Threat Intelligence Data Collection CTIA Practice Questions (Page 27)

Questions 131–135

1. 131application · medium

   A threat intelligence analyst is building a collection plan for a financial services firm. The firm's priority intelligence requirement is to identify phishing domains targeting its customers. The analyst has identified three potential sources: a commercial threat feed that has historically provided high-fidelity indicators but with a 48-hour delay, a public paste site where new phishing URLs often appear within minutes but with many false positives, and an internal email gateway log that captures actual phishing attempts against the firm. The analyst needs to balance timeliness, accuracy, and relevance. Which approach best aligns with the intelligence requirement?

   • AUse the paste site as the primary source because it provides the fastest discovery of new phishing URLs.
   • BRely solely on the commercial feed because it is the most reliable and established source.
   • CPrioritize the internal email gateway logs because they are directly relevant to the firm's customers and have high accuracy.
   • DCombine the commercial feed for validated indicators, the paste site for early warnings, and internal logs for confirmed customer-targeted threats, with a validation workflow.
   Reveal Solution Discussion Select an answer first
2. 132foundation · easy

   Why is it important for a data collection plan to align with organizational objectives?

   • ATo comply with all international data protection regulations
   • BTo guarantee that all collected data is publicly available and shareable
   • CTo simplify the process of selecting automated collection tools
   • DTo ensure the collected data directly supports the organization's strategic and operational decisions
   Reveal Solution Discussion Select an answer first
4. 133foundation · easy

   An organization's threat intelligence team is about to dispose of a set of hard drives that previously stored sensitive threat intelligence reports. Which of the following methods is the MOST appropriate to ensure the data cannot be recovered?

   • APhysical destruction of the drives
   • BEncrypting the drives and then storing them in a secure facility
   • CQuick format of the drives
   • DDeleting the files and emptying the recycle bin
   Reveal Solution Discussion Select an answer first
5. 134foundation · easy

   What is the primary output of static malware analysis?

   • AIndicators such as file hashes, embedded strings, and imported functions
   • BThe physical location of the malware's command-and-control server
   • CThe identity of the malware author
   • DA record of the malware's runtime behavior, such as files created and network connections
   Reveal Solution Discussion Select an answer first
6. 135foundation · easy

   Which of the following best describes the primary purpose of threat intelligence sharing platforms (TISPs) such as MISP, ThreatConnect, or Anomali?

   • ATo replace the need for internal threat intelligence teams by providing fully analyzed and finished intelligence reports.
   • BTo automatically remediate security incidents by pushing blocking rules directly to all member firewalls without human review.
   • CTo provide a centralized repository where organizations can publish, consume, and correlate threat indicators and intelligence with trusted partners.
   • DTo serve as a government-regulated clearinghouse that mandates the submission of all cyber incident data within 24 hours.
   Reveal Solution Discussion Select an answer first