Data Processing and Exploitation CTIA Practice Questions (Page 11)

Questions 51–54

1. 51expert · hard

   A threat intelligence platform ingests indicators from an open-source feed that has a high false-positive rate. The feed provides IP addresses and domains, but some indicators are outdated or incorrectly categorized. The analyst must use this data to block malicious traffic, but blocking false positives could disrupt legitimate business operations. The analyst has access to commercial threat intelligence feeds and internal telemetry. What is the best approach to ensure the indicators are trustworthy before blocking?

   • AUse only the open-source feed because it is free and readily available
   • BEnrich the indicators with geolocation data and block those from high-risk countries
   • CCross-validate the open-source indicators against commercial feeds and internal telemetry, and only block those confirmed by at least two independent sources
   • DBlock all indicators from the open-source feed immediately to maximize security
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A threat intelligence team is building a repository of indicators. The team has a limited budget for external data enrichment services. The team needs to prioritize which indicators to enrich first. The indicators include IP addresses, domains, and file hashes. Which indicators should the team enrich first to maximize the value of the enrichment budget?

   • AEnrich only the file hashes because they are the most reliable indicator type
   • BEnrich only the IP addresses because they are the most common indicator type
   • CEnrich all indicators equally to ensure complete coverage
   • DEnrich the indicators that are most relevant to ongoing investigations and have the highest potential impact
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   A threat intelligence analyst creates a graph showing the relationships between malicious domains, IP addresses, and malware hashes to present to management. This graphical representation is an example of:

   • AData aggregation
   • BData visualization
   • CData correlation
   • DData enrichment
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A threat intelligence analyst has correlated data from endpoint logs, network flows, and threat feeds to identify a pattern of lateral movement. The analyst needs to communicate the attack path to the incident response team in a way that highlights the sequence of compromised hosts and the tools used. What should the analyst do?

   • AStore the correlated data in a new threat intelligence repository for future use
   • BCreate a visual attack graph that maps the sequence of hosts, connections, and tools
   • CSend the raw correlated data to the incident response team for their own analysis
   • DWrite a detailed textual report listing all indicators in chronological order
   Reveal Solution Discussion Select an answer first