Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A threat intelligence analyst at a mid-sized company has completed a deep-dive analysis of a phishing campaign targeting the finance department. The CEO needs a one-page summary for the board, while the SOC manager wants the full technical details. The analyst must produce two deliverables from the same analysis. What is the most appropriate approach?

   • ASend the full technical report to both the CEO and the SOC manager, adding an executive summary at the top.
   • BCreate a short executive brief with business impact and recommended actions for the CEO, and a detailed technical report with IOCs and detection rules for the SOC manager.
   • CProvide only the executive summary to the CEO and tell the SOC manager to read the same summary because the analysis is complete.
   • DAsk the SOC manager to write their own report from the raw data, and send the CEO a verbal summary only.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat intelligence analyst is preparing a report on a new banking trojan. The report will be distributed to the executive board, the SOC team, and the fraud investigation unit. What is the most effective way to structure the report to serve all three audiences?

   • ASend the same full technical report to all three audiences without any adaptation.
   • BSend only the executive summary to all three audiences.
   • CCreate a single report with an executive summary, a technical analysis section, and a separate section for fraud-specific indicators and recommendations.
   • DCreate three completely separate reports with no shared content.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which platform is commonly used to create dashboards and visualizations of threat intelligence data by connecting to various data sources?

   • AKibana
   • BMetasploit
   • CBurp Suite
   • DJohn the Ripper
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A threat intelligence team has been producing a weekly report for six months. The report is well-structured and technically accurate, but stakeholder engagement is declining. Feedback indicates that the report is too long, the executive summary is too detailed, and the technical section lacks actionable recommendations. The team must revise the report to improve engagement. What is the most effective revision strategy?

   • AShorten the report, make the executive summary more concise, and add a 'Recommended Actions' section with specific, prioritized steps.
   • BRemove the executive summary entirely to make the report shorter.
   • CKeep the report the same length but add more charts and graphs to make it visually appealing.
   • DIncrease the frequency of the report to twice a week to keep stakeholders more engaged.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A threat intelligence team uses a SIEM and a threat intelligence platform (TIP) to collect and correlate data. They need to produce a visual timeline of an attack campaign for a post-incident review. The timeline must show the sequence of attacker actions and the associated IOCs. Which tool or platform feature is most appropriate for this task?

   • AA word processor with a table of events
   • BThe TIP's built-in visualization module that can generate timeline views from correlated events
   • CA spreadsheet application with a manually created bar chart
   • DA network diagramming tool used to draw the attack path manually
   Reveal Solution Discussion Select an answer first