Threat Intelligence Data Collection CTIA Practice Questions (Page 17)

Questions 81–85

1. 81foundation · easy

   Which type of data source is primarily collected from mobile devices for threat intelligence purposes?

   • ADNS query logs from the corporate DNS server
   • BMDM enrollment logs and app permission records
   • CNetFlow records from the core router
   • DSIEM correlation rules and alert outputs
   Reveal Solution Discussion Select an answer first
2. 82foundation · easy

   What is the primary purpose of integrating a threat intelligence platform (TIP) with an organization's existing security information and event management (SIEM) system?

   • ATo store all raw logs from the SIEM in the TIP for long-term compliance
   • BTo automatically patch vulnerabilities identified by the SIEM
   • CTo replace the SIEM's correlation engine with the TIP's analytics
   • DTo enable the SIEM to receive and use threat intelligence for enhanced alerting and correlation
   Reveal Solution Discussion Select an answer first
4. 83foundation · easy

   In the context of threat intelligence data collection, what is the primary purpose of incorporating feedback from intelligence consumers into the collection process?

   • ATo automate the collection of all available threat data feeds
   • BTo replace human analysts with automated collection tools
   • CTo validate that collected data meets the intelligence requirements and fills gaps identified by analysts
   • DTo ensure that all collected data is shared with external partners
   Reveal Solution Discussion Select an answer first
5. 84application · medium

   A government security agency is collecting signals intelligence (SIGINT) to identify the infrastructure used by a threat actor group. The agency has access to network traffic metadata, DNS logs, and geolocation data. The goal is to map the threat actor's command-and-control (C2) servers. Which combination of data sources would be most effective for this analysis?

   • AOnly DNS logs to identify domain names used by the threat actor.
   • BNetwork traffic metadata to identify communication patterns, DNS logs to resolve domain names, and geolocation data to locate servers.
   • COnly network traffic metadata to identify IP addresses communicating with the organization.
   • DOnly geolocation data to identify the physical location of servers.
   Reveal Solution Discussion Select an answer first
6. 85application · medium

   A vulnerability management team is integrating vulnerability data from CVE and NVD into their threat intelligence process. The team wants to prioritize vulnerabilities that are actively exploited in the wild. Which additional data source should they incorporate to achieve this goal?

   • AExploit databases such as Exploit-DB to see if public exploits exist.
   • BThreat intelligence feeds that provide indicators of active exploitation, such as C2 IPs and malware hashes associated with specific CVEs.
   • CSocial media discussions to gauge public interest in the vulnerability.
   • DVendor security advisories to understand the impact of the vulnerability.
   Reveal Solution Discussion Select an answer first