Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat intelligence analyst has completed a detailed investigation into a new ransomware family that is targeting the organization's industry. The analyst must now brief the board of directors, who are concerned about business impact and regulatory exposure. Which report structure and content approach is most appropriate for this audience?

   • AAn executive summary that highlights the threat's potential business impact, likelihood, and recommended risk mitigation actions, with technical details in an appendix.
   • BA short email with only the ransomware's name and a link to a public news article, to avoid overwhelming the board with details.
   • CA technical briefing that focuses on the malware's encryption algorithm and command-and-control infrastructure, assuming the board understands these concepts.
   • DA full technical report with MITRE ATT&CK mappings, IOCs, and YARA rules, presented in the same format used for the SOC.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst has identified a critical vulnerability being exploited in the wild that affects the company's internet-facing systems. The analyst must communicate this finding to the IT operations team, which will implement patches. What is the most effective way to communicate this intelligence?

   • AA verbal message to the team lead without written documentation
   • BA chart showing the vulnerability's CVSS score and exploit activity over time
   • CA lengthy report with all background research and historical context
   • DA concise alert with the vulnerability details, affected systems, exploitation status, and recommended patching actions
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an effective way to gather feedback from stakeholders on a threat intelligence report?

   • AIgnoring feedback to maintain the original report structure
   • BOnly sharing the report with technical staff to avoid criticism
   • CConducting a post-report survey or interview to ask about usefulness, clarity, and actionability
   • DWaiting for stakeholders to provide unsolicited feedback
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence team releases a weekly report. After several weeks, the security engineering team says the report lacks actionable recommendations for hardening their cloud environment. The risk team says the report is too focused on technical details and not enough on business risk. How should the team adjust the report?

   • AKeep the report unchanged because the standard structure is already correct.
   • BAdd a dedicated section for cloud-specific mitigations and expand the executive summary to include business risk implications.
   • CReduce the report to a single page of bullet points with no technical detail.
   • DRemove the executive summary and make the report purely technical to satisfy the engineering team.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which visualization method is best suited to show the frequency of malware detections over a period of time?

   • AHeat map
   • BScatter plot
   • CLine chart
   • DPie chart
   Reveal Solution Discussion Select an answer first