Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A threat intelligence analyst has collected a large amount of data on phishing domains that are targeting the organization. The analyst needs to present this data to the security team in a way that highlights the most critical domains to block first. Which presentation method is most effective?

   • AA ranked bar chart showing the top 10 highest-risk domains, with color coding for severity and a brief annotation for each.
   • BA word cloud where the size of each domain name represents its risk score.
   • CA scatter plot showing the relationship between domain age and reputation score, without highlighting specific domains.
   • DA table listing all domains alphabetically, with columns for reputation score and first seen date.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A threat intelligence team has been producing a monthly report for the executive team. The executives have provided feedback that the report is too long and that the 'Recommendations' section is not actionable. The team also receives feedback from the technical staff that the report lacks sufficient detail on IOCs. How should the team reconcile this conflicting feedback?

   • AFocus only on the executive feedback and remove technical details to keep the report short.
   • BFocus only on the technical feedback and add more IOCs, ignoring the executive feedback.
   • CMake the report longer to include both more detail and more recommendations, satisfying everyone.
   • DCreate a two-part report: a concise executive summary with actionable recommendations, and a technical appendix with detailed IOCs and analysis.
   Reveal Solution Discussion Select an answer first