Collecting and Storing Data Sets GCTI Practice Questions (Page 11)

Questions 51–54

1. 51expert · hard

   A multinational organization must store threat intelligence data that is subject to data residency laws in multiple countries. The data is accessed by analysts globally. The team must design a storage architecture that complies with legal requirements while ensuring accessibility and security. What is the best approach?

   • AEncrypt all data and store it in a single location, arguing that encryption satisfies compliance.
   • BStore data in regional data centers that comply with local residency laws, and implement access controls that restrict access based on analyst location and clearance.
   • CUse a public cloud provider and store data in any region to simplify management.
   • DStore all data in a single centralized location in the organization's headquarters country.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   An analyst notices that some indicators in the database contain malformed IP addresses and missing fields. What process should be used to correct these issues?

   • AData retention
   • BData encryption
   • CData cleaning
   • DData access control
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A CTI team ingests indicators from multiple sources. One source provides a high volume of indicators but has a known false-positive rate of 20%. Another source provides fewer indicators but is highly accurate. The team uses these indicators to block traffic, and false positives cause significant operational disruption. What is the best way to manage data quality?

   • ABlock all indicators from both sources immediately to maximize protection.
   • BUse the high-volume source but implement a scoring system that weights indicators based on source reliability and cross-source confirmation.
   • CDiscard all indicators from the high-volume source and use only the accurate source.
   • DStore all indicators in a raw archive and never use them for blocking.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A CTI team has limited collection resources and must decide between two sources: Source A provides a high volume of indicators with low false positives but lacks context; Source B provides fewer indicators but includes rich context about campaigns and threat actors. The team's priority is to support strategic reporting to executives, not just blocking. Which collection strategy best meets the requirement?

   • ACollect from neither source and rely on internal telemetry only.
   • BCollect from both sources, using Source A for operational blocking and Source B for strategic analysis.
   • CCollect from Source B only because it provides context.
   • DCollect from Source A only because it has higher data quality.
   Reveal Solution Discussion Select an answer first