Threat Intelligence Data Collection CTIA Practice Questions (Page 18)

Questions 86–90

1. 86foundation · easy

   What is a primary benefit of using external threat intelligence feeds?

   • AThey are always free and require no integration effort
   • BThey provide a broad view of the threat landscape beyond your own organization
   • CThey eliminate the need for internal data collection
   • DThey are the only source of information on zero-day vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 87foundation · easy

   When collecting threat intelligence data from public sources, which practice best aligns with ethical and privacy considerations?

   • ASharing collected personal data with partner organizations to enrich their threat feeds
   • BCollecting only the minimum personal data necessary for the intelligence objective
   • CAnonymizing data only after it has been stored in the intelligence repository
   • DGathering all available data, including personal details, to ensure comprehensive analysis
   Reveal Solution Discussion Select an answer first
4. 88expert · hard

   A threat intelligence analyst is tasked with monitoring a known cybercriminal forum on the dark web to gather intelligence about upcoming ransomware campaigns. The analyst has access to a monitored account that can view forum posts but not interact. The organization's legal counsel has advised that passive observation is permissible, but any active engagement could violate laws and the forum's terms of service. The analyst notices a thread discussing a new ransomware-as-a-service (RaaS) affiliate program. To collect the most useful intelligence while staying within legal and ethical boundaries, what should the analyst do?

   • AAttempt to access the RaaS affiliate's private messages by exploiting a vulnerability in the forum software.
   • BPost a reply in the thread asking for more details about the RaaS program to encourage the threat actors to reveal more information.
   • CContact the forum administrator to request official access to the private RaaS discussions.
   • DTake screenshots and notes of the thread, including usernames, dates, and any technical details, while continuing passive monitoring.
   Reveal Solution Discussion Select an answer first
5. 89application · medium

   A security team needs to collect indicators of compromise (IOCs) from multiple external threat intelligence feeds and internal security tools, normalize them, and store them in a central repository for analysis. The team has limited scripting expertise and wants to minimize manual effort. Which approach should the team take?

   • AManually copy IOCs from each source into a spreadsheet and then upload to the SIEM.
   • BUse a threat intelligence platform (TIP) that integrates with the feeds and security tools, automatically normalizes and stores the data, and provides APIs for SIEM integration.
   • CDevelop custom Python scripts to parse each feed and tool's output, normalize the data, and push it to the SIEM via API.
   • DConfigure the SIEM to directly ingest raw logs from all sources without any normalization.
   Reveal Solution Discussion Select an answer first
6. 90foundation · easy

   Which of the following BEST describes the purpose of a data retention policy in the context of threat intelligence data collection?

   • AIt defines how long collected data must be stored and when it should be securely deleted
   • BIt ensures that all collected data is shared with relevant stakeholders in real time
   • CIt determines which threat intelligence sources are authorized for collection
   • DIt specifies the format and structure used to store threat intelligence data in the platform
   Reveal Solution Discussion Select an answer first