Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A threat intelligence team has a large volume of raw data from multiple sources. The team needs to produce a prioritized list of indicators for the security operations team to block. The team has limited time and must ensure that the indicators are accurate and relevant. Which approach would best balance speed and accuracy?

   • ABlock all indicators from the most recent feed without further analysis.
   • BUse an automated pipeline that normalizes, enriches, and scores indicators based on threat intelligence and relevance.
   • CEnrich the indicators with geolocation and then block those from high-risk countries.
   • DManually review each indicator to ensure accuracy.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A threat intelligence team has collected and enriched a large volume of data. To extract actionable intelligence for decision-making, which criteria should the team prioritize?

   • AVolume, velocity, and variety
   • BRelevance, timeliness, and accuracy
   • CComplexity, novelty, and uniqueness
   • DConfidentiality, integrity, and availability
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A threat intelligence analyst has extracted a list of suspicious IP addresses from a malware sandbox report. The analyst needs to determine which of these IPs are likely malicious and prioritize them for blocking. The analyst has access to a commercial threat intelligence feed, WHOIS data, and geolocation services. Which combination of actions would best enrich the IP addresses to support prioritization?

   • ASubmit the IPs to a public sandbox for re-analysis.
   • BPerform a reverse DNS lookup on each IP and block those with suspicious hostnames.
   • CGeolocate the IPs and block all IPs in high-risk countries.
   • DCross-reference the IPs with the threat intelligence feed and check WHOIS registration data.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) ingests firewall logs, DNS logs, and proxy logs from three different vendors. The logs use different timestamp formats (Unix epoch, ISO 8601, and a vendor-specific format) and different IP address representations (IPv4 dotted-decimal, IPv6, and a vendor-specific integer format). Analysts are spending too much time correlating events across these sources. Which approach should the SOC take to reduce the time spent on correlation?

   • AStore the logs in their original formats and build a custom parser for each analyst query.
   • BConvert all logs to a single vendor's proprietary format for consistency.
   • CEnrich the logs with WHOIS data before storing them.
   • DNormalize all logs into a common schema with standardized timestamps and IP addresses before ingestion.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence team has collected a large volume of raw data from open-source intelligence (OSINT), dark web forums, and internal security logs. The team needs to produce a daily intelligence summary for executives that highlights only the most relevant and actionable threats. Which process would best support the extraction of useful intelligence from this data?

   • AInclude all raw data in the summary to ensure no information is missed.
   • BEnrich the data with geolocation and WHOIS information before summarizing.
   • CNormalize the data into a common format and then present it without further analysis.
   • DApply automated filtering and scoring to prioritize threats based on relevance to the organization's industry and infrastructure.
   Reveal Solution Discussion Select an answer first