Collecting and Storing Data Sets GCTI Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A threat intelligence team has a dataset of domain names associated with phishing campaigns. The team wants to enrich the data with WHOIS information and passive DNS history. However, the enrichment service has a rate limit, and the dataset is large. The team must complete the enrichment within a limited time. What is the best approach?

   • AUse multiple enrichment services simultaneously to bypass the rate limit.
   • BSkip enrichment and use the raw domain list as is.
   • CEnrich only the domains that are most relevant to current investigations and defer the rest.
   • DEnrich all domains in a single batch, ignoring the rate limit.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A threat intelligence team receives IOCs in multiple formats, including STIX, OpenIOC, and proprietary XML. The team needs to integrate these into a single repository for analysis. However, some fields are missing in certain formats, and the team must ensure that the integrated data is accurate. What is the best approach?

   • AStore each format separately and use a search tool to query across them.
   • BUse a machine learning model to automatically infer missing fields without human review.
   • CMap all fields to a common schema, fill missing fields with default values, and flag records with incomplete data for review.
   • DConvert all data to STIX and ignore any fields that do not map directly.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A threat intelligence team stores sensitive data in a cloud object storage service. The team needs to ensure that only specific analysts can access the data, and that access is logged for audit. The team also needs to protect the data from being accidentally deleted. Which combination of controls best meets these requirements?

   • AUse a shared access key for all analysts and enable versioning.
   • BMake the bucket public but encrypt the data with a strong key.
   • CUse a single IAM role for all analysts and rely on the cloud provider's default logging.
   • DUse identity-based access control with per-user permissions, enable audit logging, and enable versioning or object lock.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A threat intelligence team is decommissioning an old storage system that contains years of intelligence data. The team must ensure that data is not lost if it is still needed, and that data that is no longer needed is securely destroyed. The team also needs to maintain an audit trail of what was destroyed. What is the best approach?

   • AKeep the old system running indefinitely to avoid making decisions about data disposition.
   • BDestroy all data immediately to reduce risk, assuming the new system has enough data.
   • CMigrate all data to the new system without review to avoid data loss.
   • DReview the data against retention policies, migrate data that is still required, securely destroy data that is not, and document the destruction.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   An intelligence team is planning to collect data on a new malware family. They need to decide which sources will provide the most relevant and timely information. Which activity is being performed?

   • AAccess control implementation
   • BData retention
   • CSource selection
   • DData normalization
   Reveal Solution Discussion Select an answer first