A threat intelligence program is being established. The team has defined its intelligence requirements, but the collection phase is producing a large amount of irrelevant data. The team is spending too much time processing data that does not meet the requirements. What is the most effective way to address this issue?

Collect more data from additional sources to ensure nothing is missed.

Outsource the processing to a third-party vendor.

Stop collecting data until the team can process all existing data.

Refine the intelligence requirements and adjust collection sources and filters to focus on relevant data.

An organization has experienced a data breach involving customer credit card data. The incident response team is activated. The CISO wants to notify affected customers as soon as possible, but the legal team advises waiting until the investigation is complete to determine the full scope. The incident response team has identified the likely entry point and is working on containment. What is the most appropriate course of action?

Wait until the investigation is fully complete before notifying anyone.

Focus only on containment and ignore notification until the incident is fully resolved.

Continue containment and eradication, and coordinate with legal to determine the appropriate timing for notification based on legal obligations.

Notify customers immediately, as transparency is critical.

What is the primary goal of the containment phase in incident response?

To limit the spread and impact of the incident

To collect evidence for legal proceedings

To restore systems to normal operation

To identify the root cause of the incident

What is the purpose of incident escalation?

To transfer the incident to a different organization

To automatically close incidents that are not severe

To delay response until more information is available

To involve higher-level management or specialized teams when an incident exceeds current capabilities

EC-CouncilCertified Ethical Hacker

Domain 1Objective 8

Threat Intelligence and Incident Management CEH Practice Questions (Page 5)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

12concepts

12 Concepts in This Objective

Threat Intelligence Fundamentals
Threat Intelligence Lifecycle
Threat Intelligence Sources and Feeds
Threat Intelligence Data Collection
Threat Intelligence Processing and Analysis
Threat Intelligence Dissemination and Integration
Threat Intelligence Feedback and Improvement
Incident Management Overview
Incident Response Process
Incident Classification and Triage
Incident Handling and Escalation
Post-Incident Activities

Questions 21–25

21expert · medium
A threat intelligence program is being established. The team has defined its intelligence requirements, but the collection phase is producing a large amount of irrelevant data. The team is spending too much time processing data that does not meet the requirements. What is the most effective way to address this issue?
Select an answer first
22foundation · easy
What is the first phase of the incident response process?
Select an answer first
23expert · medium
An organization has experienced a data breach involving customer credit card data. The incident response team is activated. The CISO wants to notify affected customers as soon as possible, but the legal team advises waiting until the investigation is complete to determine the full scope. The incident response team has identified the likely entry point and is working on containment. What is the most appropriate course of action?
Select an answer first
24foundation · easy
What is the primary goal of the containment phase in incident response?
Select an answer first
25foundation · easy
What is the purpose of incident escalation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Threat Intelligence and Incident Management CEH Practice Questions (Page 5)

Questions 21–25

What is the first phase of the incident response process?

What is the primary goal of the containment phase in incident response?

What is the purpose of incident escalation?

Keep studying — Information Security and Ethical Hacking Overview