Threat Intelligence Data Collection CTIA Practice Questions (Page 14)

Questions 66–70

1. 66application · medium

   An analyst wants to automate the collection of open-source intelligence (OSINT) about a specific threat actor. The analyst needs to gather data from social media, forums, and public repositories. Which tool would be most suitable?

   • ATheHarvester, which can search emails, domains, and subdomains from public sources.
   • BMetasploit, which is used for penetration testing.
   • CWireshark, which captures network traffic.
   • DNmap, which scans network hosts.
   Reveal Solution Discussion Select an answer first
2. 67application · medium

   A financial institution is developing a threat intelligence data collection plan. The organization's key intelligence requirements (KIRs) focus on identifying phishing campaigns targeting customers and understanding the tactics used by a specific threat actor group. The analyst must decide which data sources to prioritize. Which combination of sources best aligns with the KIRs?

   • AInternal email gateway logs, public phishing repository feeds, and dark web forums discussing the threat actor group.
   • BGeneric OSINT feeds, social media sentiment analysis, and general news articles.
   • CIndustry-specific threat sharing communities and vulnerability databases.
   • DNetwork flow logs, firewall logs, and proxy logs only.
   Reveal Solution Discussion Select an answer first
4. 68application · medium

   After a significant security incident, a threat intelligence analyst is tasked with reviewing the incident response (IR) report to extract lessons and indicators for future collection. The analyst wants to improve the organization's data collection processes based on the findings. Which action would be most effective?

   • AArchive the IR report and move on to other tasks to avoid dwelling on the past.
   • BIdentify gaps in the data collection that allowed the incident to occur and update the collection plan to address those gaps.
   • CExtract indicators of compromise (IOCs) from the report and add them to the threat intelligence platform.
   • DShare the IR report with external partners to get their feedback.
   Reveal Solution Discussion Select an answer first
5. 69application · medium

   An organization suspects an insider threat is exfiltrating sensitive data. The security team needs to collect internal data to investigate. Which internal sources should be prioritized to identify unauthorized access and data exfiltration?

   • AAuthentication logs, access logs, and data loss prevention (DLP) alerts.
   • BVulnerability scan reports and patch management logs.
   • CFirewall logs and proxy logs only.
   • DPublic threat intelligence feeds and social media monitoring.
   Reveal Solution Discussion Select an answer first
6. 70application · medium

   A security operations center (SOC) is investigating a potential insider threat. The analyst has access to authentication logs, endpoint detection and response (EDR) data, and employee access records. The goal is to identify any unauthorized access or data exfiltration by an employee. Which data source combination would provide the most comprehensive evidence?

   • AAuthentication logs only, to see login times and locations.
   • BEDR data only, to see processes and file activity on endpoints.
   • CCorrelate authentication logs with EDR data to map user logins to endpoint activity, and review access records for unusual file access.
   • DReview employee access records only, to see which files were accessed.
   Reveal Solution Discussion Select an answer first