Threat Intelligence Data Collection CTIA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In the context of threat intelligence data collection, what is the primary purpose of data normalization?

   • ATo convert raw data into a consistent, structured format so that data from different sources can be compared and analyzed together.
   • BTo assign a unique identifier to each piece of threat data for tracking purposes.
   • CTo remove all duplicate records from the collected data to reduce storage requirements.
   • DTo encrypt sensitive threat data to protect it from unauthorized access during collection and storage.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst needs to collect behavioral data from a suspicious file without risking infection of the production environment. Which method is most appropriate?

   • AExecute the file in a sandbox environment with network monitoring and system activity logging.
   • BUpload the file to a public malware analysis service and rely on its report.
   • CPerform static analysis only to avoid execution risks.
   • DRun the file on a production server with endpoint detection and response (EDR) installed.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a common source of application logs that would be valuable for threat intelligence analysis?

   • AWeb server access logs
   • BDNS zone transfer logs
   • CDHCP lease logs
   • DRouter interface statistics
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   An analyst is collecting threat intelligence data from a hardware vendor's official security bulletins. This type of data collection is best categorized as:

   • AHuman intelligence collection
   • BSupply chain source collection
   • CTechnical intelligence collection
   • DOpen-source intelligence collection
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network security analyst is investigating a potential data exfiltration incident. The analyst has access to network traffic captures, firewall logs, and a SIEM platform. The goal is to identify command-and-control (C2) communication patterns and extract indicators of compromise (IOCs). Which approach would be most effective for this task?

   • AAnalyze full packet captures for unusual outbound connections, such as periodic beaconing to a specific external IP, and correlate with firewall logs.
   • BReview firewall logs for blocked outbound connections to known malicious IP addresses.
   • CDisable the firewall to allow all traffic and capture everything for analysis.
   • DQuery the SIEM for all events related to the external IP addresses found in threat intelligence feeds.
   Reveal Solution Discussion Select an answer first