Data Analysis Techniques TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst has correlated firewall logs with threat intelligence feeds and identified multiple source IPs that are attacking multiple internal hosts. The analyst needs to present this information to a non-technical manager to show which internal hosts are most targeted. Which visualization is most appropriate?

   • AA line chart of total attacks per day.
   • BA heat map showing the number of attacks per internal host over time.
   • CA scatter plot of source IPs versus destination ports.
   • DA pie chart of attack types.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large organization has been experiencing a gradual increase in phishing emails over the past six months. The security team has implemented a supervised machine learning model to classify emails as phishing or benign. The model's false positive rate is causing alert fatigue. The team wants to reduce false positives while maintaining high detection of actual phishing. Which approach is most effective?

   • AUse a different machine learning algorithm that is known to have lower false positives.
   • BStop using machine learning and rely on manual review of all emails.
   • CAdjust the classification threshold to require higher confidence before flagging an email as phishing.
   • DIncrease the amount of training data by adding more benign emails.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team wants to deploy a machine learning model to detect new malware variants. They have a large dataset of known malware and benign files. However, the team is concerned about the model's ability to generalize to unseen variants. Which approach best addresses this concern?

   • ATrain the model only on the most recent malware samples to reflect current threats.
   • BUse feature engineering to extract behavioral characteristics and train the model on a diverse dataset that includes multiple malware families.
   • CUse a simple model with few features to avoid overfitting.
   • DRely on signature-based detection for known variants and use ML only for unknown files.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A threat intelligence team has produced a detailed analysis of a new attack campaign. The analysis includes technical IoCs, TTPs, and recommended mitigations. The team needs to disseminate this intelligence to different audiences: the SOC analysts, the incident response team, and the executive leadership. What is the most effective dissemination strategy?

   • APublish the report on the internal wiki and let each audience find what they need.
   • BCreate tailored reports for each audience: a technical report with IoCs and TTPs for SOC/IR, and an executive summary with business impact for leadership.
   • CShare only the IoCs with the SOC and only the executive summary with leadership.
   • DSend the same detailed report to all audiences to ensure consistency.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small security team wants to build a threat intelligence capability with minimal budget. They plan to collect data from free public sources, internal logs, and a low-cost commercial feed. What is the most important consideration when combining these data sources?

   • AUse only the commercial feed because it is more reliable than free sources.
   • BStore all data in its original format to preserve fidelity.
   • CNormalize the data into a common format to enable consistent analysis and correlation.
   • DFocus on visualization to make the data understandable.
   Reveal Solution Discussion Select an answer first