Threat Intelligence and Incident Management CEH Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A threat intelligence team is building a collection plan for a new intelligence requirement about a specific malware family. The team has access to OSINT feeds, commercial feeds, internal logs, and dark web forums. The team has limited time and needs to produce actionable intelligence quickly. Which collection strategy is most efficient?

   • AOnly use internal logs because they are most relevant to the organization
   • BOnly use OSINT feeds because they are free and accessible
   • CCollect data from all sources equally to ensure completeness
   • DPrioritize commercial feeds and internal logs for technical IOCs, and use dark web forums for contextual TTPs
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is triaging two incidents: (1) a phishing email that was reported by a user but not clicked, and (2) a suspected data exfiltration from a database server. Which incident should be classified as higher severity and prioritized?

   • AThe phishing email, because it was reported by a user.
   • BNeither should be escalated because no malware was detected.
   • CThe data exfiltration, because it involves potential loss of sensitive data.
   • DBoth should be treated equally because both are security incidents.
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   During a security incident, the on-call analyst discovers that the incident involves a critical server and requires expertise beyond their level. The incident response plan specifies that the incident commander should be notified for critical incidents. However, the incident commander is currently unavailable. What should the analyst do?

   • AEscalate to the next level of management or the designated backup incident commander.
   • BHandle the incident alone, even without the necessary expertise.
   • CWait for the incident commander to become available before taking any action.
   • DDeclare the incident as resolved and close it.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A threat intelligence analyst is evaluating sources for a new program. The analyst has access to a commercial feed that provides high-confidence indicators but is expensive, an OSINT feed that is free but has a high false-positive rate, and internal logs that are accurate but only reflect past activity. The analyst needs to support real-time blocking decisions. Which combination of sources is most appropriate?

   • AUse the commercial feed as the primary source for real-time blocking, supplemented by OSINT and internal logs for context and validation.
   • BUse internal logs only because they are accurate and reflect the organization's environment.
   • CUse only the OSINT feed because it is free and provides a large volume of indicators.
   • DUse only the commercial feed because it has high-confidence indicators.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A threat intelligence team has just completed a quarterly report on ransomware campaigns targeting the organization's sector. The report was distributed to executives and the SOC, but the team notices that the SOC has not adjusted its detection rules based on the new indicators. According to the threat intelligence lifecycle, which phase is most likely being neglected?

   • APlanning and direction
   • BDissemination and integration
   • CCollection
   • DFeedback
   Reveal Solution Discussion Select an answer first