Bulk Data Collection Methods and Considerations TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations center (SOC) is planning to implement bulk data collection to improve their threat intelligence capabilities. They want to ensure the collected data is actionable and aligns with their intelligence requirements. What should be their first step?

   • ABegin collecting data from as many sources as possible.
   • BPurchase a commercial threat intelligence feed to supplement internal data.
   • CDefine clear intelligence requirements and collection objectives.
   • DSet up the storage infrastructure to handle large volumes of data.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A threat intelligence team is collecting large volumes of data from multiple sources, including social media and dark web forums. The data is in different formats (JSON, HTML, plain text). The team needs to integrate this data into a single platform for analysis. Which step is essential before the data can be effectively analyzed?

   • AStore the data in its original format to preserve fidelity.
   • BUse a separate database for each data format.
   • CNormalize the data into a common schema or format.
   • DConvert all data to a single text file for simplicity.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An intelligence team wants to collect data from dark web forums to monitor for leaked credentials. They have access to a commercial dark web monitoring service that provides curated data. What is the primary advantage of using this service over collecting directly?

   • AIt provides data in a normalized and structured format, reducing processing effort.
   • BIt guarantees the data is 100% accurate and relevant.
   • CIt eliminates all legal and ethical concerns.
   • DIt allows unlimited collection without rate limits.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A threat intelligence team is implementing a new bulk collection capability. The team has limited resources and must decide where to focus its efforts. The stakeholders include the SOC, which needs timely indicators for blocking, and the executive team, which needs strategic reports on emerging threats. The team has a budget for only one major improvement. Which improvement would provide the most value across both stakeholder groups?

   • AFocus on dissemination by creating more distribution channels, such as email and Slack.
   • BEnhance the analysis and production stage to generate both tactical indicators and strategic reports from the collected data.
   • CInvest in better storage to retain more historical data.
   • DImprove the collection pipeline to ingest more sources and increase data volume.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A threat intelligence team is collecting data from a public forum that requires users to agree to a terms of service that prohibits automated scraping. The team wants to use the data to identify emerging malware campaigns. The team's legal department has approved the collection under a 'legitimate interest' argument. Which additional step is most important to maintain ethical and legal compliance?

   • AMinimize the data collected to only what is necessary for the stated purpose and ensure it is stored securely.
   • BPublish the collected data publicly to increase transparency.
   • CIgnore the terms of service because legal has approved the collection.
   • DCollect as much data as possible to maximize the value of the intelligence.
   Reveal Solution Discussion Select an answer first