Data Collection And Processing

A threat intelligence team ingests a daily feed delivered as a single JSON file. Each record includes an indicator value, a confidence score, and a free-text description. During processing, the team must enrich each indicator with internal asset context and geographic location before loading it into a MISP event. Which action should be performed first to ensure the enrichment stage has clean, normalized records?

An analyst is collecting threat intelligence from a new OSINT source that provides indicators in a structured format. The analyst needs to ensure that the data is ingested into the threat intelligence platform (TIP) without manual reformatting. Which data format is most commonly supported by TIPs for automated ingestion?

A threat intelligence analyst is collecting data from a dark web forum to identify emerging threats. The analyst uses a web scraping tool that automatically extracts posts and user metadata. After several hours, the tool is blocked and the analyst's IP is banned. Which of the following is the most likely cause of the block, and what should the analyst have implemented to prevent it?

A threat intelligence analyst is processing a set of indicators and needs to ensure that the data is properly enriched and contextualized before dissemination. Which TWO of the following actions are appropriate during the processing phase of the threat intelligence lifecycle? (Choose two.)

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

An analyst is processing a set of indicators received in a CSV file. The file contains a column labeled 'ip_address' with values such as '192.168.1.1' and '10.0.0.1'. The analyst needs to import these into a threat intelligence platform that expects indicators to be classified by type. Which of the following actions should the analyst take to ensure proper classification?

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

A junior analyst receives a CSV export from a partner that contains a column named 'indicator' with values such as 'hxxp://malicious[.]example[.]com/path'. The analyst needs to prepare these values for ingestion into a threat intelligence platform that expects defanged indicators to be normalized. Which action should the analyst take?

Which TWO of the following are recognized categories of threat intelligence sources?

An analyst is using YARA to create a rule that detects a specific malware family by matching a unique string in memory. The analyst wants the rule to match when the string appears at least three times in the scanned data. Which YARA condition should the analyst use?

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

An analyst receives a collection of threat indicators from a partner in a STIX 2.1 bundle. Several indicators use the 'pattern' property with the 'LIKE' comparison operator, such as [file:name LIKE '%.exe']. The analyst needs to filter these indicators to only those that match files with a specific name exactly 'malware.exe'. Which STIX pattern should the analyst use to achieve this?

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Which TWO of the following are common actions performed during the 'processing' phase of the threat intelligence lifecycle?

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?

Which of the following is an example of 'structured' threat intelligence data?

A threat intelligence analyst is collecting data from a new OSINT source that provides indicators in a proprietary XML format. The analyst needs to extract the indicators and convert them into a structured format for ingestion into the organization's TIP. Which of the following is the most appropriate first step in processing this data?

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

A threat intelligence analyst is processing a large dataset of indicators collected from multiple OSINT sources. The analyst notices that many indicators are malformed, such as IP addresses with invalid octets or domain names containing illegal characters. The analyst needs to ensure that only valid indicators are stored in the intelligence platform. Which action should the analyst take during the processing phase?

A threat intelligence analyst is collecting data from a TAXII 2.1 server. The analyst needs to retrieve only the indicators that have been added or modified since the last collection. Which TAXII 2.1 feature should be used to achieve this?

Which of the following is a 'pull-based' method of threat intelligence data collection?

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

An analyst is extracting indicators from a large collection of PDF reports. The reports contain IP addresses embedded in narrative text, tables, and footnotes with inconsistent formatting. The analyst needs a repeatable method to extract IPv4 addresses while minimizing false positives from version numbers such as 10.2.3.4. Which approach best supports this requirement?

A threat intelligence analyst is processing a new feed that contains indicators of compromise (IOCs) in STIX 2.1 format. Before ingesting the data into the internal platform, the analyst must validate that the STIX objects conform to the specification. Which two of the following are required properties for a STIX 2.1 'Indicator' object? (Choose two.)

An analyst at a financial services firm receives a threat feed where each entry contains a 'confidence' field set to 85. The feed vendor's documentation states that confidence values are expressed as a percentage. The analyst needs to normalize this data before loading it into the internal threat intelligence platform, which accepts confidence on a 0-100 integer scale. Which action should the analyst take during processing?

A threat intelligence analyst at a financial institution is ingesting a high-volume STIX 2.1 feed from a commercial provider. The feed contains many duplicate and near-duplicate indicators. The analyst needs to programmatically deduplicate the data before storing it in a MISP instance. Which approach is most appropriate for identifying and removing duplicate indicators?

Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?

A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a TIP. The analyst notices that many indicators are duplicated across feeds but have slightly different metadata, such as confidence scores and timestamps. To ensure efficient processing and accurate analysis, which of the following should the analyst implement to handle these duplicates?

A threat intelligence analyst is collecting data from a paste site that frequently removes posts within hours. The analyst wants to preserve the content for later analysis and ensure that the original source can be verified even if the post is deleted. Which collection practice best meets these requirements?

A threat intelligence analyst is preparing to ingest a new threat feed that provides indicators in STIX 2.1 format. Before ingestion, the analyst must ensure the data is properly structured and can be processed by the TIP. Which of the following are valid steps to prepare the STIX 2.1 data for ingestion? (Choose two.)

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

A threat intelligence analyst is processing a large set of indicators and needs to enrich them with additional context. The analyst wants to use the MITRE ATT&CK framework to map indicators to adversary tactics, techniques, and procedures (TTPs). Which data processing step should be performed first to ensure accurate mapping?