A multinational company is responding to a ransomware incident that affects operations in multiple regions. The incident response team has identified the ransomware family and its C2 infrastructure. They want to share intelligence with external partners but are concerned about legal and privacy implications. What is the best approach?

Share intelligence only with law enforcement and no other partners.

Share the full incident report publicly, including all technical details.

Share IOCs and TTPs with trusted partners through an ISAC, while redacting any personal data and following applicable data protection laws.

Refuse to share any intelligence to avoid legal liability.

During an incident investigation, the response team discovers a suspicious file on a compromised host. They want to determine if this file is related to a known threat actor and understand the potential scope of the attack. Which action would best utilize threat intelligence to enrich the investigation?

Submit the file's hash to a public malware analysis sandbox and a threat intelligence platform to check for known associations and behavioral reports.

Run a full antivirus scan on the host and assume the file is benign if the scan does not detect it.

Delete the file immediately to prevent further infection, then continue monitoring the network for other anomalies.

Compare the file's hash only against the organization's internal allowlist of approved software.

What is a common challenge when using threat intelligence in incident response?

Threat intelligence is only useful for large enterprises

Threat intelligence eliminates the need for human analysis

The volume of intelligence can lead to alert fatigue and difficulty prioritizing true threats

Threat intelligence is always accurate and up-to-date

EC-CouncilThreat Intelligence Essentials

Domain 8Objective 5

Threat Intelligence in Incident Response TIE Practice Questions (Page 11)

Part of the Sharing, Collaboration, and Incident Response domain, which makes up ~13% of our current practice bank.

53questions here

11free pages

8concepts

8 Concepts in This Objective

Role of threat intelligence in incident response
Integrating threat intelligence into incident response processes
Using threat intelligence for incident detection and triage
Threat intelligence in incident analysis and investigation
Threat intelligence for containment and eradication
Threat intelligence in recovery and post-incident activities
Sharing threat intelligence during incident response
Challenges and best practices in using threat intelligence for incident response

Questions 51–53

51expert · hard
A multinational company is responding to a ransomware incident that affects operations in multiple regions. The incident response team has identified the ransomware family and its C2 infrastructure. They want to share intelligence with external partners but are concerned about legal and privacy implications. What is the best approach?
Select an answer first
52application · medium
During an incident investigation, the response team discovers a suspicious file on a compromised host. They want to determine if this file is related to a known threat actor and understand the potential scope of the attack. Which action would best utilize threat intelligence to enrich the investigation?
Select an answer first
53foundation · easy
What is a common challenge when using threat intelligence in incident response?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Threat Intelligence in Incident Response TIE Practice Questions (Page 11)

Questions 51–53

What is a common challenge when using threat intelligence in incident response?

Keep studying — Sharing, Collaboration, and Incident Response