Data Processing and Exploitation CTIA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is integrating a new threat intelligence feed into its SIEM. The feed provides indicators in a proprietary format that does not match the SIEM's schema. The team must ensure that the indicators are correctly mapped and that no data is lost during ingestion. What is the most important step?

   • AIngest the feed as-is and rely on the SIEM to interpret it
   • BManually enter the indicators into the SIEM
   • CConvert the feed to CSV and import it without checking field mappings
   • DDevelop a normalization mapping that translates the feed's fields to the SIEM schema and validate the mapping with sample data
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A threat intelligence team needs to present the geographic distribution of attack sources and the timeline of a multi-stage campaign to non-technical executives. Which approach best communicates this processed data?

   • ASend a detailed technical report with all correlation rules
   • BProvide a raw data dump of all indicators for executives to review
   • CCreate a dashboard with a map showing attack origins and a timeline chart of campaign stages
   • DVerbally describe the findings without any visual aids
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   During threat intelligence analysis, an analyst notices that the same IP address appears in firewall logs, a phishing email header, and a malware sandbox report. What process is being used to identify this relationship?

   • AData enrichment
   • BData correlation
   • CData aggregation
   • DData normalization
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following best describes the overall purpose of the data processing stage in threat intelligence?

   • ATo convert raw collected data into a usable, standardized, and enriched form that supports analysis and decision-making
   • BTo collect data from multiple sources and store it in its original format for future reference
   • CTo automatically generate threat intelligence reports without human intervention
   • DTo delete all irrelevant data before it enters the intelligence repository
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security operations center is investigating a potential data exfiltration. The analyst has access to firewall logs, DNS logs, and endpoint logs. The firewall logs show a large outbound transfer to an external IP, but the DNS logs do not show any domain resolution for that IP. The endpoint logs show a process that has not been seen before. The analyst needs to determine if the transfer is malicious. What should the analyst do?

   • ACorrelate the endpoint process with the firewall transfer and check for other hosts with similar behavior
   • BBlock the external IP immediately to prevent further data loss
   • CFilter the endpoint logs to only show critical events
   • DIgnore the transfer because the DNS logs do not show a domain resolution
   Reveal Solution Discussion Select an answer first