The Threat Intelligence Generation Process TIE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a common source of raw data for threat intelligence collection?

   • AFinal intelligence reports from commercial vendors
   • BFirewall logs and public vulnerability databases
   • CNormalized threat indicators in STIX format
   • DCorrelated attack patterns from a SIEM
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which technique is commonly used during the analysis and correlation stage to identify relationships between raw data points?

   • AGraph analysis to map connections between indicators
   • BDeduplication of log entries
   • CStandardizing IP address formats
   • DEncrypting data at rest
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which activity is part of the data processing and normalization stage of threat intelligence generation?

   • AWriting a threat report for executive stakeholders
   • BRemoving duplicate records and standardizing timestamp formats
   • CDistributing alerts to security operations teams
   • DCorrelating indicators with known attack patterns
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An analyst is investigating a series of intrusions that appear to be linked. Each intrusion used a different malware family, but the C2 infrastructure shares a common pattern: domains registered with the same registrar, using similar naming conventions, and hosted on the same hosting provider. The analyst wants to determine if these intrusions are part of a single campaign. What is the best analytical approach?

   • AFocus only on the malware families and ignore the infrastructure similarities.
   • BCorrelate the shared infrastructure attributes (registrar, naming pattern, hosting provider) to build a case for a common threat actor.
   • CTreat each intrusion as a separate incident because the malware families are different.
   • DReport the intrusions as unrelated because the domains are not identical.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat intelligence analyst is correlating data from a dark web forum, a sandbox analysis of a new malware sample, and internal network logs. The dark web post mentions a new exploit kit, the sandbox report shows the malware using a specific domain for C2, and the internal logs show a host communicating with that domain. The analyst has limited time and must decide what to report to the SOC. What is the most appropriate action?

   • AReport the domain as a high-confidence C2 indicator and recommend immediate blocking, based on the correlation of all three sources.
   • BReport the dark web post as a potential threat but note that the sandbox and internal logs are inconclusive.
   • CReport the internal log finding only, as it is the most direct evidence of compromise.
   • DWait for additional confirmation from a third-party threat feed before reporting.
   Reveal Solution Discussion Select an answer first