A small business has no formal incident management process. After a ransomware attack, the owner realizes that employees did not know who to contact or what steps to take. Which action would best address this gap?

Wait for another incident to see how employees react.

Train employees on how to use email more securely.

Develop an incident response plan that defines roles, procedures, and communication channels.

Purchase more antivirus software to prevent future attacks.

What is a common post-incident activity?

Deleting all incident-related data to free up storage

Ignoring the incident to avoid drawing attention

Immediately reinstalling all systems without review

Updating the incident response plan based on lessons learned

A company's SOC receives three incident reports simultaneously: (1) a phishing email that was not clicked, (2) a ransomware infection on a file server that is spreading, and (3) a low-severity policy violation by an employee. According to incident classification and triage, which incident should be handled first?

The phishing email that was not clicked

All three incidents should be handled simultaneously

The ransomware infection on the file server

The low-severity policy violation

How does threat intelligence differ from raw threat data?

Threat intelligence is always quantitative, while raw data is qualitative

Threat intelligence is unprocessed information, while raw data is analyzed and contextualized

Threat intelligence is raw data that has been processed, analyzed, and contextualized for decision-making

Threat intelligence is only available from commercial vendors, while raw data comes from open sources

A company is developing an incident management program. The CISO wants to ensure that incidents are detected, contained, and resolved efficiently while minimizing business impact. Which component is most critical to establish first?

A documented incident response plan with defined roles, procedures, and communication channels

A budget for purchasing new security software

A new SIEM tool with advanced analytics

A dedicated incident response team with no formal procedures

EC-CouncilCertified Ethical Hacker

Domain 1Objective 8

Threat Intelligence and Incident Management CEH Practice Questions (Page 12)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

12concepts

12 Concepts in This Objective

Threat Intelligence Fundamentals
Threat Intelligence Lifecycle
Threat Intelligence Sources and Feeds
Threat Intelligence Data Collection
Threat Intelligence Processing and Analysis
Threat Intelligence Dissemination and Integration
Threat Intelligence Feedback and Improvement
Incident Management Overview
Incident Response Process
Incident Classification and Triage
Incident Handling and Escalation
Post-Incident Activities

Questions 56–60

56application · medium
A small business has no formal incident management process. After a ransomware attack, the owner realizes that employees did not know who to contact or what steps to take. Which action would best address this gap?
Select an answer first
57foundation · easy
What is a common post-incident activity?
Select an answer first
58application · medium
A company's SOC receives three incident reports simultaneously: (1) a phishing email that was not clicked, (2) a ransomware infection on a file server that is spreading, and (3) a low-severity policy violation by an employee. According to incident classification and triage, which incident should be handled first?
Select an answer first
59foundation · easy
How does threat intelligence differ from raw threat data?
Select an answer first
60application · medium
A company is developing an incident management program. The CISO wants to ensure that incidents are detected, contained, and resolved efficiently while minimizing business impact. Which component is most critical to establish first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.