Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A threat intelligence team needs to visualize a complex attack graph that includes multiple attack paths, each with different likelihood and impact scores. The audience is a group of risk managers who need to understand which attack paths pose the greatest risk to the organization. Which visualization approach is most effective?

   • AA simple list of attack paths sorted by likelihood, without any visual representation.
   • BA node-link diagram where nodes are colored by likelihood and edges are labeled with impact scores.
   • CA bar chart showing the number of attack paths per attack vector.
   • DA pie chart showing the proportion of attack paths that are high, medium, and low risk.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat intelligence analyst has confirmed that a zero-day vulnerability is being exploited in the wild, but the vendor has not yet released a patch. The analyst must communicate this to the executive team, the IT operations team, and the security team. The executive team needs to understand the business risk, the IT operations team needs to know which systems are affected, and the security team needs to develop mitigations. What is the most effective communication strategy?

   • AIssue a single urgent alert with three clearly labeled sections: business risk, affected systems, and recommended mitigations.
   • BSend a technical alert to the security team only and wait for the vendor patch before informing executives.
   • CSend separate alerts to each team, each with only the information relevant to that team.
   • DSend a high-level alert to executives and a separate detailed alert to the security team, but do not inform IT operations.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A threat intelligence analyst needs to present the timeline of a multi-stage attack campaign to a non-technical audience, such as the legal department, to support a legal case. The timeline includes several key events, such as initial compromise, lateral movement, and data exfiltration. Which visualization method is most appropriate?

   • AA heat map showing the intensity of malicious activity across different hours of the day.
   • BA Gantt chart or timeline visualization that clearly shows the sequence and duration of each attack phase.
   • CA scatter plot showing the number of compromised hosts over time.
   • DA network diagram showing the connections between compromised systems, without time information.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key characteristic of effective threat intelligence communication?

   • AIt avoids any recommendations to remain objective
   • BIt provides clear context and explains the significance of the findings
   • CIt uses as many technical terms as possible to ensure precision
   • DIt focuses only on raw data without interpretation
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which audience would most likely benefit from a threat intelligence report that includes specific indicators of compromise, detection rules, and recommended mitigation steps?

   • ATechnical security staff and analysts
   • BBoard of directors
   • CLegal and compliance officers
   • DPublic relations team
   Reveal Solution Discussion Select an answer first