What is the purpose of disseminating threat intelligence to relevant stakeholders?

To comply with legal requirements for public disclosure

To ensure that intelligence is used to improve security posture and decision-making

To keep intelligence confidential and prevent leaks

To store intelligence in a central repository

What is a characteristic of commercial threat intelligence feeds?

They are generated from internal organizational data only

They require a subscription or payment and often provide curated, high-quality intelligence

They are always free and publicly available

They are only available from government agencies

What is the purpose of a lessons-learned meeting after an incident?

To celebrate the successful resolution of the incident

To delete all records of the incident

To identify what went well and what can be improved in incident response

To assign blame to individuals who made mistakes

An organization's SOC detects a malware infection on a few workstations. The malware appears to be spreading laterally to other systems. The incident response team has been activated. According to the incident response process, which action should be taken FIRST?

Conduct a lessons-learned meeting to discuss the incident.

Eradicate the malware by wiping and reimaging all affected systems.

Contain the spread by isolating the affected workstations from the network.

Recover by restoring from backups and verifying system integrity.

A security manager wants to justify the creation of a threat intelligence program to senior leadership. Which statement best describes the primary value of threat intelligence in a proactive security posture?

It replaces the need for incident response planning.

It guarantees that no security incident will ever succeed.

It provides a historical record of past attacks for compliance audits.

It enables the organization to anticipate and prepare for potential threats before they occur.

EC-CouncilCertified Ethical Hacker

Domain 1Objective 8

Threat Intelligence and Incident Management CEH Practice Questions (Page 3)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

12concepts

12 Concepts in This Objective

Threat Intelligence Fundamentals
Threat Intelligence Lifecycle
Threat Intelligence Sources and Feeds
Threat Intelligence Data Collection
Threat Intelligence Processing and Analysis
Threat Intelligence Dissemination and Integration
Threat Intelligence Feedback and Improvement
Incident Management Overview
Incident Response Process
Incident Classification and Triage
Incident Handling and Escalation
Post-Incident Activities

Questions 11–15

11foundation · easy
What is the purpose of disseminating threat intelligence to relevant stakeholders?
Select an answer first
12foundation · easy
What is a characteristic of commercial threat intelligence feeds?
Select an answer first
13foundation · easy
What is the purpose of a lessons-learned meeting after an incident?
Select an answer first
14application · medium
An organization's SOC detects a malware infection on a few workstations. The malware appears to be spreading laterally to other systems. The incident response team has been activated. According to the incident response process, which action should be taken FIRST?
Select an answer first
15application · medium
A security manager wants to justify the creation of a threat intelligence program to senior leadership. Which statement best describes the primary value of threat intelligence in a proactive security posture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.