Data Collection Methods and Techniques TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team needs to collect intelligence on a sophisticated adversary that is known to monitor for active scanning. The team has a mandate to avoid detection and must gather data on the adversary's command-and-control (C2) infrastructure. They have access to internal network logs, public threat feeds, and the ability to deploy a honeypot. Which collection strategy best balances stealth and data richness?

   • ASubscribe to a commercial threat feed that provides real-time C2 indicators and rely solely on that feed.
   • BDeploy a honeypot that mimics a vulnerable service and monitor all interactions with it.
   • CPerform active vulnerability scanning of IP addresses associated with the C2 infrastructure to gather more details.
   • DUse passive DNS data and internal NetFlow logs to identify C2 connections without interacting with the adversary.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An organization sets up a decoy server that appears to be a vulnerable database to attract and log attacker behavior. Which data collection technique is being used?

   • APassive DNS monitoring
   • BAPI integration
   • CHoneypot
   • DWeb scraping
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization is preparing to collect intelligence on a hacktivist group that is planning to deface their public website. The team needs to gather data on the group's likely attack methods. Which data source would be most valuable for this specific threat?

   • AHoneypots deployed on the organization's public web server.
   • BOpen-source intelligence (OSINT) from hacktivist forums and social media where the group discusses plans.
   • CInternal network traffic logs from the organization's own servers.
   • DGeneral threat intelligence feeds covering all types of malware.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat intelligence analyst needs to collect data from a public forum where attackers discuss new techniques. The forum requires login credentials and has anti-scraping measures. What is the most appropriate technique to collect this data?

   • ADeploy a honeypot to attract forum users
   • BUse a web scraping tool with proper authentication and respect for the site's terms of service
   • CManually copy and paste all relevant posts without any automation
   • DUse passive DNS monitoring to observe forum traffic
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization is preparing for a cyber threat assessment that must cover both external threats and insider threats. The team has limited resources and must choose which sources to prioritize. External threat feeds provide broad coverage of known threats, while internal HR and access logs can reveal insider behavior. What is the most effective source selection strategy?

   • AUse only internal logs because external threats are already covered by other teams
   • BUse only external feeds because insider threats are less common
   • CPrioritize internal logs for insider threat detection and use external feeds for context on external threats
   • DCollect from both sources equally without prioritization
   Reveal Solution Discussion Select an answer first