Threat Intelligence and Incident Management CEH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the first phase of the threat intelligence lifecycle?

   • APlanning and Direction
   • BCollection
   • CDissemination
   • DProcessing
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   After a major security incident has been resolved, the incident response team is preparing to conduct a lessons-learned meeting. What is the primary goal of this meeting?

   • ADelete all evidence related to the incident to protect the company
   • BImmediately implement new security controls without discussion
   • CIdentify what went well and what could be improved in the incident response process
   • DAssign blame to individuals who made mistakes during the incident
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of an open-source threat intelligence feed?

   • AA threat report from a commercial vendor that requires a subscription
   • BAn internal feed of firewall logs from your own organization
   • CA public blocklist of known malicious IP addresses maintained by a community
   • DA vendor-specific malware analysis report available only to paying customers
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A threat intelligence analyst is processing a large volume of indicators from multiple sources. The analyst notices that some indicators from a commercial feed are also present in internal logs, but the internal logs show that those IPs have been communicating with a server that is not part of the organization's normal business operations. The analyst must decide how to handle these indicators. What is the most appropriate action?

   • AIgnore the internal logs because the commercial feed is more authoritative.
   • BReport the indicators to law enforcement without further analysis.
   • CImmediately block all IPs from the commercial feed to prevent potential threats.
   • DCorrelate the indicators with internal context to determine if the communications are malicious, then prioritize response.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   After a major incident, the incident response team conducts a lessons-learned meeting. The team identifies that the detection rules were not updated with known indicators, which delayed the response. The team also notes that the communication between the SOC and the incident response team was unclear. What is the most important outcome of this lessons-learned meeting?

   • ADocument the findings and create an action plan to update detection rules and improve communication procedures.
   • BAssign blame to the SOC for not updating the detection rules.
   • CImmediately fire the SOC analyst responsible for the delay.
   • DArchive the meeting notes and take no further action.
   Reveal Solution Discussion Select an answer first