24 questions · Data Collection And Processing topic · All types, answers revealed
Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?
Frequency is a key attribute of sightings.
Why this answer
Observed data objects record the 'first_observed', 'last_observed', and 'number_observed' properties to provide context to the sighting.
You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?
403 errors are frequently triggered by IP-based access control lists.
Why this answer
403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.
You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?
Most TAXII clients allow for query parameters to filter by confidence.
Why this answer
Filtering by confidence levels is typically performed within the TAXII client configuration or via an API parameter defined by the threat feed provider.
While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?
Decoding is essential for normalization and indicator extraction.
Why this answer
Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.
Which TWO of the following are recognized categories of threat intelligence sources?
OSINT is a primary intelligence category.
Why this answer
Threat intelligence sources are generally categorized into open-source (OSINT) and closed/proprietary sources.
You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?
ip-src is the correct attribute type for source IPs.
Why this answer
IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.
Which THREE of the following are considered challenges when ingesting threat intelligence feeds?
Disparate formats create significant processing overhead.
Why this answer
Data volume, lack of standardization, and quality/noise are the most significant hurdles in intelligence ingestion.
In the context of STIX 2.1, what is the purpose of the 'relationship' object?
Relationship objects allow for semantic linking of intelligence data.
Why this answer
The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.
Which TWO of the following are valid ways to improve the reliability of threat intelligence data?
Verification against multiple sources improves accuracy.
Why this answer
Data reliability is improved through source verification and cross-referencing indicators across multiple platforms.
Which TWO of the following are common methods used to normalize threat data from disparate sources?
Normalization requires time synchronization.
Why this answer
Normalization involves mapping diverse data to a common schema and standardizing fields like time and identity.
Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?
TAXII is the industry standard for transporting STIX.
Why this answer
TAXII (Trusted Automated eXchange of Intelligence Information) is the application-layer protocol designed specifically to transport STIX information.
You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?
NLP automates the extraction of IOCs from unstructured text.
Why this answer
NLP (Natural Language Processing) is the standard technique for converting unstructured text into structured, normalized intelligence.
Which TWO of the following are common actions performed during the 'processing' phase of the threat intelligence lifecycle?
Normalization is essential to make data usable.
Why this answer
Data processing focuses on transforming raw data into useful information, typically through parsing and normalization.
You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?
The 406 error specifically relates to content negotiation failure.
Why this answer
A 406 error typically indicates that the media type requested in the Accept header is not supported by the TAXII server, often due to a mismatch between STIX versioning expectations.
You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?
Transforming data formats is the core of the ETL process.
Why this answer
You must implement a transformation layer (often using a library or script) to map the JSON STIX structure to the required CSV columns.
Which of the following is an example of 'structured' threat intelligence data?
STIX is a structured standard.
Why this answer
STIX/TAXII provides a machine-readable, structured format for intelligence.
When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?
Service providers block IPs that exceed defined rate thresholds.
Why this answer
Automated scraping without respect for rate limits often leads to IP blacklisting by the source provider.
Which THREE of the following are key components of a STIX 2.1 'Indicator' object?
Validity dates are standard properties.
Why this answer
The Indicator object in STIX 2.1 contains specific properties including the pattern, validity period, and confidence score.
Which of the following is a 'pull-based' method of threat intelligence data collection?
A poll is an explicit request for data.
Why this answer
A TAXII client requesting data from a TAXII server (Poll) is a pull-based method.
You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?
Standard practice is to default to the most restrictive level.
Why this answer
When TLP is missing, the default safest practice is to assume TLP:RED or the most restrictive category to prevent unauthorized disclosure.
When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?
The STIX ID is designed to be the globally unique identifier for objects.
Why this answer
The 'pattern' or 'hash' (if applicable) or a unique 'external_id' are common identifiers, but 'id' in STIX is the unique object identifier.
When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?
The type field is required for all STIX objects.
Why this answer
In STIX 2.1, the 'type' field is mandatory for all SDOs and SCOs, and for file objects, it must be set to 'file'.
Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?
Connectivity must be established first.
Why this answer
Troubleshooting should focus on network reachability, TLS/SSL configuration, and authentication credentials.
A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?
This tool checks against defined rules.
Why this answer
JSON Schema validation is the standard method for verifying the structure and types of JSON data.
Ready to test yourself?
Try a timed practice session using only Data Collection And Processing questions.