Collecting and Storing Data Sets GCTI Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An analyst receives threat data from multiple sources that use different formats for IP addresses, timestamps, and malware names. What process converts this data into a common, consistent format?

   • AData access control
   • BData retention
   • CData encryption
   • DData normalization
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst notices that a threat intelligence feed frequently contains indicators with malformed hashes and duplicate entries for the same domain. The team uses these indicators to block malicious traffic. What should the team do to improve the reliability of the blocking decisions?

   • AImplement a validation and deduplication process before the indicators are loaded into the blocking tool.
   • BStore all indicators in a raw archive for future forensic analysis.
   • CIncrease the frequency of feed ingestion to ensure the latest indicators are always available.
   • DSwitch to a different commercial feed that claims higher accuracy.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A threat intelligence team uses a feed that provides indicators with a confidence score. The team has noticed that some indicators with high confidence are later found to be false positives. The team wants to improve the quality of the dataset. What is the most effective approach?

   • AManually review every indicator before adding it to the dataset.
   • BStop using the feed and rely on internal detection logs only.
   • CImplement a feedback loop where analysts can mark indicators as false positives, and use this feedback to adjust the confidence scoring model.
   • DIncrease the confidence threshold to only accept indicators with a score above 90%.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence team is tasked with monitoring a specific threat actor. The team has access to various sources, including dark web forums, social media, and internal telemetry. The team needs to ensure that the collected data is relevant and can be enriched with context. What is the first step in the collection process?

   • AStart with internal telemetry only, as it is the most reliable source.
   • BCollect data from all sources without filtering to ensure nothing is missed.
   • CPurchase a commercial threat feed to ensure comprehensive coverage.
   • DDefine the intelligence requirements and select sources that are likely to provide relevant information about the threat actor.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A CTI team receives threat intelligence from multiple sources that use different formats for IP addresses, such as '192.168.1.1', '192.168.001.001', and '0xC0A80101'. The team wants to store all indicators in a single repository and correlate them. What should the team do?

   • ANormalize all IP addresses to a canonical form, such as dotted-decimal without leading zeros, during ingestion.
   • BCreate separate tables for each format and merge them during analysis.
   • CStore the indicators exactly as received and rely on the analyst to recognize they are the same.
   • DConvert all IP addresses to hexadecimal format for consistency.
   Reveal Solution Discussion Select an answer first