20+ practice questions focused on Data Collection And Processing — one of the most tested topics on the Certified Threat Intelligence Analyst (312-85) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Data Collection And Processing PracticeWhich THREE of the following are key components of a STIX 2.1 'Indicator' object?
Explanation: In STIX 2.1, the Indicator SDO's required properties are 'pattern' (option E), which holds the detection expression such as a STIX Patterning string, and 'valid_from' (option A), a timestamp marking when the indicator is considered valid; both are mandatory fields of the object. 'confidence' (option B) is also a defined property of the Indicator object, expressed as an integer 0-100 (or the Low/Medium/High enum in some contexts) to convey the producer's certainty, making it a key component. The other options do not belong: 'firewall_acl_rule' (option C) is not a STIX 2.1 Indicator property — firewall rules would be represented via other SDOs/SCOs or extensions, and 'user_password_hash' (option D) is not a STIX property at all and would relate to credential objects, not an Indicator.
When using the YARA-L language for detection logic on ingested threat data, which field is primarily used to match against normalized IP addresses?
Explanation: In YARA-L, the 'principal.ip' or 'target.ip' fields are standard placeholders for matching normalized network indicators.
A threat intelligence analyst is configuring a TAXII 2.1 client to collect STIX 2.1 data from a new provider. The provider's collection requires authentication and supports filtering by object type. The analyst wants to ensure that only indicators and observed-data objects are retrieved, and that the client can resume collection after a network interruption without missing data. Which TWO configuration steps are necessary to meet these requirements? (Choose two.)
Explanation: To filter by object type in TAXII 2.1, the client must use the match[type] query parameter with the desired STIX types. To resume collection after an interruption, the client should track the timestamp of the last retrieved object and use added_after on subsequent requests. These two parameters directly address the requirements of retrieving only indicators and observed-data and ensuring no data is missed after a network failure.
A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a MISP instance. The analyst notices that the same IP address appears with different timestamps and contextual tags from each feed. Which MISP feature should be used to consolidate these duplicate attributes while preserving the earliest sighting date and merging the tags?
Explanation: MISP's 'Merge attributes' functionality is designed to consolidate duplicate attributes, such as the same IP address ingested from different feeds. It preserves the earliest sighting date and merges tags, ensuring that contextual information is retained. This reduces data redundancy and improves the quality of threat intelligence. The other options describe features that either do not exist or do not perform deduplication and merging.
A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a local MISP instance. The analyst notices that many indicators are duplicates but have different timestamps and slightly different metadata. To reduce noise and improve correlation, the analyst wants to merge these duplicates while preserving the most recent information. Which MISP feature should the analyst use?
Explanation: MISP provides an attribute deduplication feature that merges attributes sharing the same value and type, keeping the most recent information. This is the appropriate tool for reducing duplicates from multiple feeds while preserving updated metadata. Other options either do not target deduplication or are manual and inefficient.
+15 more Data Collection And Processing questions available
Practice all Data Collection And Processing questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Data Collection And Processing. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Data Collection And Processing questions on the 312-85 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Data Collection And Processing is tested as part of the Certified Threat Intelligence Analyst (312-85) blueprint. Practicing with targeted Data Collection And Processing questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 312-85 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Data Collection And Processing is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Data Collection And Processing practice session with instant scoring and detailed explanations.
Start Data Collection And Processing Practice →