Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is investigating a series of phishing emails that all point to a single domain. The domain was registered recently and is hosted on a cloud provider. The analyst wants to determine if the domain is part of a larger campaign. Which enrichment sources would be most valuable to identify related infrastructure?

   • APassive DNS to find other domains that resolve to the same IP, and threat intelligence feeds to see if the domain or IP is associated with known campaigns.
   • BOnly use passive DNS to see historical IP addresses.
   • COnly use threat intelligence feeds to get a reputation score for the domain.
   • DWHOIS to identify the registrant and geolocation to find the server location.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is investigating a suspicious domain that was used in a phishing campaign. The analyst wants to determine if the domain is still active and whether it is hosting malicious content. Which enrichment sources would be most useful?

   • AA port scan of the domain's web server.
   • BA search engine query for the domain name.
   • CWHOIS data for registration details and a URL reputation service to check for malicious content.
   • DGeolocation of the domain's IP address and a list of all domains hosted on the same IP.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security operations center (SOC) is integrating a new threat intelligence feed that provides indicators in a custom JSON format. The existing SIEM expects indicators in a specific CSV format. The SOC has a small team and needs to automate the integration to avoid manual work. Which approach would be most efficient for normalizing the feed data?

   • AWrite a script that parses the JSON and converts it to the CSV format required by the SIEM.
   • BUse a SIEM feature that automatically detects and converts JSON to CSV.
   • CAsk the feed provider to deliver the data in CSV format.
   • DManually convert the JSON to CSV using a text editor.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is investigating a suspicious file hash that was found on an infected host. The analyst wants to know if this hash is associated with any known malware family. Which enrichment source would be most appropriate?

   • APassive DNS for the file hash.
   • BGeolocation of the file hash.
   • CA malware analysis platform or threat intelligence feed that provides hash reputation and malware family associations.
   • DWHOIS lookup for the file hash.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat intelligence platform (TIP) ingests millions of raw events daily. The SOC team is overwhelmed by the volume and needs to focus on the most critical threats to the organization. The team has already normalized and enriched the data. What is the next step to extract actionable intelligence?

   • AShare all indicators with external partners to increase collective defense.
   • BApply a scoring model that prioritizes indicators based on relevance to the organization's assets, timeliness of the data, and accuracy of the source.
   • CGenerate a daily report of all unique IP addresses seen in the last 24 hours.
   • DStore all enriched data in a data warehouse for future forensic analysis.
   Reveal Solution Discussion Select an answer first