Data Processing and Exploitation CTIA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing alerts from multiple sources: an IDS flagged a suspicious connection to an external IP, a proxy log shows a user visited a known malicious domain, and an endpoint log shows a new process running. The analyst suspects these events are related to a single intrusion. What should the analyst do to confirm the relationship?

   • AFilter the alerts to only show critical severity events
   • BCorrelate the events by common attributes such as source IP, timestamp, and user account
   • CEnrich the external IP with threat intelligence and report it as a standalone finding
   • DAggregate all alerts into a single dashboard without further analysis
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A threat intelligence analyst collects firewall logs (CSV), proxy logs (JSON), and DNS logs (key-value pairs) from different security tools. The analyst needs to correlate events across these sources to identify a coordinated attack. What should the analyst do first to enable effective correlation?

   • AAggregate all logs into a single file regardless of format
   • BEnrich the logs with threat intelligence feeds before correlation
   • CFilter out all low-severity events before processing
   • DNormalize all logs into a common schema with standardized field names and formats
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst has identified a suspicious domain that has been used in a phishing campaign. The domain is not in any internal threat feed. The analyst wants to add this domain to the threat intelligence platform with additional context to support future investigations. What should the analyst do?

   • AFilter the domain out because it is not in a known threat feed
   • BStore the domain as a raw indicator without any additional context
   • CEnrich the domain with WHOIS, passive DNS, and SSL certificate data before storing it
   • DCorrelate the domain with internal logs to find other affected hosts
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization is investigating a potential data breach. The security team has collected logs from authentication servers, endpoint devices, and network proxies. The logs are in different formats and time zones. The team needs to identify the attack path and present it to management. The team has limited time and resources. What should the team do first to efficiently identify the attack path?

   • ANormalize the logs to a common time zone and format, then correlate events across sources to reconstruct the attack timeline
   • BVisualize the logs as they are without normalization
   • CAggregate all logs into a single file and manually review every entry
   • DFilter out all logs older than 24 hours
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary benefit of data normalization in threat intelligence processing?

   • AIt automatically identifies malicious indicators
   • BIt eliminates the need for manual data validation
   • CIt enables consistent analysis and correlation of data from diverse sources
   • DIt reduces the storage space required for raw data
   Reveal Solution Discussion Select an answer first