Data Collection Methods and Techniques TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A small security team needs to collect threat intelligence on a limited budget. They want to cover a broad range of threats without hiring additional staff. Which collection method is most suitable?

   • AAutomated tools that aggregate data from multiple open-source feeds
   • BManual research by the existing team members
   • CRelying solely on third-party feeds without any internal collection
   • DPurchasing an expensive commercial intelligence platform
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team wants to collect threat intelligence on a new malware strain that is being distributed through a legitimate-looking website. The team needs to analyze the malware's behavior and the website's infrastructure. They have a legal constraint: they cannot interact with the website in a way that could be considered unauthorized access. Which collection technique is most appropriate?

   • AUse active scanning to enumerate the website's technologies and vulnerabilities
   • BUse a web scraping tool to extract all content from the website
   • CDeploy a honeypot that mimics the website to attract the malware
   • DUse passive collection methods, such as passive DNS and web traffic analysis, to observe the website's infrastructure
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence team is creating a collection plan for a quarterly cyber threat assessment. They have a limited budget and need to cover a wide range of threats. What is the most important element to include in the plan to ensure effective use of resources?

   • AA clear list of collection objectives and the specific sources to be used
   • BA schedule for daily collection without defining the scope
   • CA plan to use only free sources to minimize costs
   • DA commitment to collect as much data as possible from all available sources
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst is overwhelmed by the volume of alerts from multiple threat intelligence feeds, many of which are irrelevant. Which challenge is the analyst facing?

   • AData privacy
   • BData overload
   • CFalse positives
   • DSource reliability
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst needs to collect indicators of compromise (IOCs) from a newly discovered malware campaign. The analyst wants to gather data without alerting the attackers and without generating excessive network traffic. Which collection technique best meets this requirement?

   • ASubscribe to a commercial threat intelligence feed that provides IOCs for the campaign
   • BDeploy a honeypot that mimics a vulnerable service to capture attacker behavior
   • CUse passive DNS and netflow analysis to observe existing traffic and identify C2 domains
   • DPerform active scanning of the suspected C2 infrastructure to enumerate open ports
   Reveal Solution Discussion Select an answer first