Data Collection And Processing

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Which TWO of the following are recognized categories of threat intelligence sources?

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Which TWO of the following are common actions performed during the 'processing' phase of the threat intelligence lifecycle?

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?

Which of the following is an example of 'structured' threat intelligence data?

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Which of the following is a 'pull-based' method of threat intelligence data collection?

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?