Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A threat intelligence team produces a monthly report. The executive sponsor wants a one-page summary with clear business risk ratings. The SOC manager wants detailed IOCs and TTPs. The compliance team wants a section on regulatory implications. The team has limited time and must produce a single report. What is the best approach to satisfy all stakeholders?

   • ACreate a single report with an executive summary, a technical section, and a compliance section, and use an executive dashboard for the sponsor.
   • BSend the full technical report to everyone and let each audience extract what they need.
   • CProduce three separate reports, one for each stakeholder group, with no shared content.
   • DFocus only on the executive summary because the sponsor is the most important stakeholder.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst has identified a critical vulnerability that is being exploited in the wild and affects a system that the organization uses. The analyst must communicate this to the system owner, who is not a security expert. What is the most effective way to communicate this finding?

   • AExplain the vulnerability in non-technical terms, describe the potential business impact, and provide clear, prioritized remediation steps.
   • BOnly inform the system owner that there is a vulnerability and that they should patch it, without further explanation.
   • CSend a detailed technical advisory with CVE details, exploit code, and detection rules.
   • DEscalate the issue to the system owner's manager without informing the system owner directly.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst has collected a large dataset of threat intelligence from multiple sources, including open-source feeds, commercial feeds, and internal telemetry. The data contains many false positives and duplicates. The analyst needs to present a clear and actionable summary to the security team. What is the most important step before creating the visualization?

   • AClean and deduplicate the data, and filter out false positives to ensure the visualization is accurate.
   • BUse a complex visualization that can handle all the data without any preprocessing.
   • CCreate the visualization immediately to show the team the raw data as it is.
   • DPresent the data in a table with all details, so the team can manually filter it.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence analyst uses a Python-based data analysis environment and wants to create a reusable, code-driven visualization of malware family relationships for a weekly report. The analyst needs a tool that integrates with the existing Python workflow and can produce publication-quality graphs. Which tool is most appropriate?

   • AA presentation software with hand-drawn diagrams
   • BA network graph library such as NetworkX with Matplotlib for rendering
   • CA word processor with embedded images from other sources
   • DA spreadsheet program with manual chart creation
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which practice best supports the presentation of complex threat data in an actionable manner?

   • AUsing only text to avoid misinterpretation of charts
   • BUsing visualizations and summaries to highlight key findings and recommended actions
   • CProviding raw logs without any interpretation
   • DIncluding every indicator and data point in the main body
   Reveal Solution Discussion Select an answer first