A threat intelligence analyst needs to collect data from a variety of sources. Which of the following is an example of an internal source of threat intelligence data?

A commercial threat intelligence feed

The organization's firewall and proxy logs

A public blog post from a security researcher

An analyst has correlated multiple data sources and identified a complex attack pattern involving lateral movement across several hosts. The analyst needs to present this pattern to both technical and non-technical audiences. Which visualization approach is most effective?

Present a raw log table of all correlated events.

Use a single pie chart showing the proportion of attacks by host.

Create a network graph showing the relationships and movement between hosts, with a summary heat map for non-technical stakeholders.

Use a line chart of the number of compromised hosts over time.

A security analyst at a mid-sized firm discovers a suspicious file hash in an internal sandbox report. The hash is not found in the firm's internal threat feed. To quickly determine whether this hash is associated with a known campaign, which action is most appropriate?

Immediately block the hash at the firewall without further analysis to prevent potential infection.

Query a commercial threat intelligence platform that aggregates multiple sources and provides context such as campaign attribution and related indicators.

Search the firm's SIEM logs for other occurrences of the same hash to see if it has been seen internally before.

Run the hash through a local hash database that only contains hashes from the firm's own past incidents.

A financial institution is planning to deploy a new online banking application. The security team wants to systematically identify potential threats and vulnerabilities in the application before it goes live. Which approach should they use?

Construct a threat model that maps application components, data flows, and trust boundaries.

Create a heat map of network traffic in the existing data center.

Perform a statistical analysis of historical cyber attack data in the banking sector.

Collect IoCs from recent phishing campaigns targeting banks.

EC-CouncilThreat Intelligence Essentials

Domain 6Objective 1

Data Analysis Techniques TIE Practice Questions (Page 1)

Part of the Threat Intelligence Analysis domain, which makes up ~14% of our current practice bank.

59questions here

12free pages

12concepts

12 Concepts in This Objective

Data collection methods
Data normalization
Data correlation
Data enrichment
Statistical analysis
Visualization techniques
Machine learning applications
Indicators of Compromise (IoC) analysis
Tactics, Techniques, and Procedures (TTP) analysis
Threat modeling
Risk assessment
Reporting and dissemination

Questions 1–5

1foundation · easy
An analyst notices that a specific IP address appears in firewall logs, and the same IP is also found in a threat intelligence feed as a command-and-control server. What technique is the analyst applying?
Select an answer first
2foundation · easy
A threat intelligence analyst needs to collect data from a variety of sources. Which of the following is an example of an internal source of threat intelligence data?
Select an answer first
3expert · hard
An analyst has correlated multiple data sources and identified a complex attack pattern involving lateral movement across several hosts. The analyst needs to present this pattern to both technical and non-technical audiences. Which visualization approach is most effective?
Select an answer first
4application · medium
A security analyst at a mid-sized firm discovers a suspicious file hash in an internal sandbox report. The hash is not found in the firm's internal threat feed. To quickly determine whether this hash is associated with a known campaign, which action is most appropriate?
Select an answer first
5application · medium
A financial institution is planning to deploy a new online banking application. The security team wants to systematically identify potential threats and vulnerabilities in the application before it goes live. Which approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.