312-85 Data Collection And Processing — 25 Questions

Question 1

When using the YARA-L language for detection logic on ingested threat data, which field is primarily used to match against normalized IP addresses?

Accepted Answer

principal.ip. In YARA-L, the 'principal.ip' or 'target.ip' fields are standard placeholders for matching normalized network indicators.

Answer

file.md5

Answer

metadata.event_type

Answer

user.userid

Question 2

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

Accepted Answer

type. In STIX 2.1, the 'type' field is mandatory for all SDOs and SCOs, and for file objects, it must be set to 'file'.

Answer

name

Answer

spec_version

Answer

hashes

Question 3

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

Accepted Answer

Check if the source IP is whitelisted on the threat intelligence provider side.. 403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.

Answer

Update the SSL certificates on the collector.

Answer

Increase the connector memory allocation.

Answer

Restart the OpenCTI RabbitMQ service.

Question 4

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

Accepted Answer

Source IP blacklisting.. Automated scraping without respect for rate limits often leads to IP blacklisting by the source provider.

Answer

Lack of data encryption.

Answer

STIX version mismatch.

Answer

Data normalization failure.

Question 5

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

Accepted Answer

In the TAXII client configuration settings.. Filtering by confidence levels is typically performed within the TAXII client configuration or via an API parameter defined by the threat feed provider.

Answer

At the firewall level.

Answer

By disabling the feed authentication.

Answer

By modifying the STIX schema.

Question 6

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 7

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

Accepted Answer

TAXII. TAXII (Trusted Automated eXchange of Intelligence Information) is the application-layer protocol designed specifically to transport STIX information.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 8

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Accepted Answer

Decode the content and extract nested indicators.. Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.

Answer

Replace the payload with a static hash.

Answer

Discard the indicator as encrypted.

Answer

Store the raw base64 string as a comment.

Question 9

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

Accepted Answer

The client requested an unsupported content-type in the Accept header.. A 406 error typically indicates that the media type requested in the Accept header is not supported by the TAXII server, often due to a mismatch between STIX versioning expectations.

Answer

The connection is blocked by a firewall ACL.

Answer

The API key provided for authentication is expired.

Answer

The TAXII discovery service endpoint is misconfigured.

Question 10

Which of the following is a 'pull-based' method of threat intelligence data collection?

Accepted Answer

TAXII Poll.. A TAXII client requesting data from a TAXII server (Poll) is a pull-based method.

Answer

Webhook notifications.

Answer

Email distribution lists.

Answer

RSS feeds.

Question 11

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Accepted Answer

To link two objects together.. The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.

Answer

To define the schema version.

Answer

To encrypt the data transport.

Answer

To set the confidence score.

Question 12

Which of the following is an example of 'structured' threat intelligence data?

Accepted Answer

A STIX 2.1 JSON file.. STIX/TAXII provides a machine-readable, structured format for intelligence.

Answer

An email body.

Answer

A handwritten note.

Answer

A PDF report from a vendor.

Question 13

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Accepted Answer

Application of NLP techniques to extract entities.. NLP (Natural Language Processing) is the standard technique for converting unstructured text into structured, normalized intelligence.

Answer

Hashing the entire document.

Answer

Direct ingestion into the SIEM.

Answer

Manual entry into a spreadsheet.

Question 14

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

Accepted Answer

Assume TLP:RED.. When TLP is missing, the default safest practice is to assume TLP:RED or the most restrictive category to prevent unauthorized disclosure.

Answer

Publish to public forums.

Answer

Discard the data entirely.

Answer

Assume TLP:CLEAR.

Question 15

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

Accepted Answer

JSON Schema Validator.. JSON Schema validation is the standard method for verifying the structure and types of JSON data.

Answer

Netstat.

Answer

Nmap.

Answer

Wireshark.

Question 16

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

Accepted Answer

The object ID (UUID).. The 'pattern' or 'hash' (if applicable) or a unique 'external_id' are common identifiers, but 'id' in STIX is the unique object identifier.

Answer

The file size.

Answer

The source name.

Answer

The timestamp of ingestion.

Question 17

You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?

Accepted Answer

Develop an ETL/transformation script.. You must implement a transformation layer (often using a library or script) to map the JSON STIX structure to the required CSV columns.

Answer

Ignore the format mismatch.

Answer

Enable automatic STIX parsing in the SIEM engine.

Answer

Increase the SIEM storage capacity.

Question 18

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Accepted Answer

Standardizing time formats (e.g., UTC).. Normalization involves mapping diverse data to a common schema and standardizing fields like time and identity.

Answer

Deleting all historical data.

Answer

Increasing the firewall throughput.

Answer

Disabling API authentication.

Question 19

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Accepted Answer

valid_from. The Indicator object in STIX 2.1 contains specific properties including the pattern, validity period, and confidence score.

Answer

firewall_acl_rule

Answer

user_password_hash

Question 20

Which TWO of the following are recognized categories of threat intelligence sources?

Accepted Answer

Open Source Intelligence (OSINT).. Threat intelligence sources are generally categorized into open-source (OSINT) and closed/proprietary sources.

Answer

Local User Logs.

Answer

Internal Hardware Inventory.

Answer

Network Topology Maps.