Reporting, Communicating, and Visualizing Findings TIE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A threat intelligence team uses an open-source SIEM and a separate open-source visualization platform. They need to create a real-time dashboard that combines SIEM alerts with threat intelligence feeds to show current attack patterns. The team has limited budget and prefers open-source tools. What is the most appropriate approach?

   • AExport SIEM alerts to a CSV file and manually upload them to the visualization platform hourly.
   • BUse a commercial BI tool that requires a paid license, exceeding the budget.
   • CBuild a custom dashboard from scratch using a programming language and a database, without using the visualization platform.
   • DUse the visualization platform's built-in connectors to ingest SIEM alerts and threat feeds, and build the dashboard with its query language.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which principle is most important for clear and effective communication of threat intelligence findings?

   • AProviding actionable and relevant information tailored to the audience
   • BUsing highly technical jargon to demonstrate expertise
   • CIncluding every possible detail to ensure completeness
   • DPresenting findings without context to avoid bias
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A threat intelligence team is analyzing a large dataset of malware samples and wants to visualize the similarities between the samples based on their behavioral characteristics. The goal is to identify clusters of related malware families. Which visualization technique is most appropriate?

   • AA bar chart showing the top 10 most common behavioral features across all samples.
   • BA heat map with hierarchical clustering, where rows and columns are malware samples and colors represent similarity scores.
   • CA pie chart showing the proportion of samples that are trojans, worms, and ransomware.
   • DA line chart showing the number of samples discovered over time.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An analyst is using a threat intelligence platform (TIP) that supports exporting data in various formats. The analyst needs to create a visual representation of the relationships between threat actors and the campaigns they are known to run. The TIP has a built-in visualization feature, but the analyst also has access to external tools. Which approach is most efficient and effective?

   • ACreate a simple table in a word processor listing actors and campaigns, without any graphical representation.
   • BUse the TIP's built-in graph visualization feature to generate the relationship diagram directly from the data.
   • CExport the data to a CSV file and manually create a diagram in a generic drawing tool.
   • DPrint the raw data and manually draw the relationships on paper for a meeting.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A threat intelligence analyst is preparing a report on a newly identified advanced persistent threat (APT) group. The report will be shared with both the SOC team and the IT operations team. The SOC team needs detailed TTPs and IOCs, while IT operations needs to understand the impact on infrastructure and patching priorities. What is the most appropriate report structure?

   • AA single report that only contains the executive summary and a list of IOCs, to keep it concise.
   • BTwo completely separate reports with no overlap, one for SOC and one for IT operations, to avoid confusion.
   • CA report that is primarily a collection of raw data, such as logs and malware samples, without any analysis or structure.
   • DA single report with an executive summary, a technical analysis section with TTPs and IOCs, and a separate section on infrastructure impact and recommended actions.
   Reveal Solution Discussion Select an answer first