with the most connections.
   Reveal Solution Discussion Select an answer first