Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat intelligence team has collected a large amount of data from various sources, including social media, forums, and technical reports. The team needs to identify emerging threats that are relevant to the organization. Which approach would best support the extraction of emerging threats?

   • ANormalize the data into a common format and then store it without further analysis.
   • BUse text mining and natural language processing to identify keywords and trends related to the organization's industry.
   • CManually read all social media posts and forum threads.
   • DEnrich the data with geolocation and then sort by country.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat intelligence team is responsible for producing a daily threat summary for a large enterprise. The team has a limited budget and cannot afford a commercial threat intelligence platform. They have access to open-source feeds, a SIEM, and a free WHOIS service. The team needs to extract actionable intelligence efficiently. What is the most effective approach?

   • AManually review all open-source feeds and compile a list of indicators.
   • BSubscribe to a free threat feed and block all indicators without validation.
   • CUse only the SIEM to detect anomalies without incorporating external threat feeds.
   • DUse the SIEM to correlate open-source feed indicators with internal logs, and manually enrich the most relevant hits with WHOIS and other free sources.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst has a list of 10,000 indicators from various sources. The analyst needs to identify which indicators are most likely to be used in an imminent attack against the organization's network. The data has been normalized and enriched. What is the most effective method to extract the most relevant indicators?

   • APrioritize indicators that are recent, have a high confidence score, and are directly related to the organization's attack surface.
   • BUse all indicators to create a comprehensive blocklist.
   • CFocus on indicators that have been seen in the most number of sources.
   • DSelect indicators that are easiest to block, such as IP addresses, regardless of other factors.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst has a list of suspicious IP addresses that triggered alerts on the organization's perimeter firewall. The analyst needs to determine which of these IPs are associated with known malicious infrastructure and which are simply false positives from legitimate services. The analyst has access to a commercial threat intelligence feed, WHOIS data, and geolocation services. What is the most effective way to enrich the IP addresses?

   • AUse geolocation alone to identify the country of origin and block all IPs from high-risk countries.
   • BSubmit the IPs to a public sandbox for detonation to see if they host malware.
   • CQuery the threat intelligence feed for reputation scores and known indicators, then cross-reference with WHOIS and geolocation for context.
   • DPerform a reverse DNS lookup on each IP and compare the domain names to a list of known-good domains.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is investigating a phishing campaign that uses a newly registered domain. The analyst has the domain name and wants to determine the registrant's identity and whether the domain is associated with known malicious activity. Which enrichment sources would be most useful for this investigation?

   • ASocial media profiles of the domain owner and a search engine query.
   • BReverse DNS lookup and a port scan of the domain's web server.
   • CGeolocation of the domain's IP address and a list of top-level domains.
   • DWHOIS registration data and a threat intelligence feed that tracks domain reputation.
   Reveal Solution Discussion Select an answer first