Data Analysis Techniques TIE Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   Why is it important to tailor threat intelligence reports to different audiences?

   • ATo comply with legal requirements
   • BTo ensure the report is as long as possible
   • CDifferent audiences have different levels of technical expertise and decision-making needs
   • DTo hide sensitive information from lower-level employees
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   An analyst is reviewing a set of IoCs from a recent incident. One IoC is a file hash that is associated with a known banking trojan, but the hash has a low reputation score on a commercial feed. Another IoC is an IP address that has been observed in multiple campaigns. Which IoC should be prioritized for blocking?

   • AThe IP address, because it is associated with multiple campaigns and may be more broadly malicious.
   • BNeither, because IoCs are not reliable enough for blocking decisions.
   • CBoth equally, because both are IoCs and should be blocked immediately.
   • DThe file hash, because it is associated with a known banking trojan.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A threat intelligence analyst must prepare a report for the board of directors about a recent ransomware attack. The board is not technical and is primarily concerned with business impact. What is the most appropriate way to present the findings?

   • APresent a timeline of the attack with every technical step and timestamp.
   • BFocus on the TTPs used by the attacker and recommend specific detection rules.
   • CProvide a high-level summary focusing on business impact, such as downtime, financial loss, and remediation status, with simple visuals.
   • DInclude detailed technical indicators and malware analysis to demonstrate thoroughness.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   What is the main benefit of using visualization techniques in threat intelligence analysis?

   • AThey guarantee the accuracy of threat intelligence data
   • BThey automatically identify all threats without human intervention
   • CThey make complex data easier to understand and communicate
   • DThey replace the need for statistical analysis
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A security team is analyzing network traffic to detect anomalies. They have a baseline of normal traffic patterns. They notice a sudden spike in outbound traffic to a specific external IP address during off-hours. The team wants to determine if this is a security incident or just a false positive. Which statistical method is most appropriate to assess this anomaly?

   • APlot the traffic on a line chart and visually inspect the spike.
   • BUse a z-score or standard deviation analysis to compare the current traffic to the baseline.
   • CUse a moving average to smooth the data and see if the spike is still visible.
   • DCalculate the average traffic over the past year and compare it to the current spike.
   Reveal Solution Discussion Select an answer first