Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security operations center (SOC) receives threat data from multiple sources in different formats. The SOC uses a SIEM that requires data to be in a specific schema. The team has a data pipeline that ingests raw data and needs to normalize it before sending it to the SIEM. However, the team also needs to preserve the original raw data for forensic investigations. What is the best way to design the pipeline?

   • ANormalize the data at the source before ingestion to avoid storing raw data.
   • BIngest raw data into a data lake, then process and normalize it into the SIEM schema, while keeping the raw data in the data lake for forensic use.
   • CStore only normalized data in the SIEM and discard raw data after processing.
   • DSend raw data directly to the SIEM and let the SIEM normalize it.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is reviewing a large dataset of network flows to identify potential command-and-control (C2) communication. The dataset contains millions of records, and the analyst needs to quickly identify the most suspicious connections for further investigation. Which approach would best support the extraction of actionable intelligence from this dataset?

   • ABlock all connections to IP addresses in foreign countries.
   • BManually review all connections to ensure no suspicious activity is missed.
   • CEnrich the dataset with WHOIS data and then sort by domain age.
   • DUse statistical anomaly detection to flag connections that deviate from normal behavior.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team is ingesting threat intelligence from multiple sources, including a STIX/TAXII feed, a CSV file, and a JSON API. The team wants to store all indicators in a single database for querying. Which normalization step is essential before loading the data into the database?

   • AConvert all indicators to a common format, such as STIX 2.1.
   • BEnrich each indicator with geolocation data.
   • CStore each source in a separate table to preserve the original format.
   • DRemove all indicators that are not in the STIX format.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is investigating a series of attacks targeting the company's web servers. The analyst has the source IP addresses of the attacks and wants to understand the attacker's infrastructure and potential motivation. Which enrichment would provide the most useful context for this investigation?

   • AA list of all IP addresses that have accessed the company's website.
   • BWHOIS data for the IP addresses and a threat intelligence feed that tracks known attacker infrastructure.
   • CGeolocation of the IP addresses to identify the country of origin.
   • DReverse DNS lookup to identify the hostnames associated with the IPs.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   During an investigation, an analyst extracts an IP address from a phishing email. To increase the value of this raw indicator, the analyst looks up the IP's geolocation, WHOIS registration details, and checks it against known threat intelligence feeds. What is this process called?

   • AData normalization
   • BData enrichment
   • CData validation
   • DData reduction
   Reveal Solution Discussion Select an answer first