A threat hunter has completed a hunt that confirmed a data breach involving customer data. The legal team requires that the findings be documented in a way that is admissible in court. The hunter must write the report. What is the most important consideration for the report?

Write the report in a way that minimizes the organization's legal liability, even if it omits some details.

Focus only on the technical details and avoid mentioning any human errors or process failures.

Ensure that the report includes a clear chain of custody for all evidence and a detailed timeline of the investigation.

Submit the report verbally to the legal team and keep no written record to avoid discovery.

What is the primary role of threat hunting within an organization's overall security strategy?

To reduce the time between a security incident and its detection by proactively searching for threats

To replace automated security tools such as firewalls and EDR

To patch vulnerabilities before they are exploited by attackers

To generate compliance reports for regulatory audits

A security team wants to reduce the time between an attacker's initial compromise and the team's discovery of that compromise. They plan to implement a threat hunting program. Which primary goal should guide the design of their hunts?

To ensure that all security alerts are automatically resolved without analyst intervention.

To increase the number of alerts generated by the security tools.

To identify unknown threats that evade existing automated detection and shorten the dwell time.

To replace the organization's SIEM and all signature-based detection tools.

After a week-long hunt, a threat hunter has confirmed that a previously unknown backdoor is present on several workstations. The hunter needs to communicate the findings to both technical staff and executive leadership. What is the most effective way to document and report the findings?

Wait until the investigation is completely finished and all affected systems are remediated before reporting anything.

Verbally inform the security manager and let them decide what to share with others.

Provide a single detailed technical report containing all IOCs, log snippets, and analysis, and send it to all stakeholders.

Create a technical report for the incident response team with IOCs and evidence, and a separate executive summary with business impact and recommended actions.

EC-CouncilThreat Intelligence Essentials

Domain 7Objective 2

The Threat Hunting Process TIE Practice Questions (Page 5)

Part of the Threat Hunting and Detection domain, which makes up ~12% of our current practice bank.

46questions here

10free pages

6concepts

Questions 21–25

21foundation · easy
During which phase of the threat hunting process does the hunter determine whether the hypothesis was correct and take appropriate action?
Select an answer first
22expert · hard
A threat hunter has completed a hunt that confirmed a data breach involving customer data. The legal team requires that the findings be documented in a way that is admissible in court. The hunter must write the report. What is the most important consideration for the report?
Select an answer first
23foundation · easy
What is the primary role of threat hunting within an organization's overall security strategy?
Select an answer first
24application · medium
A security team wants to reduce the time between an attacker's initial compromise and the team's discovery of that compromise. They plan to implement a threat hunting program. Which primary goal should guide the design of their hunts?
Select an answer first
25application · medium
After a week-long hunt, a threat hunter has confirmed that a previously unknown backdoor is present on several workstations. The hunter needs to communicate the findings to both technical staff and executive leadership. What is the most effective way to document and report the findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.