After a ransomware incident, the incident response team has completed eradication and recovery. The CISO wants to ensure that the organization is better prepared for future incidents. The team has limited time and budget. Which post-incident activity should the team prioritize?

Conduct a lessons-learned review and update the incident response plan based on findings

Immediately implement all possible security controls without prioritization

Delete all incident-related documentation to avoid legal exposure

Purchase additional endpoint detection and response (EDR) licenses

A company wants to shift from a reactive security posture to a proactive one. The CISO asks the security team to implement a program that uses threat intelligence to anticipate and mitigate attacks before they occur. Which initiative best aligns with this goal?

Purchasing additional firewall licenses to improve network performance

Hiring more help desk staff to handle user complaints

Increasing the frequency of vulnerability scans on critical systems

Establishing a threat intelligence capability that collects, analyzes, and disseminates actionable intelligence to security teams

After a ransomware incident, the incident response team has successfully contained the threat and restored systems from backups. The CISO requests a report detailing what happened and how to prevent recurrence. Which post-incident activity is most directly aligned with this request?

Updating the incident response plan only if the CISO explicitly asks for it.

Conducting a lessons-learned meeting to identify gaps in the response process and recommend improvements.

Deleting all logs related to the incident to protect sensitive information.

Immediately returning to normal operations without further review.

A threat intelligence analyst needs to collect data about a new ransomware group that is targeting the organization's industry. The analyst wants to gather both technical indicators and contextual information about the group's tactics, techniques, and procedures (TTPs). Which combination of sources would provide the most comprehensive data?

Only social media posts from the threat group

OSINT feeds for IOCs and dark web forums for TTP discussions

Only commercial threat intelligence reports

What is a common method for collecting threat data from external sources?

Using open-source intelligence (OSINT) gathering from public websites and forums

Monitoring internal server logs

EC-CouncilCertified Ethical Hacker

Domain 1Objective 8

Threat Intelligence and Incident Management CEH Practice Questions (Page 11)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

12concepts

12 Concepts in This Objective

Threat Intelligence Fundamentals
Threat Intelligence Lifecycle
Threat Intelligence Sources and Feeds
Threat Intelligence Data Collection
Threat Intelligence Processing and Analysis
Threat Intelligence Dissemination and Integration
Threat Intelligence Feedback and Improvement
Incident Management Overview
Incident Response Process
Incident Classification and Triage
Incident Handling and Escalation
Post-Incident Activities

Questions 51–55

51expert · hard
After a ransomware incident, the incident response team has completed eradication and recovery. The CISO wants to ensure that the organization is better prepared for future incidents. The team has limited time and budget. Which post-incident activity should the team prioritize?
Select an answer first
52application · medium
A company wants to shift from a reactive security posture to a proactive one. The CISO asks the security team to implement a program that uses threat intelligence to anticipate and mitigate attacks before they occur. Which initiative best aligns with this goal?
Select an answer first
53application · medium
After a ransomware incident, the incident response team has successfully contained the threat and restored systems from backups. The CISO requests a report detailing what happened and how to prevent recurrence. Which post-incident activity is most directly aligned with this request?
Select an answer first
54application · medium
A threat intelligence analyst needs to collect data about a new ransomware group that is targeting the organization's industry. The analyst wants to gather both technical indicators and contextual information about the group's tactics, techniques, and procedures (TTPs). Which combination of sources would provide the most comprehensive data?
Select an answer first
55foundation · easy
What is a common method for collecting threat data from external sources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.