Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After delivering a monthly threat intelligence report, the analyst receives feedback from the incident response team that the 'Indicators of Compromise' section is too long and includes many IOCs that are not relevant to their current environment. The executive team also comments that the 'Executive Summary' is too technical. How should the analyst incorporate this feedback?

   • AKeep the report as is, because the feedback is subjective and the report must remain comprehensive.
   • BRemove the IOC section entirely and focus only on strategic summaries to satisfy the executives.
   • CCreate two separate reports: one for executives and one for the IR team, but do not change the content of either.
   • DRevise the report to include a concise executive summary with business-focused language, and an IOC section that is filtered to only include indicators relevant to the organization's environment, with a note on how to request additional IOCs.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A threat intelligence team uses a commercial TIP that has a built-in dashboard feature. The team also has access to an open-source visualization tool like Gephi. The team needs to create a complex network graph of threat actor relationships for a deep-dive analysis, but the TIP's built-in graph feature is limited. What is the best approach?

   • AUse only Gephi and manually enter the data, ignoring the TIP.
   • BUse only the TIP's built-in graph feature, even though it is limited.
   • CExport the relationship data from the TIP and import it into Gephi to create the advanced graph.
   • DManually recreate the graph in a drawing tool like Visio.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An analyst has a dataset of 10,000 phishing URLs, each tagged with the threat actor, target industry, and date. The analyst needs to present this data to a non-technical audience to show which industries are most targeted and by which actors. The audience is not familiar with technical jargon. What is the best visualization approach?

   • AA scatter plot of URLs with actor and industry as coordinates
   • BA stacked bar chart with industries on the x-axis and counts of URLs, colored by threat actor
   • CA network graph connecting actors to industries
   • DA table listing every URL with its actor and industry
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which section of a threat intelligence report is primarily intended to provide a quick overview of the key findings, conclusions, and recommended actions for readers who may not have time to read the full document?

   • AIndicators of Compromise
   • BAppendix
   • CMethodology
   • DExecutive Summary
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst has collected a large dataset of malicious domains and their associated threat actor groups. The analyst must present this data to a non-technical audience in a way that highlights the most active threat actors. What is the best way to present this data?

   • AA complex network graph showing all domain-actor relationships
   • BA scatter plot of domain registration dates versus actor group IDs
   • CA bar chart ranking threat actors by the number of associated malicious domains
   • DA raw data table with all domains and actors
   Reveal Solution Discussion Select an answer first