A security analyst has a list of IP addresses that were flagged as malicious by an internal IDS. The analyst wants to enrich these IPs with external context to determine which ones are most relevant to the organization. The analyst has access to a commercial threat intelligence platform, a free geolocation service, and a private sector information sharing group. Which combination of enrichment sources is most effective for assessing relevance?

Use the sharing group only because it is tailored to the organization's sector.

Use only the geolocation service to identify where the IPs are located.

Use the commercial platform to get threat context and the sharing group to get sector-specific relevance.

Use only the commercial platform because it is the most comprehensive source.

What is the primary goal of disseminating threat intelligence reports?

To demonstrate the analyst's technical skills

To provide actionable insights that support decision-making

To share raw data with the public

To archive all threat data for future reference

A threat intelligence team must prepare a report for both the executive leadership and the technical security team about a recent advanced persistent threat (APT) campaign. The report must be actionable for both audiences. What is the most effective approach?

Present the report verbally to both audiences with the same content.

Create two separate reports: one high-level executive summary and one detailed technical report.

Create a single report that includes both high-level summaries and technical details in the same document.

Focus on technical details and assume executives will understand them.

A threat intelligence team collects indicators from multiple sources: a commercial feed provides IP addresses in dotted-decimal format, an open-source feed provides IPs in CIDR notation, and internal logs provide IPs as integers. To correlate these indicators across all sources, what should the team do first?

Keep the data in its original format and rely on the correlation tool to handle the differences automatically.

Discard the integer format because it is not a standard representation.

Use a pivot table in a spreadsheet to manually align the different formats.

Convert all IP addresses to a single standard format, such as dotted-decimal, and store them in a unified schema.

EC-CouncilThreat Intelligence Essentials

Domain 6Objective 1

Data Analysis Techniques TIE Practice Questions (Page 9)

Part of the Threat Intelligence Analysis domain, which makes up ~14% of our current practice bank.

59questions here

12free pages

12concepts

12 Concepts in This Objective

Data collection methods
Data normalization
Data correlation
Data enrichment
Statistical analysis
Visualization techniques
Machine learning applications
Indicators of Compromise (IoC) analysis
Tactics, Techniques, and Procedures (TTP) analysis
Threat modeling
Risk assessment
Reporting and dissemination

Questions 41–45

41foundation · easy
Which of the following is a common threat modeling methodology?
Select an answer first
42expert · hard
A security analyst has a list of IP addresses that were flagged as malicious by an internal IDS. The analyst wants to enrich these IPs with external context to determine which ones are most relevant to the organization. The analyst has access to a commercial threat intelligence platform, a free geolocation service, and a private sector information sharing group. Which combination of enrichment sources is most effective for assessing relevance?
Select an answer first
43foundation · easy
What is the primary goal of disseminating threat intelligence reports?
Select an answer first
44expert · hard
A threat intelligence team must prepare a report for both the executive leadership and the technical security team about a recent advanced persistent threat (APT) campaign. The report must be actionable for both audiences. What is the most effective approach?
Select an answer first
45application · medium
A threat intelligence team collects indicators from multiple sources: a commercial feed provides IP addresses in dotted-decimal format, an open-source feed provides IPs in CIDR notation, and internal logs provide IPs as integers. To correlate these indicators across all sources, what should the team do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Data Analysis Techniques TIE Practice Questions (Page 9)

Questions 41–45

Which of the following is a common threat modeling methodology?

What is the primary goal of disseminating threat intelligence reports?

A threat intelligence team must prepare a report for both the executive leadership and the technical security team about a recent advanced persistent threat (APT) campaign. The report must be actionable for both audiences. What is the most effective approach?

Keep studying — Threat Intelligence Analysis