Data Collection Methods and Techniques TIE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A threat intelligence team needs to collect data on a sophisticated adversary that is known to monitor for active scanning. The team has a requirement to gather network-level indicators without being detected. They also need to collect data from a public forum that requires login. Which combination of techniques best satisfies both requirements?

   • AUse passive network monitoring for the adversary's infrastructure and web scraping with authenticated access for the forum
   • BUse a honeypot to attract the adversary and use an API to access the forum
   • CUse active scanning for the adversary's infrastructure and manual copying for the forum
   • DUse passive DNS for the adversary's infrastructure and rely on third-party feeds for forum data
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A threat intelligence team is collecting data from multiple automated feeds. The team is experiencing a high rate of false positives, which is overwhelming the analysts. They have tried refining filters but the problem persists. What is the most effective next step to mitigate the false positive issue?

   • AIncrease the number of feeds to get more data and hope for better coverage
   • BDisable all automated collection and rely on a single trusted feed
   • CSwitch to manual collection to eliminate false positives
   • DImplement a scoring and prioritization system that weights sources based on historical accuracy
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An organization is investigating a targeted attack that uses a custom backdoor. The team has limited time and must choose between collecting data from internal network logs or from a commercial threat intelligence feed. The internal logs are known to be incomplete, but the feed may not contain indicators for the custom backdoor. What is the best approach?

   • ADelay the investigation until more complete logs are available
   • BUse only internal logs because the feed is unlikely to be relevant
   • CUse only the commercial feed because it is more reliable and comprehensive
   • DCollect from both internal logs and the feed, prioritizing internal logs for host-specific indicators
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A small security team needs to collect threat intelligence on malware campaigns targeting their industry. They have a limited budget and no dedicated threat intelligence platform. Which collection method is most cost-effective and sustainable for their needs?

   • ADeploy a large number of honeypots across the internet to collect malware samples.
   • BManually visit known malware analysis blogs and forums daily to gather IOCs.
   • CPurchase an expensive commercial threat intelligence platform that automates everything.
   • DSubscribe to free open-source threat intelligence feeds and use automated scripts to parse and store the data.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   When selecting a data source for threat intelligence, which factor is most important to ensure the data is useful for decision-making?

   • AThe source is popular among analysts
   • BThe source provides accurate and relevant data
   • CThe source is updated daily
   • DThe source is free to access
   Reveal Solution Discussion Select an answer first