A company is developing a new IoT device that will be deployed in critical infrastructure. The security team needs to identify potential threats and vulnerabilities in the device's design. They have limited time and resources. Which approach is most effective?

Wait until the device is deployed and then monitor for attacks.

Conduct a threat modeling session using a methodology like STRIDE, focusing on the most critical components.

Use a vulnerability scanner on the device's firmware.

Perform a penetration test on a prototype of the device.

Why is TTP analysis important for developing countermeasures?

It identifies the identity of the attacker

It helps understand how adversaries operate, allowing for targeted defenses

It eliminates the need for IoC analysis

It automatically blocks all known malware signatures

A security team wants to implement a machine learning model to detect phishing emails. They have a large dataset of labeled emails (phishing and benign). They also have a smaller dataset of emails that are not labeled. Which approach is most effective to improve the model's accuracy?

Use semi-supervised learning, which uses the labeled data to train the model and the unlabeled data to refine the decision boundary.

Use unsupervised clustering on the unlabeled data and then manually label the clusters.

Use only the labeled data to train a supervised model and ignore the unlabeled data.

Use a rule-based filter to classify emails and then use machine learning only for uncertain cases.

What is the primary purpose of trend analysis in threat intelligence?

To correlate disparate data points

To identify changes in threat activity over time

To normalize data into a standard format

To enrich data with external context

EC-CouncilThreat Intelligence Essentials

Domain 6Objective 1

Data Analysis Techniques TIE Practice Questions (Page 8)

Part of the Threat Intelligence Analysis domain, which makes up ~14% of our current practice bank.

59questions here

12free pages

12concepts

12 Concepts in This Objective

Data collection methods
Data normalization
Data correlation
Data enrichment
Statistical analysis
Visualization techniques
Machine learning applications
Indicators of Compromise (IoC) analysis
Tactics, Techniques, and Procedures (TTP) analysis
Threat modeling
Risk assessment
Reporting and dissemination

Questions 36–40

36expert · hard
A company is developing a new IoT device that will be deployed in critical infrastructure. The security team needs to identify potential threats and vulnerabilities in the device's design. They have limited time and resources. Which approach is most effective?
Select an answer first
37foundation · easy
Why is TTP analysis important for developing countermeasures?
Select an answer first
38expert · hard
A security team wants to implement a machine learning model to detect phishing emails. They have a large dataset of labeled emails (phishing and benign). They also have a smaller dataset of emails that are not labeled. Which approach is most effective to improve the model's accuracy?
Select an answer first
39foundation · easy
What is the primary purpose of trend analysis in threat intelligence?
Select an answer first
40foundation · easy
Which statistical method is used to identify unusual patterns in threat data that deviate from expected behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.