A threat intelligence team has a limited budget and needs to produce a weekly report for the board. The report must highlight the top threats relevant to the company's industry. The team has access to a free OSINT feed, a paid threat intelligence feed, and internal incident data. The team has only one analyst available to work on this task. Which approach would be most effective in producing the report?

Ask the board to prioritize which threats they want to see.

Combine the OSINT feed, paid feed, and internal incident data, then normalize and enrich the data before prioritizing threats.

Use the paid feed exclusively because it is more reliable and comprehensive.

Use only internal incident data because it is most relevant to the company.

A threat intelligence team is integrating a new open-source feed that provides indicators in a format different from the existing internal system. The team needs to ensure that the indicators can be used by the existing detection tools. What should the team do first?

Use the feed as-is and hope the detection tools can parse it.

Manually enter the indicators into the detection tools.

Map the fields from the new feed to the internal schema and transform the data accordingly.

Ask the feed provider to change their format to match the internal system.

An analyst has a dataset of millions of network events. To extract useful intelligence, the analyst applies a method that identifies patterns and anomalies that indicate potential threats. Which method is this?

Data mining and pattern recognition

A threat intelligence team has collected a large dataset of indicators from open-source feeds. The team needs to produce a daily digest for executives that highlights the most relevant threats to the organization's industry. The data has been normalized and enriched. What is the best way to extract the intelligence for the digest?

Randomly select a sample of indicators to keep the digest short.

Only include indicators that have a high confidence score, regardless of relevance.

Include all indicators in the digest to ensure nothing is missed.

Filter indicators that match the organization's industry, sector, and geographic region, then rank them by severity and confidence.

An analyst is investigating a malware sample and has identified a C2 server IP address. The analyst wants to determine if this IP is associated with other malware samples and whether it is part of a larger campaign. Which enrichment source would provide the most relevant context?

A threat intelligence feed that provides relationships between IPs, domains, and malware samples.

A list of all IP addresses in the organization's firewall logs.

EC-CouncilThreat Intelligence Essentials

Domain 4Objective 4

Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 1)

Part of the Data Collection and Sources domain, which makes up ~13% of our current practice bank.

38questions here

8free pages

3concepts

Questions 1–5

1expert · hard
A threat intelligence team has a limited budget and needs to produce a weekly report for the board. The report must highlight the top threats relevant to the company's industry. The team has access to a free OSINT feed, a paid threat intelligence feed, and internal incident data. The team has only one analyst available to work on this task. Which approach would be most effective in producing the report?
Select an answer first
2application · medium
A threat intelligence team is integrating a new open-source feed that provides indicators in a format different from the existing internal system. The team needs to ensure that the indicators can be used by the existing detection tools. What should the team do first?
Select an answer first
3foundation · easy
An analyst has a dataset of millions of network events. To extract useful intelligence, the analyst applies a method that identifies patterns and anomalies that indicate potential threats. Which method is this?
Select an answer first
4application · medium
A threat intelligence team has collected a large dataset of indicators from open-source feeds. The team needs to produce a daily digest for executives that highlights the most relevant threats to the organization's industry. The data has been normalized and enriched. What is the best way to extract the intelligence for the digest?
Select an answer first
5application · medium
An analyst is investigating a malware sample and has identified a C2 server IP address. The analyst wants to determine if this IP is associated with other malware samples and whether it is part of a larger campaign. Which enrichment source would provide the most relevant context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Normalizing, Enriching, and Extracting Useful Intelligence TIE Practice Questions (Page 1)

Questions 1–5

A threat intelligence team is integrating a new open-source feed that provides indicators in a format different from the existing internal system. The team needs to ensure that the indicators can be used by the existing detection tools. What should the team do first?

An analyst has a dataset of millions of network events. To extract useful intelligence, the analyst applies a method that identifies patterns and anomalies that indicate potential threats. Which method is this?

An analyst is investigating a malware sample and has identified a C2 server IP address. The analyst wants to determine if this IP is associated with other malware samples and whether it is part of a larger campaign. Which enrichment source would provide the most relevant context?

Keep studying — Data Collection and Sources