Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A multinational company's SOC receives threat intelligence from multiple sources, including a commercial feed that uses STIX/TAXII, an open-source feed that provides CSV files, and internal sensors that output JSON. The SOC wants to correlate indicators of compromise (IOCs) across these sources to detect attacks. The team has limited engineering resources and needs a solution that can be implemented quickly. Which approach best balances the need for consistency and the limited resources?

   • AUse a threat intelligence platform (TIP) that supports multiple data formats and provides built-in normalization.
   • BBuild a custom normalization layer that converts all sources into a single internal schema.
   • CManually convert each source into a common format using spreadsheets.
   • DStore the data in its original format and use a search engine to correlate IOCs.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations center (SOC) receives threat data from multiple sources: firewall logs that record IP addresses in dotted-decimal, DNS logs that use fully qualified domain names, and a threat intelligence feed that uses CIDR notation. Analysts are struggling to correlate events because the same host appears in different formats across sources. The SOC manager wants a single, unified view for analysis. Which approach should the analyst take first?

   • AEnrich the threat feed with WHOIS data for every IP before attempting any correlation.
   • BNormalize all IP addresses to a consistent format (e.g., integer or dotted-decimal) and map domain names to their resolved IPs where possible.
   • CCreate a separate dashboard for each source so analysts can manually compare the data.
   • DStore all raw logs in a data lake and query them with a search engine that supports fuzzy matching.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A threat intelligence team has a large volume of indicators that have been normalized and enriched. The team needs to produce a report for the board of directors that highlights the top threats to the organization. The team has limited time and must ensure the report is accurate and relevant. What is the most effective way to extract the intelligence for this report?

   • AUse only indicators with high confidence, regardless of relevance.
   • BUse a scoring model that weighs relevance to the organization's industry, confidence, and recency to select the top indicators, and then have an analyst validate the findings.
   • CManually review all indicators to ensure nothing is missed.
   • DUse only the most recent indicators, regardless of relevance.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence team has a large dataset of indicators that have been normalized and enriched. The team needs to provide a weekly report to the CISO that summarizes the top threats and recommends actions. What is the most effective way to extract the intelligence for this report?

   • AList all indicators in the report without any analysis.
   • BInclude only indicators that have a high confidence score, even if they are not relevant to the organization.
   • CFocus only on the most recent indicators, regardless of their relevance.
   • DIdentify trends and patterns in the data, such as increasing activity from specific threat actors or regions, and correlate them with the organization's risk profile.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   An analyst has a list of suspicious domains from network logs. Which enrichment source would provide the most direct information about the domain's registration owner and contact details?

   • AGeolocation database
   • BWHOIS database
   • CSandboxing report
   • DNetwork flow logs
   Reveal Solution Discussion Select an answer first