Data Processing and Exploitation CTIA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An analyst has correlated multiple indicators and identified a potential phishing campaign targeting employees. The analyst has enriched the indicators with threat intelligence and filtered out false positives. The analyst must now decide which indicators to include in a blocklist for the email gateway. The blocklist has a limited capacity. What should the analyst prioritize?

   • AIndicators that are easiest to implement, regardless of confidence
   • BIndicators that are confirmed malicious and have a high confidence score
   • CAll indicators, even if some are unverified
   • DIndicators from the most recent feed, regardless of validation
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A threat intelligence team stores processed indicators in a centralized database that supports fast queries and allows other analysts to retrieve historical data. This practice is an example of:

   • AData exploitation
   • BData storage and management
   • CData visualization
   • DData filtering
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After processing a large dataset of indicators, an analyst notices that some indicators from an automated feed conflict with manually verified data. Before using this data in a report, what should the analyst do?

   • AAverage the conflicting values to create a compromise
   • BIgnore the conflict and include all data in the report
   • CValidate the conflicting indicators against multiple reliable sources and remove or flag unverified ones
   • DUse the automated feed data because it is more current
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A threat intelligence analyst is evaluating a new commercial threat feed. The feed provides a high volume of indicators, but the analyst has found that some indicators are false positives. The analyst needs to decide whether to integrate the feed into the platform. The feed is the only source for a specific type of malware that is targeting the organization. What should the analyst do?

   • AIntegrate the feed without any filtering to ensure no indicators are missed
   • BReject the feed entirely because of the false positives
   • CEnrich every indicator from the feed before deciding
   • DIntegrate the feed but apply strict validation and filtering rules to reduce false positives
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence platform is ingesting millions of DNS queries daily. The analyst needs to identify only the queries that match known malicious domains or suspicious patterns, such as long subdomains or high query frequency. The platform's storage and processing capacity is limited. What should the analyst do to focus on actionable intelligence?

   • AApply filtering rules to discard queries to known benign domains and flag those matching malicious indicators or anomalies
   • BStore all raw queries and perform analysis only when an incident occurs
   • CEnrich every query with geolocation data before analysis
   • DAggregate queries by domain and present the top 100 domains to management
   Reveal Solution Discussion Select an answer first