Data Analysis Techniques TIE Practice Questions (Page 12)

Questions 56–59

1. 56application · medium

   A security analyst is reviewing a year of authentication logs and notices that the number of failed logon attempts per day has been steadily increasing. The analyst wants to determine whether the increase is a gradual trend or an anomaly that requires immediate investigation. Which statistical method is most appropriate for this analysis?

   • ACreate a pie chart showing the proportion of failed logons by hour of day.
   • BCalculate the moving average and standard deviation to identify deviations from the expected baseline.
   • CCorrelate failed logon attempts with the number of new user accounts created each day.
   • DEnrich the log data with threat intelligence feeds to identify known malicious IPs.
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A security operations center observes that the number of phishing emails targeting the finance department has increased by 40% over the last month, while other departments have seen no change. To determine whether this is a significant shift or just random variation, which statistical method is most appropriate?

   • APerform a hypothesis test, such as a chi-square test, comparing the observed counts to expected counts based on historical data.
   • BCalculate the average number of phishing emails per day and compare it to the monthly total.
   • CUse a simple moving average to smooth the data and observe the trend.
   • DPlot the data on a line chart and visually inspect the trend.
   Reveal Solution Discussion Select an answer first
4. 58foundation · easy

   What is the primary purpose of data normalization in threat intelligence analysis?

   • ATo delete duplicate threat data to save storage space
   • BTo encrypt raw threat data so that it cannot be read by unauthorized parties
   • CTo enrich raw data with additional context from external sources
   • DTo convert raw threat data into a consistent, standardized format for analysis
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   An analyst has an IP address from a security alert. Which of the following actions would be considered data enrichment?

   • AComparing the IP address with other alerts to find patterns
   • BConverting the IP address into a standard format for storage
   • CLooking up the IP address in a WHOIS database to identify the owner
   • DDeleting the IP address if it appears in a whitelist
   Reveal Solution Discussion Select an answer first