Data Analysis Techniques TIE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is it important to assess the severity and relevance of an IoC?

   • ATo automatically block all IP addresses associated with the IoC
   • BTo delete the IoC from the database
   • CTo ensure the IoC is shared with all employees
   • DTo prioritize response actions based on the potential impact
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an incident response, an analyst observes that an attacker used a spear-phishing email to deliver a macro-enabled document, then used PowerShell to download a remote access tool, and finally established persistence via a scheduled task. The analyst wants to document this behavior to help the detection engineering team build better controls. What should the analyst produce?

   • AA statistical analysis of the number of phishing emails received in the past month.
   • BA TTP analysis that maps each observed action to a known adversary behavior framework.
   • CA risk assessment that rates the likelihood and impact of the incident.
   • DA list of IoCs including the email subject, file hash, and scheduled task name.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a common application of machine learning in threat intelligence analysis?

   • AAutomating the classification of malware samples
   • BReplacing human analysts entirely
   • CGuaranteeing the accuracy of threat intelligence reports
   • DEliminating all false positives in threat detection
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which visualization technique is most appropriate for showing the geographic distribution of attack sources?

   • APie chart
   • BLine chart
   • CHeat map
   • DScatter plot
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat intelligence analyst has a list of IP addresses that were flagged as malicious by an automated system. Before including them in a report to the incident response team, what should the analyst do to improve the value of the report?

   • ARemove any IPs that are not in the top 10 most critical to keep the report short.
   • BSend the raw list directly to the IR team to avoid delays.
   • CConvert the IPs to a different format, such as CIDR, to make them more readable.
   • DEnrich the IPs with additional context such as geolocation, ownership, and associated domains from external sources.
   Reveal Solution Discussion Select an answer first