Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat intelligence team needs to present the relationships between indicators of compromise (IOCs) and the malware families they are associated with, along with the confidence levels of those associations. The audience is a group of security analysts who need to quickly identify which IOCs are most reliable for hunting. Which visualization approach is most effective?

   • AA table listing IOCs and malware families, sorted alphabetically, with confidence values in a separate column.
   • BA bar chart showing the count of IOCs per malware family, with no additional detail.
   • CA pie chart showing the proportion of IOCs that are IP addresses, domains, and file hashes.
   • DA link graph or node-link diagram where IOCs and malware families are nodes, and edges are colored by confidence level.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is incorporating feedback from stakeholders important in the threat intelligence reporting process?

   • AIt helps improve the quality and relevance of future reports to better meet stakeholder needs
   • BIt guarantees that all stakeholders will agree with the findings
   • CIt ensures the report is written in a more complex style
   • DIt reduces the need for analysis in future reports
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst has discovered that a known threat actor is using a new malware variant that evades current detection. The analyst must communicate this to the detection engineering team so they can update their rules. What is the most effective communication approach?

   • AA high-level alert stating that a new malware variant exists, without technical details
   • BA visual infographic showing the threat actor's history
   • CA verbal update in a meeting, with no written documentation
   • DA concise technical brief with the malware's behavior, evasion techniques, and recommended detection rule changes
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst needs to create a visualization that shows the geographic distribution of phishing servers targeting the organization. The analyst has access to a threat intelligence platform that can export data, and also has a business intelligence (BI) tool. Which approach is most effective?

   • ACreate a table listing the IP addresses and countries, without a map.
   • BUse the BI tool to create a map visualization by importing the data from the TIP.
   • CUse a word cloud with country names sized by the number of servers.
   • DManually plot the locations on a paper map for a team meeting.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst must present the findings of a threat intelligence report to a mixed audience of executives and technical staff. The key finding is that a specific APT group has increased activity against the company's sector. What is the most effective way to present this finding?

   • APresent only the business impact and omit technical details
   • BBegin with the technical indicators and assume the executives will understand them
   • CStart with a high-level summary of the threat and its business impact, then provide technical details in a separate section
   • DPresent only the technical details because the executives can read the summary later
   Reveal Solution Discussion Select an answer first