A security operations center (SOC) receives millions of raw DNS logs daily. An analyst filters the logs to show only queries to domains known to be malicious, then correlates those queries with internal hostnames and timestamps. Finally, the analyst writes a report explaining that the pattern indicates a specific malware family and recommends isolating the affected hosts. Which step in this process represents the transition from information to intelligence?

Collecting the raw DNS logs from the DNS server

Filtering the raw DNS logs to only malicious domains

Correlating queries with hostnames and timestamps

Writing the report that explains the malware family and recommends isolating hosts

A threat intelligence analyst is reviewing a report from an external vendor. The report contains a list of IP addresses, a description of the malware family associated with those IPs, and a recommendation to block the IPs. The analyst's organization has no systems that communicate with those IPs, and the malware family is not relevant to their industry. Which part of the report is intelligence, and how should the analyst treat it?

The IP addresses are intelligence, and the analyst should block them immediately.

The recommendation is information, and the analyst should implement it because it is from a trusted vendor.

The recommendation is intelligence, but it is not actionable for this organization because it lacks local context.

The malware family description is intelligence, and the analyst should update the threat model.

EC-CouncilThreat Intelligence Essentials

Domain 1Objective 2

Key Differences Between Intelligence, Information, and Data TIE Practice Questions (Page 8)

Part of the Introduction to Threat Intelligence domain, which makes up ~14% of our current practice bank.

38questions here

8free pages

6concepts

Questions 36–38

36application · medium
A security operations center (SOC) receives millions of raw DNS logs daily. An analyst filters the logs to show only queries to domains known to be malicious, then correlates those queries with internal hostnames and timestamps. Finally, the analyst writes a report explaining that the pattern indicates a specific malware family and recommends isolating the affected hosts. Which step in this process represents the transition from information to intelligence?
Select an answer first
37expert · hard
A threat intelligence analyst is reviewing a report from an external vendor. The report contains a list of IP addresses, a description of the malware family associated with those IPs, and a recommendation to block the IPs. The analyst's organization has no systems that communicate with those IPs, and the malware family is not relevant to their industry. Which part of the report is intelligence, and how should the analyst treat it?
Select an answer first
38foundation · easy
A threat intelligence platform collects indicators of compromise (IOCs) from multiple feeds and correlates them with internal vulnerability data to produce a prioritized list of actions for the incident response team. What is the final product?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Key Differences Between Intelligence, Information, and Data TIE Practice Questions (Page 8)

Questions 36–38

A threat intelligence platform collects indicators of compromise (IOCs) from multiple feeds and correlates them with internal vulnerability data to produce a prioritized list of actions for the incident response team. What is the final product?

Keep studying — Introduction to Threat Intelligence