Data Collection Methods and Techniques TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to collect threat intelligence about a new ransomware family that is spreading via malicious email attachments. They need to gather samples and analyze the delivery mechanism. Which collection technique is most effective for this purpose?

   • AUse passive DNS monitoring to track the ransomware's C2 domains
   • BPerform active scanning of the ransomware's distribution servers
   • CSet up a honeypot email account to capture malicious attachments
   • DSubscribe to a threat intelligence feed that lists ransomware IOCs
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is using an automated tool to collect threat intelligence from social media. The tool is generating a large number of alerts, but many are false positives. What is the best way to reduce the false positive rate?

   • AIncrease the frequency of collection to capture more data
   • BDisable all automated collection and rely on manual monitoring
   • CRefine the collection criteria and use keyword filters that are more specific to the threat
   • DSwitch to a different social media platform entirely
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat intelligence analyst wants to collect data on a newly discovered exploit kit. The analyst needs to understand the exploit kit's delivery mechanisms without directly interacting with the malicious infrastructure. Which technique is most appropriate?

   • AUse a sandbox to detonate samples of the exploit kit and observe its behavior.
   • BAnalyze passive DNS records and web proxy logs to identify domains and URLs associated with the exploit kit.
   • CPerform active scanning of the exploit kit's command-and-control servers to identify vulnerabilities.
   • DSubscribe to a threat feed that provides exploit kit signatures and rely on that data alone.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An analyst needs to understand the current malware families targeting their industry. Which type of data source would be most appropriate?

   • AFinancial transaction logs
   • BBuilding access logs
   • CThreat intelligence feeds
   • DEmployee HR records
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is collecting threat intelligence from multiple open-source feeds. The analyst notices that some feeds report conflicting information about the same malware family, and the volume of data is overwhelming. What is the most effective way to address these challenges?

   • ADisable all automated feeds and rely solely on manual research to ensure accuracy
   • BAccept the conflicting data as-is and include all indicators in the final report
   • CCorrelate data from multiple sources and apply a scoring system to assess source reliability
   • DUse only the feed with the highest volume of data to ensure comprehensive coverage
   Reveal Solution Discussion Select an answer first