Threat Intelligence and Incident Management CEH Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which phase of the threat intelligence lifecycle involves using intelligence to improve future intelligence efforts?

   • ACollection
   • BDissemination
   • CAnalysis
   • DFeedback
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why is feedback important in the threat intelligence process?

   • AIt ensures that intelligence is kept secret from unauthorized personnel
   • BIt is used to assign blame for security incidents
   • CIt allows the organization to delete all collected data
   • DIt helps refine intelligence requirements and improve future intelligence products
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is a key procedure for handling an incident?

   • AImmediately shutting down all systems without investigation
   • BDeleting all logs to prevent data leakage
   • CIgnoring the incident if it is not severe
   • DDocumenting all actions taken during the incident
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security manager is evaluating whether to build an in-house threat intelligence team or subscribe to a commercial threat intelligence service. The organization has a small security team and a limited budget, but the industry is highly targeted by sophisticated adversaries. Which approach best balances cost and capability?

   • ASubscribe to a commercial threat intelligence service and integrate its feeds into existing security tools
   • BDo nothing because the organization is too small to benefit from threat intelligence
   • CBuild an in-house team with dedicated analysts to collect and analyze intelligence from scratch
   • DRely solely on free OSINT feeds and manual analysis
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security analyst at a mid-sized e-commerce company is tasked with building a threat intelligence program. The company has a limited budget and needs to prioritize threats relevant to its payment card processing environment. The analyst has access to free OSINT feeds, a commercial threat feed that includes indicators of compromise (IOCs) for the banking sector, and internal logs from the company's own network. Which approach best aligns with the company's needs and budget?

   • ACombine OSINT and commercial feeds with internal log analysis, and prioritize IOCs that match the company's payment environment.
   • BRely on internal logs only, since they reflect the actual network and are free.
   • CUse only free OSINT feeds to avoid any cost, and manually correlate them with internal logs.
   • DSubscribe to the commercial banking-sector feed and use it exclusively, because it is tailored to the company's industry.
   Reveal Solution Discussion Select an answer first