Data Collection Methods and Techniques TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat intelligence team needs to collect data on a targeted attack against their organization's industrial control systems (ICS). They have limited resources and need to prioritize sources. Which source combination is most appropriate for this specific threat type?

   • AA single commercial feed that covers all industries
   • BOnly public vulnerability databases, ignoring internal logs
   • CGeneral social media monitoring and celebrity news feeds
   • DICS-specific threat feeds, vendor advisories, and internal ICS network logs
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which mitigation strategy is most effective for reducing the impact of false positives in threat intelligence data?

   • AIncreasing the number of data sources
   • BIgnoring alerts from external sources
   • CImplementing correlation and validation rules
   • DDeleting all alerts
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization is investigating a potential insider threat. The intelligence team needs to collect data on employee behavior while respecting privacy regulations. Which data source is most appropriate for this investigation?

   • AThird-party threat feeds that focus on insider threat indicators.
   • BHoneypots deployed on the internal network to lure the suspected employee into revealing malicious intent.
   • CPublicly available social media profiles of the employees under investigation.
   • DInternal authentication logs and access records, collected with proper legal authorization.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is correlating threat data from multiple open-source feeds and notices that many indicators are duplicates or conflict with each other. The analyst needs to produce a clean list of unique IOCs for blocking. Which mitigation strategy is most effective for this challenge?

   • AManually review each indicator and remove duplicates based on analyst judgment.
   • BUse a threat intelligence platform (TIP) that automates deduplication and normalization of indicators from multiple sources.
   • CSelect only the feed with the highest reputation and ignore all other sources.
   • DIncrease the collection frequency to ensure the data is more current and less likely to conflict.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations center (SOC) wants to automate the collection of threat intelligence from multiple sources, including APIs, RSS feeds, and public blocklists. They need to reduce manual effort and ensure timely updates. What is the best approach?

   • ADeploy a honeypot to collect data from the sources
   • BUse a single third-party feed that aggregates all data
   • CUse an automated threat intelligence platform (TIP) that integrates with these sources via APIs and connectors
   • DHave an analyst manually check each source daily
   Reveal Solution Discussion Select an answer first