A SOC receives two incidents: (1) a suspected insider threat where an employee is downloading large amounts of data to a USB drive, and (2) a distributed denial-of-service (DDoS) attack that is impacting customer-facing services. The SOC has limited staff and can only handle one incident at a time. Which incident should be prioritized?

The DDoS attack, because it directly impacts customer-facing services and revenue

Both incidents simultaneously, even with limited staff

The insider threat, because data exfiltration is always more severe

The insider threat, because it involves a person and is more complex

How can threat intelligence be integrated into security operations?

By manually reviewing intelligence reports on a monthly basis

By feeding indicators of compromise into SIEM and IDS/IPS systems

By storing intelligence in a separate database that is not connected to other systems

By sharing intelligence only with external partners

During an incident, the incident response team has identified that a compromised workstation is being used to scan the internal network. The team has isolated the workstation from the network. According to the incident response process, what should the team do next?

Escalate the incident to law enforcement without further action

Conduct a lessons-learned meeting

Eradicate the threat by removing malware and patching vulnerabilities

Immediately begin recovery by restoring the system from backup

Which technique is used to enrich raw threat data with additional context?

Data correlation with external threat feeds

What is the primary purpose of threat intelligence in an organization?

To ensure compliance with regulatory requirements by documenting all security incidents

To provide actionable knowledge about existing and emerging threats to support proactive security decisions

To replace the need for traditional security controls such as firewalls and antivirus

To reactively respond to security incidents after they occur

EC-CouncilCertified Ethical Hacker

Domain 1Objective 8

Threat Intelligence and Incident Management CEH Practice Questions (Page 8)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

12concepts

12 Concepts in This Objective

Threat Intelligence Fundamentals
Threat Intelligence Lifecycle
Threat Intelligence Sources and Feeds
Threat Intelligence Data Collection
Threat Intelligence Processing and Analysis
Threat Intelligence Dissemination and Integration
Threat Intelligence Feedback and Improvement
Incident Management Overview
Incident Response Process
Incident Classification and Triage
Incident Handling and Escalation
Post-Incident Activities

Questions 36–40

36expert · hard
A SOC receives two incidents: (1) a suspected insider threat where an employee is downloading large amounts of data to a USB drive, and (2) a distributed denial-of-service (DDoS) attack that is impacting customer-facing services. The SOC has limited staff and can only handle one incident at a time. Which incident should be prioritized?
Select an answer first
37foundation · easy
How can threat intelligence be integrated into security operations?
Select an answer first
38application · medium
During an incident, the incident response team has identified that a compromised workstation is being used to scan the internal network. The team has isolated the workstation from the network. According to the incident response process, what should the team do next?
Select an answer first
39foundation · easy
Which technique is used to enrich raw threat data with additional context?
Select an answer first
40foundation · easy
What is the primary purpose of threat intelligence in an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.