Bulk Data Collection Methods and Considerations TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat intelligence team has collected a large volume of data and is now in the analysis phase. They have identified several indicators of compromise (IOCs). What should they do next to ensure the intelligence is effectively used?

   • ADelete the raw data to protect sensitive information.
   • BCreate actionable intelligence reports and disseminate them to relevant stakeholders.
   • CStore the IOCs in a database and wait for further instructions.
   • DShare the raw IOCs with all employees immediately.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What does data normalization address in the context of bulk-collected data?

   • AConverting data from various formats into a consistent, standardized format
   • BCompressing data to save storage space
   • CEncrypting data to protect it from unauthorized access
   • DDeleting duplicate records automatically
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence analyst is collecting data from public social media posts to identify potential insider threats. The analyst plans to store the data in a central database. What is a key legal consideration?

   • AThe data should be stored only for a limited time to save storage costs.
   • BThe analyst must obtain consent from every individual whose data is collected.
   • CThe data must be encrypted at rest to protect against breaches.
   • DThe collection must comply with data protection regulations like GDPR, which may require a legal basis for processing personal data.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst collects a large dataset of threat indicators from a public malware repository to enrich their SIEM. After loading the data, they notice many indicators are outdated and some are duplicates. What should the analyst do first to improve the dataset's usefulness?

   • ADelete all indicators older than one week to ensure only recent data is used.
   • BImmediately feed all indicators into the SIEM to maximize coverage.
   • CPerform data deduplication and validate the indicators' freshness against known threat intelligence sources.
   • DStore the raw dataset in a data lake for future analysis without any processing.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization collects billions of DNS records daily from multiple sensors to identify domain generation algorithm (DGA) activity. The raw data is stored in a distributed file system, but analysts complain that queries are slow and the data is difficult to search. The team needs to improve query performance without losing raw data. Which approach best addresses this challenge?

   • AUse a relational database to store all raw records with proper indexing.
   • BLoad all raw data into memory on a single powerful server to speed up queries.
   • CBuild a normalized and indexed secondary store (e.g., a columnar database) for fast querying while retaining the raw data in the distributed file system.
   • DDelete raw records older than 30 days and keep only aggregated summaries.
   Reveal Solution Discussion Select an answer first