A threat intelligence team has received feedback that their reports are often too technical for the executive audience, but the technical team finds them insufficiently detailed. The team is now revising the report template. What is the most effective way to address this feedback?

Standardize on a single level of detail that is somewhere in the middle, to satisfy both audiences.

Make the report longer and more technical, and require the executives to read the executive summary only.

Create a modular report template with an executive summary, a technical section, and a 'further details' appendix that can be included as needed.

Make the report shorter and less technical, and require the technical team to request additional details separately.

An analyst is writing a threat intelligence report on a ransomware group that has targeted the company's sector. The report will be read by both the executive team and the security operations staff. Which report structure best serves both audiences?

A single section combining all information without any headings

Technical indicators only, because the report is for security staff

Executive summary, threat actor profile, technical indicators, recommended mitigations, and appendix with IOCs

Executive summary only, because the report is for the board

In a threat intelligence report, what is the primary purpose of the 'Indicators of Compromise' (IOC) section?

To list technical artifacts such as IP addresses, domains, file hashes, and email addresses that can be used to detect or block malicious activity

To provide a detailed narrative of the threat actor's motivations and capabilities

To summarize the report's conclusions and recommended actions for senior management

To explain the analytical methods and sources used to produce the intelligence

Which visualization technique is most appropriate for showing the relationships between different threat actors, malware families, and infrastructure?

Link analysis graph (node-link diagram)

An analyst has discovered a new phishing campaign that uses a legitimate cloud service to host malicious documents. The analyst must communicate this finding to both the executive team and the technical response team. What is the most effective communication approach?

Use a single visual dashboard that shows technical details and business impact in one view, assuming both groups will interpret it correctly.

Only inform the technical team, as they are responsible for mitigation, and let them decide what to escalate.

Provide a brief executive summary with business risk and recommended actions, and a separate technical report with IOCs, TTPs, and detection guidance.

Send the same detailed technical report to both groups, ensuring consistency and completeness.

EC-CouncilThreat Intelligence Essentials

Domain 6Objective 5

Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 1)

Part of the Threat Intelligence Analysis domain, which makes up ~14% of our current practice bank.

47questions here

10free pages

7concepts

Questions 1–5

1expert · hard
A threat intelligence team has received feedback that their reports are often too technical for the executive audience, but the technical team finds them insufficiently detailed. The team is now revising the report template. What is the most effective way to address this feedback?
Select an answer first
2application · medium
An analyst is writing a threat intelligence report on a ransomware group that has targeted the company's sector. The report will be read by both the executive team and the security operations staff. Which report structure best serves both audiences?
Select an answer first
3foundation · easy
In a threat intelligence report, what is the primary purpose of the 'Indicators of Compromise' (IOC) section?
Select an answer first
4foundation · easy
Which visualization technique is most appropriate for showing the relationships between different threat actors, malware families, and infrastructure?
Select an answer first
5application · medium
An analyst has discovered a new phishing campaign that uses a legitimate cloud service to host malicious documents. The analyst must communicate this finding to both the executive team and the technical response team. What is the most effective communication approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.