Data Analysis Techniques TIE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of a commercial source of threat intelligence?

   • AAn organization's own intrusion detection system alerts
   • BA subscription to a vendor's threat intelligence platform
   • CA public forum where security analysts share IoCs
   • DA government publication of malware analysis reports
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the goal of data correlation in threat intelligence analysis?

   • ATo remove false positives from threat data
   • BTo convert raw data into a standardized format
   • CTo assign a severity score to each threat indicator
   • DTo identify relationships between disparate data points that indicate a threat
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An incident response team has analyzed a series of attacks against multiple organizations in the same industry. The attacks share similar TTPs, including the use of a specific phishing lure and a common C2 infrastructure. The team wants to develop countermeasures that will be effective against future attacks. What is the most valuable action?

   • AConduct a post-incident review to identify lessons learned and update internal policies.
   • BIncrease security awareness training for employees to recognize phishing emails.
   • CPublish a detailed TTP analysis report with recommended detection rules and share it with industry peers.
   • DBlock the specific C2 IP addresses and domains observed in the attacks.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of data enrichment in threat intelligence analysis?

   • ATo add additional context from external sources to raw data
   • BTo remove irrelevant data points from a dataset
   • CTo encrypt data for secure storage
   • DTo convert data into a standardized format
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team wants to automate the detection of new malware variants by analyzing file characteristics such as API calls, file size, and entropy. They have a large dataset of known malware and benign files. Which machine learning approach is most suitable for this task?

   • AApply a simple rule-based system that flags files with high entropy.
   • BUse a time-series forecasting model to predict future malware variants.
   • CUse unsupervised clustering to group files without labels and manually inspect each cluster.
   • DTrain a supervised classification model on labeled samples of malware and benign files.
   Reveal Solution Discussion Select an answer first