Which of the following is a common method for sharing threat intelligence with external stakeholders during an incident?

Keeping all intelligence confidential and not sharing with anyone

Emailing all customers with full technical details of the incident

Posting sensitive incident details on public social media

Publishing indicators of compromise (IOCs) to a trusted information sharing and analysis center (ISAC)

An organization is responding to a worm that spreads via a specific SMB vulnerability. Threat intelligence indicates that the worm has a self-propagating mechanism and can spread quickly. The incident response team needs to contain the worm, but the organization cannot afford to take all systems offline. Which containment strategy best balances the need to stop the spread with operational continuity?

Allow the worm to run its course, as it will eventually die out.

Disconnect the entire network from the internet and shut down all servers to stop the worm.

Only patch the most critical servers and leave the rest unpatched to save time.

Segment the network into smaller zones, block SMB traffic between zones, and apply a virtual patch to all systems to mitigate the vulnerability.

A SOC receives an alert for a login from an IP address that is listed in a threat intelligence feed as a known proxy used by a specific APT group. However, the login is from a legitimate user and the IP is also used by a major cloud provider. The analyst must decide whether to escalate. What is the most appropriate action?

Block the IP address immediately to prevent potential compromise.

Escalate the alert for further investigation, considering the context of the user's behavior and the IP's dual use.

Disable the user's account to prevent unauthorized access.

Ignore the alert because the IP is used by a legitimate cloud provider.

A company has confirmed a malware infection that uses a specific command-and-control (C2) domain. The incident response team needs to contain the threat while preserving evidence. Which containment action is most directly informed by threat intelligence?

Power off all servers in the data center immediately.

Wait for the malware to spread to understand its full behavior.

Disconnect the internet connection for the entire company.

Block the C2 domain at the firewall and isolate affected hosts from the network.

During which phase of the incident response lifecycle does threat intelligence primarily help responders understand the adversary's tactics, techniques, and procedures (TTPs) to guide the investigation?

Containment, Eradication, and Recovery

EC-CouncilThreat Intelligence Essentials

Domain 8Objective 5

Threat Intelligence in Incident Response TIE Practice Questions (Page 3)

Part of the Sharing, Collaboration, and Incident Response domain, which makes up ~13% of our current practice bank.

53questions here

11free pages

8concepts

8 Concepts in This Objective

Role of threat intelligence in incident response
Integrating threat intelligence into incident response processes
Using threat intelligence for incident detection and triage
Threat intelligence in incident analysis and investigation
Threat intelligence for containment and eradication
Threat intelligence in recovery and post-incident activities
Sharing threat intelligence during incident response
Challenges and best practices in using threat intelligence for incident response

Questions 11–15

11foundation · easy
Which of the following is a common method for sharing threat intelligence with external stakeholders during an incident?
Select an answer first
12expert · hard
An organization is responding to a worm that spreads via a specific SMB vulnerability. Threat intelligence indicates that the worm has a self-propagating mechanism and can spread quickly. The incident response team needs to contain the worm, but the organization cannot afford to take all systems offline. Which containment strategy best balances the need to stop the spread with operational continuity?
Select an answer first
13expert · hard
A SOC receives an alert for a login from an IP address that is listed in a threat intelligence feed as a known proxy used by a specific APT group. However, the login is from a legitimate user and the IP is also used by a major cloud provider. The analyst must decide whether to escalate. What is the most appropriate action?
Select an answer first
14application · medium
A company has confirmed a malware infection that uses a specific command-and-control (C2) domain. The incident response team needs to contain the threat while preserving evidence. Which containment action is most directly informed by threat intelligence?
Select an answer first
15foundation · easy
During which phase of the incident response lifecycle does threat intelligence primarily help responders understand the adversary's tactics, techniques, and procedures (TTPs) to guide the investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Threat Intelligence in Incident Response TIE Practice Questions (Page 3)

Questions 11–15

Which of the following is a common method for sharing threat intelligence with external stakeholders during an incident?

A company has confirmed a malware infection that uses a specific command-and-control (C2) domain. The incident response team needs to contain the threat while preserving evidence. Which containment action is most directly informed by threat intelligence?

During which phase of the incident response lifecycle does threat intelligence primarily help responders understand the adversary's tactics, techniques, and procedures (TTPs) to guide the investigation?

Keep studying — Sharing, Collaboration, and Incident Response