Bulk Data Collection Methods and Considerations TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A team is building a bulk data collection system that ingests data from multiple sources in different formats (JSON, CSV, XML). They need to combine this data for analysis. What is the primary challenge they must address?

   • AData deduplication to remove redundant records.
   • BData visualization for stakeholders.
   • CData encryption during transmission.
   • DData normalization to a common schema.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A multinational company is planning to collect threat intelligence from social media platforms and dark web forums to monitor mentions of its brand. The legal team warns that privacy regulations in some operating regions restrict the collection of personal data. Which approach best complies with privacy laws while still gathering useful intelligence?

   • ACollect only from dark web forums because they are outside the jurisdiction of privacy laws.
   • BObtain consent from every user whose data is collected.
   • CCollect all data and anonymize it after analysis to ensure no personal data is retained.
   • DCollect only publicly available posts and avoid any data that can be linked to an identified individual.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst needs to collect threat intelligence from a public API that provides a daily dump of malicious IP addresses. The API has a rate limit of 100 requests per minute, and the analyst needs to download millions of records. Which method is most appropriate to collect the data efficiently while respecting the rate limit?

   • AMake as many requests as possible in parallel to finish quickly, ignoring the rate limit.
   • BRequest a one-time full database export from the API provider via email.
   • CWrite a script that makes requests at a rate below the limit and handles pagination to retrieve all records.
   • DUse web scraping on the API's documentation page to extract the data.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat intelligence team collects indicators from a public blocklist that is known to have a high false-positive rate. The team also collects from a commercial feed that is highly accurate but has limited coverage. The team wants to create a combined indicator list for blocking. Which approach best balances false positives and coverage?

   • AUse the public blocklist as the primary source because it has more indicators.
   • BCombine both sources without any filtering to maximize coverage.
   • CUse the commercial feed as the primary source and use the public blocklist only for indicators that are also confirmed by another source.
   • DUse only the commercial feed because it is accurate.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat intelligence team is integrating bulk data collection into their intelligence lifecycle. They have collected a large dataset of indicators from various sources. According to the intelligence lifecycle, what should they do after processing and analysis?

   • AImmediately implement security controls based on the raw indicators.
   • BDelete the raw data to reduce storage costs.
   • CCollect more data to ensure completeness before sharing.
   • DDisseminate the intelligence reports to relevant stakeholders.
   Reveal Solution Discussion Select an answer first