The Threat Intelligence Generation Process TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is processing threat intelligence data from a commercial feed. The feed contains IP addresses, domains, and file hashes. The analyst notices that some file hashes are in MD5 format while others are in SHA256, and some IP addresses are in CIDR notation while others are single IPs. What is the best way to handle this data during the processing phase?

   • AKeep the data in its original format to avoid any potential loss of information.
   • BCreate separate datasets for each format and analyze them independently.
   • CConvert all hashes to a single format (e.g., SHA256) and expand CIDR notation into individual IPs or standardize the representation.
   • DOnly use the SHA256 hashes and discard the MD5 hashes.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security operations center wants to collect threat intelligence from the dark web to identify early signs of attacks against their organization. They have a limited budget and must comply with legal and ethical guidelines. What is the most appropriate collection method?

   • AUse a web scraper to collect data from dark web sites without authorization.
   • BHave an analyst create a fake identity and interact directly with threat actors.
   • CUse commercial dark web monitoring services that provide vetted and legal access to relevant forums and marketplaces.
   • DSet up a honeypot on the dark web to attract threat actors.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A multinational organization is building a threat intelligence program. They need to collect data from internal sensors, external OSINT, and industry sharing groups. However, they have a limited number of analysts and must prioritize which sources to integrate first. Which approach best balances coverage and analyst workload?

   • AUse only external OSINT feeds because they are free and comprehensive.
   • BRely on industry sharing groups only, as they provide vetted intelligence.
   • CStart with internal logs and a curated set of high-value OSINT feeds, then expand based on analyst capacity.
   • DIntegrate all possible sources at once to maximize coverage.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of a finished intelligence product produced during the intelligence production stage?

   • AA raw packet capture from a network sensor
   • BA tactical threat advisory describing a new malware campaign
   • CA normalized CSV file of indicators
   • DA list of unprocessed IP addresses from a firewall log
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is processing raw data from multiple sources: firewall logs, proxy logs, and a threat feed. The data contains timestamps in different time zones, IP addresses in both IPv4 and IPv6 formats, and some entries with missing fields. What is the primary goal of the data processing and normalization phase in this context?

   • AKeep the data in its original format to avoid any loss of fidelity.
   • BDelete all entries with missing fields to ensure data quality.
   • CImmediately convert all IP addresses to a single format and ignore timestamps.
   • DConvert all timestamps to a single time zone, standardize IP address formats, and handle missing fields to create a consistent dataset for analysis.
   Reveal Solution Discussion Select an answer first