Threat Intelligence and Incident Management CEH Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   During an incident, the response team discovers that the attacker has established persistence via a scheduled task on multiple servers. The team has contained the immediate threat by isolating the affected servers. However, the business requires these servers to be back online within 24 hours. What should the team do to balance thorough eradication with the business deadline?

   • ARebuild the servers from scratch without any forensic preservation
   • BImmediately reconnect the servers to production after removing only the scheduled tasks
   • CKeep the servers isolated indefinitely until a full forensic analysis is complete
   • DEradicate the scheduled tasks and associated malware, then restore the servers from known-good backups before returning them to production
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A threat intelligence analyst is correlating data from multiple feeds and notices that a specific IP address appears in a commercial feed as a C2 server, but the same IP is listed in an OSINT feed as a legitimate web server. The analyst must decide whether to block the IP. What is the most appropriate action?

   • ABlock the IP and also block all IPs in the same /24 subnet to be safe
   • BInvestigate the IP address further by checking additional context, such as domain history and threat reports, before making a decision
   • CBlock the IP immediately because the commercial feed is more reliable
   • DIgnore the OSINT feed and only use the commercial feed for blocking decisions
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a common source of feedback for improving threat intelligence?

   • AFeedback from external attackers
   • BFeedback from regulatory bodies
   • CFeedback from automated systems that generate alerts
   • DInput from intelligence consumers such as SOC analysts and incident responders
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A threat intelligence team has produced a report on a new phishing campaign targeting the finance department. The report includes IOCs and recommended actions. The team needs to ensure that the finance department's leadership understands the business impact, while the SOC needs the technical IOCs. What is the most effective dissemination approach?

   • ASend the same detailed technical report to both leadership and the SOC
   • BOnly share the IOCs with the SOC and keep the report confidential from leadership
   • CCreate two tailored briefings: one executive summary for leadership and one technical report for the SOC
   • DPost the full report on the company's public website
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A threat intelligence analyst is setting up data collection for a new program. The analyst wants to collect data from internal sources, open-source intelligence, and commercial feeds. Which method is most appropriate for collecting data from internal sources?

   • AConfiguring the SIEM to export logs and alerts to the threat intelligence platform.
   • BDeploying honeypots to attract external attackers.
   • CSubscribing to a commercial threat intelligence platform.
   • DMonitoring public social media for mentions of the company.
   Reveal Solution Discussion Select an answer first