Threat Intelligence and Incident Management CEH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of incident classification?

   • ATo assign blame to the responsible party
   • BTo automatically resolve incidents without human intervention
   • CTo determine the financial cost of the incident
   • DTo assign a severity level that helps prioritize response efforts
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A threat intelligence team has just completed a six-month cycle of collecting, processing, and disseminating intelligence on a specific malware family. During a review meeting, the team notices that several indicators were not actionable and that the dissemination format was not well received by the SOC. According to the threat intelligence lifecycle, what should the team do next?

   • ACollect feedback from consumers and adjust the requirements and dissemination methods for the next cycle
   • BOnly update the internal documentation without involving the SOC
   • CImmediately start a new collection phase using the same sources to ensure consistency
   • DDiscontinue threat intelligence activities because the indicators were not actionable
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A threat intelligence team produces a weekly report for the SOC and a monthly executive summary for leadership. The SOC complains that the weekly report contains too much raw data and not enough actionable recommendations. The executives want more strategic context. How should the team adjust its dissemination strategy?

   • AStop producing the monthly executive summary because it is not used by the SOC.
   • BTailor the weekly report for the SOC with actionable recommendations, and the monthly summary for executives with strategic insights.
   • CAsk the SOC to extract the recommendations themselves from the raw data.
   • DSend the same report to both audiences to save time.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A threat intelligence team has produced a detailed report on a new attack campaign. The report includes IOCs, TTPs, and recommended mitigations. The team needs to share this intelligence with both the SOC and the executive leadership. The SOC needs technical details, while executives need a summary of business risk. What is the best way to disseminate the intelligence?

   • ASend the full technical report to everyone, including executives
   • BCreate two versions of the report: a technical report for the SOC and an executive summary for leadership
   • CPublish the report on the company's internal wiki without any targeted distribution
   • DOnly share the report with the SOC and keep it from executives
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which factor is most important when prioritizing incident response?

   • AThe skill level of the incident responder
   • BThe potential impact on business operations and data confidentiality
   • CThe time of day the incident occurred
   • DThe number of systems affected
   Reveal Solution Discussion Select an answer first