Data Analysis Techniques TIE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which type of machine learning is commonly used to detect anomalies in network traffic?

   • AReinforcement learning
   • BSemi-supervised learning
   • CSupervised learning
   • DUnsupervised learning
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A threat intelligence analyst has extracted a list of suspicious IP addresses from internal DNS logs. The analyst wants to determine which of these IPs are known command-and-control (C2) servers and what malware families they are associated with. Which approach best improves the value of this raw data?

   • ACross-reference the IPs against a commercial threat intelligence feed that provides malware family and C2 context.
   • BVisualize the IPs on a network graph showing connections to internal hosts.
   • CNormalize the IP addresses into a consistent format for storage in a SIEM.
   • DPerform statistical trend analysis on the frequency of DNS queries to these IPs over the past month.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   During an incident response, an analyst observes that the attacker used a spear-phishing email with a malicious attachment, then used PowerShell to download a payload, and finally established persistence via a scheduled task. What is the most valuable output for the organization's defensive team?

   • AA detailed report of the TTPs used, mapped to a framework like MITRE ATT&CK, with recommended detection rules.
   • BA summary of the financial impact of the incident.
   • CA timeline of the attack events with timestamps.
   • DA list of the specific file hashes and IP addresses involved in the incident.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a common standard used to normalize threat intelligence data?

   • ACSV (Comma-Separated Values)
   • BXML (eXtensible Markup Language)
   • CSTIX (Structured Threat Information eXpression)
   • DJSON (JavaScript Object Notation)
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A threat intelligence team has identified two active threats: Threat A has a high likelihood of occurring but low impact, while Threat B has a low likelihood but high impact. The team has limited resources to address only one threat. Which threat should be prioritized?

   • AThreat B, because the impact is high and could cause significant damage.
   • BPrioritize the threat that is easiest to mitigate, regardless of likelihood and impact.
   • CPrioritize based on a risk score that combines both likelihood and impact, such as likelihood × impact.
   • DThreat A, because it is more likely to occur and will happen sooner.
   Reveal Solution Discussion Select an answer first