Bulk Data Collection Methods and Considerations TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat intelligence team is tasked with building a baseline of malicious infrastructure indicators from public passive DNS databases and certificate transparency logs. They plan to pull millions of records daily and store them for historical correlation. The team must ensure the collection pipeline does not overwhelm the existing SIEM, which is already near capacity. Which approach best addresses the storage and processing challenge while still supporting the intelligence lifecycle?

   • AIngest raw records directly into the SIEM and rely on its existing retention policy to manage growth.
   • BDiscard records older than 24 hours to keep storage requirements minimal.
   • CStore raw records in a scalable data lake, then process and normalize only relevant indicators into the SIEM.
   • DUse the SIEM's built-in log forwarder to compress and store all records in its long-term archive.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat intelligence analyst needs to collect a large volume of public data from multiple social media platforms to track a coordinated disinformation campaign. The analyst must comply with each platform's terms of service and avoid legal issues. Which approach best balances data volume with compliance?

   • AUse each platform's official API with rate limits and appropriate authentication to collect data within allowed boundaries.
   • BManually copy and paste relevant posts into a spreadsheet to avoid any automated access.
   • CUse a web scraper to extract all public posts and user profiles from each platform without authentication.
   • DPurchase user data from a third-party data broker that aggregates social media information.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A threat intelligence platform is ingesting billions of events daily from multiple sources. The team needs to provide near-real-time analysis while also retaining historical data for long-term trend analysis. Which architecture best meets both requirements?

   • AA batch processing system that runs nightly to analyze all data.
   • BAn in-memory data grid that stores all data for instant access.
   • CA single relational database that stores all data and supports real-time queries.
   • DA streaming pipeline that processes data in real-time and stores raw data in a scalable data lake for later analysis.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A threat intelligence platform ingests data from a dark web forum that is known to be heavily infiltrated by law enforcement and researchers. The data contains many false claims and deliberate misinformation. The platform also ingests a commercial feed that is well-vetted. The team wants to reduce the impact of misinformation while still gaining unique insights from the forum. Which strategy is most effective?

   • AIncrease the collection frequency from the forum to gather more data and statistically dilute the misinformation.
   • BUse only the commercial feed and ignore the forum because it is unreliable.
   • CRemove the forum from the collection sources entirely to avoid misinformation.
   • DTreat forum data as low-confidence and require corroboration from the commercial feed or other independent sources before elevating any indicator.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of bulk data collection in the context of threat intelligence?

   • ATo provide raw data directly to end users without any processing or analysis
   • BTo gather a large volume of diverse data points that can be analyzed to identify patterns and emerging threats
   • CTo store all available internet data for indefinite retention and future legal proceedings
   • DTo replace human analysts with automated systems that make final threat determinations
   Reveal Solution Discussion Select an answer first