Data Processing and Exploitation CTIA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   An analyst uses the Diamond Model to analyze a cyber intrusion, examining the adversary, infrastructure, capability, and victim. This approach is an example of:

   • AData normalization
   • BData exploitation technique
   • CData aggregation
   • DData validation
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the main benefit of data aggregation in threat intelligence processing?

   • AIt standardizes data formats to a common schema
   • BIt provides a unified view of data from multiple sources, supporting comprehensive analysis
   • CIt automatically identifies malicious patterns in the data
   • DIt adds external context to each data point
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence team has processed a large volume of indicators and finished a major analysis project. The team expects to reuse this data for future investigations and wants to ensure it remains accessible and reliable. What should the team do to manage the processed data effectively?

   • AEmail the processed data to all team members for safekeeping
   • BDelete the processed data to free up storage space
   • CStore the processed data in a structured repository with metadata, versioning, and access controls
   • DKeep the data in the original raw format in a shared folder
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security operations center receives a massive volume of alerts daily. Analysts are overwhelmed and missing critical alerts. The team wants to reduce noise while ensuring that high-fidelity alerts are not lost. The team has implemented correlation rules but still sees too many alerts. What should the team do to improve the signal-to-noise ratio without sacrificing important detections?

   • AIncrease the severity threshold for all alerts to reduce volume
   • BDisable all correlation rules to reduce alert volume
   • CSend all alerts to a separate email folder for later review
   • DImplement filtering rules that suppress known benign alerts and aggregate similar alerts into incidents
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst observes that a specific user account logged in from an unusual location and, minutes later, the same account attempted to access a sensitive database. The analyst wants to determine if these events are part of a coordinated attack. What should the analyst do?

   • AAggregate all events from the same day into one report
   • BFilter out the login event because it appears benign
   • CCorrelate the login event with the database access attempt using common attributes such as user and time
   • DEnrich the login event with geolocation data only
   Reveal Solution Discussion Select an answer first