Collecting and Storing Data Sets GCTI Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary benefit of integrating data from multiple sources in threat intelligence?

   • AIt eliminates the need for data retention policies
   • BIt automatically encrypts all data
   • CIt reduces the need for data normalization
   • DIt provides a more complete and comprehensive view of threats
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A threat intelligence team is designing a storage solution for a new platform. The data will include sensitive information and must be accessible to analysts in different time zones. The team wants to ensure that the data is always available and protected from unauthorized access. Which storage design best meets these needs?

   • AStore data on USB drives and distribute them to analysts.
   • BUse a cloud storage service with redundancy across multiple regions, encryption at rest, and role-based access control.
   • CStore data in a single on-premises server with a strong password.
   • DUse a network-attached storage (NAS) device with no encryption but with a firewall.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial institution collects threat intelligence data that includes customer-related information. Regulatory requirements mandate that certain data be retained for at least 7 years, while other data must be deleted after 90 days. The institution also needs to ensure that data is not accessible to unauthorized personnel. What is the best approach to manage these requirements?

   • ARetain all data for 7 years to simplify compliance and avoid accidental deletion.
   • BDelete all data after 90 days to minimize storage costs and security exposure.
   • CImplement a data retention policy that categorizes data types, applies different retention periods, and enforces deletion schedules with access controls.
   • DStore all data in an encrypted archive and never delete anything to preserve evidence.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial institution's threat intelligence team collects raw network flow data that may contain customer IP addresses. Regulatory requirements mandate that personal data not be kept longer than 90 days unless a specific threat investigation is active. The team also needs to retain finished intelligence reports for five years for audit purposes. What should the team implement?

   • AA tiered retention policy: raw flow data is purged after 90 days, while finished reports are retained for five years with access controls.
   • BRetain all data for five years but anonymize IP addresses after 90 days.
   • CA single retention policy that deletes all data after 90 days to ensure compliance.
   • DStore all data in a cold archive that is inaccessible to analysts until the retention period expires.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A threat intelligence team has a dataset of malware hashes that is no longer relevant because the malware has been eradicated. The team wants to remove the data to reduce storage costs and security risks. What should the team do?

   • AArchive the data to a cold storage tier and keep it indefinitely.
   • BDelete the data immediately without any review.
   • CFollow a formal disposal process that verifies the data is no longer needed, documents the deletion, and securely erases it.
   • DEncrypt the data and keep it in the same storage tier.
   Reveal Solution Discussion Select an answer first