Data Collection And Processing

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

Which of the following is a 'pull-based' method of threat intelligence data collection?

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Which of the following is an example of 'structured' threat intelligence data?

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Which TWO of the following are recognized categories of threat intelligence sources?

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Which TWO of the following are common actions performed during the 'processing' phase of the threat intelligence lifecycle?

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?