Data Analysis Techniques TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security operations center (SOC) analyst is correlating firewall logs with endpoint detection alerts. The firewall logs use IP addresses and port numbers, while the endpoint alerts use hostnames and process names. The analyst needs to identify whether a specific external IP address is associated with a series of failed logon attempts on multiple hosts. Which action should the analyst take first to enable effective correlation?

   • AEnrich the firewall logs with geolocation data for the external IP address.
   • BApply a machine learning clustering algorithm to group similar failed logon events.
   • CNormalize both data sources into a common schema that maps IP addresses and timestamps consistently.
   • DCreate a heat map of failed logon attempts by source IP address.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A threat intelligence analyst has completed an analysis of a new malware campaign targeting the organization. The analyst needs to inform the executive leadership about the potential business impact and the board of directors about the strategic implications. What is the most effective way to disseminate this intelligence?

   • ASend the full technical report with all IoCs and TTPs to the executives.
   • BShare the raw threat intelligence data with the board for their review.
   • CPost the analysis on the internal wiki for all employees to read.
   • DPrepare a high-level executive summary that focuses on business risk and recommended actions.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security operations center is correlating endpoint detection and response (EDR) alerts with DNS logs to identify potential data exfiltration. The EDR alerts include process names and file paths, while DNS logs include domain names and IP addresses. The analyst has normalized both data sources to a common schema. Which additional step is most important to identify a relationship between a specific process and a suspicious domain?

   • ACorrelate the process execution timestamps with DNS query timestamps for the same host.
   • BApply a machine learning model to classify the domain as malicious or benign.
   • CVisualize the DNS queries on a timeline to see overall query volume.
   • DEnrich the domain with geolocation data to determine where the DNS server is located.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A large organization collects threat data from multiple sources: a commercial feed that provides IoCs in STIX format, an open-source feed that provides CSV files, and internal logs in JSON. The team wants to correlate these data to identify a potential campaign. They have noticed that the commercial feed uses a different timestamp format than the internal logs. What is the most critical first step to enable effective correlation?

   • AManually map the fields from each source to a common standard.
   • BUse a data lake to store all raw data without transformation and rely on query-time processing.
   • CNormalize all data into a common schema and standardize timestamp formats.
   • DConvert all data to STIX format because it is the industry standard.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An incident response team has observed a series of attacks that appear to follow a specific pattern: initial access via a vulnerable web application, privilege escalation using a known exploit, and data exfiltration via encrypted channels. The team wants to develop countermeasures that address the entire attack chain. What is the most effective approach?

   • AMonitor for the specific IoCs observed in the attacks.
   • BPerform a TTP analysis to map the attack chain to a framework and identify mitigation points at each stage.
   • CConduct a risk assessment to prioritize which part of the attack chain to mitigate.
   • DFocus on blocking the initial access vector by patching the web application vulnerability.
   Reveal Solution Discussion Select an answer first