A threat intelligence team has identified three threats: Threat A has a high likelihood and high impact, Threat B has a medium likelihood and medium impact, and Threat C has a low likelihood and high impact. The team has limited resources and must prioritize. Which threat should be addressed first?

Threat B, because it is balanced and easier to mitigate.

Threat C, because the impact is high even though the likelihood is low.

Address all three simultaneously to avoid missing any threat.

Threat A, because it has the highest risk score when likelihood and impact are combined.

Why is risk assessment important in threat intelligence analysis?

It helps prioritize which threats to address first

It replaces the need for threat modeling

It automatically mitigates vulnerabilities

It guarantees that all threats will be eliminated

What is the primary purpose of threat modeling?

To systematically identify potential threats and vulnerabilities in a system

To collect threat intelligence from external sources

To normalize threat data into a standard format

To respond to an active security incident

What does TTP stand for in threat intelligence analysis?

Tactics, Techniques, and Procedures

An analyst has identified a suspicious file hash in an endpoint detection alert. The analyst wants to determine if this hash is associated with known malware and assess the severity of the potential infection. Which action should the analyst take?

Visualize the file hash on a timeline of endpoint events.

Normalize the hash into a standard format for storage.

Enrich the hash with threat intelligence feeds to check for known malware associations and reputation scores.

Perform a statistical analysis of file hash occurrences in the organization's logs.

EC-CouncilThreat Intelligence Essentials

Domain 6Objective 1

Data Analysis Techniques TIE Practice Questions (Page 2)

Part of the Threat Intelligence Analysis domain, which makes up ~14% of our current practice bank.

59questions here

12free pages

12concepts

12 Concepts in This Objective

Data collection methods
Data normalization
Data correlation
Data enrichment
Statistical analysis
Visualization techniques
Machine learning applications
Indicators of Compromise (IoC) analysis
Tactics, Techniques, and Procedures (TTP) analysis
Threat modeling
Risk assessment
Reporting and dissemination

Questions 6–10

6expert · hard
A threat intelligence team has identified three threats: Threat A has a high likelihood and high impact, Threat B has a medium likelihood and medium impact, and Threat C has a low likelihood and high impact. The team has limited resources and must prioritize. Which threat should be addressed first?
Select an answer first
7foundation · easy
Why is risk assessment important in threat intelligence analysis?
Select an answer first
8foundation · easy
What is the primary purpose of threat modeling?
Select an answer first
9foundation · easy
What does TTP stand for in threat intelligence analysis?
Select an answer first
10application · medium
An analyst has identified a suspicious file hash in an endpoint detection alert. The analyst wants to determine if this hash is associated with known malware and assess the severity of the potential infection. Which action should the analyst take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.