Threat Intelligence and Incident Management CEH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which method is commonly used to collect threat data from internal network traffic?

   • AAnalyzing DNS logs from external providers
   • BSubscribing to a commercial threat feed
   • CUsing network intrusion detection systems (IDS) and packet capture tools
   • DDeploying honeypots to attract attackers
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   A security director is considering whether to invest in a threat intelligence program. The director is concerned that the program may not provide a return on investment because the organization has never experienced a major incident. Which argument best justifies the investment?

   • AThreat intelligence is required by law for all organizations.
   • BThreat intelligence guarantees that the organization will never be breached.
   • CThreat intelligence eliminates the need for other security controls.
   • DThreat intelligence helps the organization identify and mitigate emerging threats before they can be exploited, reducing the likelihood and impact of incidents.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During a routine security monitoring shift, an analyst observes multiple failed login attempts against a non-critical internal file server, followed by a single successful login from an unusual external IP address. The analyst also notices that a public-facing web server is experiencing a high volume of malformed requests that match a known exploit pattern. Given limited resources, which incident should the analyst escalate first?

   • AThe failed login attempts, because they indicate a brute-force attack in progress.
   • BThe malformed requests on the public-facing web server, because they match a known exploit pattern and could lead to a breach.
   • CAll incidents equally, because any suspicious activity should be treated with the same priority.
   • DThe successful login from an unusual IP, because it indicates a potential account compromise.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A helpdesk technician receives a call from an employee who clicked a link in a phishing email and entered their credentials on a fake login page. The technician suspects a credential compromise. According to incident handling procedures, what should the technician do FIRST?

   • AReset the employee's account and log the incident without further action.
   • BAsk the employee to change their password and continue working.
   • CEscalate the incident to the security team immediately, providing all relevant details.
   • DIgnore the incident because the employee did not lose money.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst has collected raw threat data from multiple sources, including firewall logs, OSINT feeds, and a commercial intelligence service. The data contains many false positives and is in different formats. The analyst needs to transform this data into actionable intelligence for the SOC. What should the analyst do first?

   • AImmediately disseminate the raw data to all SOC analysts
   • BStore the raw data in a data lake without any processing
   • CNormalize and correlate the data to identify common patterns and remove duplicates
   • DDiscard all data from OSINT feeds because they are less reliable
   Reveal Solution Discussion Select an answer first