Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An analyst has identified a suspicious file hash from a malware sample. The analyst wants to determine if this hash is associated with a known threat actor group and what type of malware it is. Which enrichment sources would provide the most relevant context?

   • AA list of all file hashes seen in the organization's network.
   • BWHOIS data for the domain that delivered the malware.
   • CA threat intelligence platform that provides malware family and actor attribution.
   • DGeolocation of the IP address that hosted the malware.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A multinational organization has a threat intelligence platform that ingests data from multiple sources, including internal logs, commercial feeds, and open-source feeds. The data is stored in a data lake. The team has noticed that the same IP address appears in different formats: some sources use dotted-decimal, some use integer, and some use CIDR. The team also has a requirement to preserve the original raw data for compliance purposes. The team needs to enable efficient correlation and analysis while maintaining the raw data. What is the best approach?

   • ACreate a normalized and enriched view of the data for analysis, while preserving the original raw data in its native format in the data lake.
   • BOverwrite the raw data with the normalized format to save storage space.
   • CStore the raw data in a separate database and only use the normalized data for analysis.
   • DKeep only the normalized data and discard the raw data after processing.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team is consolidating threat intelligence from multiple sources into a single repository. The sources use different formats for IP addresses, including IPv4, IPv6, and CIDR notation. The team needs to ensure that all IP addresses can be queried consistently. What should the team do?

   • AStore the IP addresses in their original formats and use a search engine to find matches.
   • BCreate separate tables for IPv4, IPv6, and CIDR notation.
   • CConvert all IP addresses to a single format, such as IPv4 or IPv6, and expand CIDR notation into individual IPs.
   • DEnrich the IP addresses with geolocation data to differentiate them.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A threat intelligence team is tasked with identifying which indicators from a large dataset are most relevant to the organization's current security posture. The dataset includes indicators from various sources, some of which are outdated. Which approach would best help the team extract the most useful intelligence?

   • ANormalize the indicators and then present them all to the security team.
   • BFilter indicators based on their age and relevance to the organization's industry and infrastructure.
   • CEnrich the indicators with geolocation data and then sort by country.
   • DInclude all indicators regardless of age to ensure completeness.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team is integrating a new threat intelligence feed that provides indicators in STIX/TAXII format. The team's existing TIP uses a custom JSON schema. The team needs to ingest the new feed without disrupting existing workflows. What is the first step the team should take?

   • AReplace the TIP's JSON schema with STIX/TAXII to avoid transformation.
   • BMap the STIX/TAXII fields to the TIP's JSON schema and write a parser to transform the data.
   • CManually copy the indicators from the STIX/TAXII feed into the TIP.
   • DStore the STIX/TAXII data in a separate database and query it separately.
   Reveal Solution Discussion Select an answer first