The Threat Hunting Process TIE Practice Questions (Page 10)

Questions 46–46

1. 46application · medium

   After completing a threat hunt that confirmed the presence of a previously undetected backdoor on several servers, a threat hunter must report the findings to both the IT operations team and the executive leadership. What is the most appropriate way to document and communicate the results?

   • AOnly document the findings in the SIEM as a note and let each team access it as needed.
   • BCreate a detailed technical report for IT operations with IOCs and remediation steps, and a separate executive summary highlighting business impact, risk, and recommended actions.
   • CSend a single technical report with all IOCs, log excerpts, and forensic details to both teams.
   • DVerbally inform the IT operations team and send a short email to executives with no written documentation.
   Reveal Solution Discussion Select an answer first