A threat intelligence analyst must produce a report that serves two audiences: the executive board, which needs a high-level risk overview, and the SOC team, which needs actionable indicators and detection guidance. The analyst has limited time and must produce a single report. What is the best approach?

Send a raw intelligence feed to both audiences

Create a single report with an executive summary at the beginning and a technical appendix with IOCs and detection rules

Write a technical report with IOCs and detection rules only

Write a strategic report with business impact analysis only

A threat intelligence analyst is preparing a report on a new ransomware campaign. The report will be read by the executive team, the IT security team, and the legal department. The executive team needs a business impact summary, the IT security team needs technical indicators and mitigation steps, and the legal department needs information about regulatory notification requirements. The analyst must produce a single report. Which structure best meets all three needs?

A single report containing only a timeline of the ransomware campaign

A single technical report with IOCs and mitigation steps only

A single strategic report with business impact and regulatory information only

A report with an executive summary, a technical section with IOCs and mitigations, and a separate section on regulatory and legal considerations

A SOC uses a TIP to generate alerts. The team is overwhelmed by the volume of alerts and is considering using the TIP's visualization and reporting features to reduce alert fatigue. Which approach is most effective?

Disable all alerts except those marked as critical

Use the TIP to correlate alerts and produce a prioritized risk-based report for analysts

Send all alerts directly to the incident response team

Increase the number of visualizations on the SOC dashboard

A threat intelligence analyst must produce a weekly report for a mixed audience of SOC analysts and IT managers. The SOC analysts need technical indicators, while IT managers need a summary of risks and resource implications. What is the best approach?

Send the same executive summary to both groups

Publish a dashboard with only charts and no narrative

Create two separate reports: a tactical report for SOC analysts and a strategic/operational summary for IT managers

Create a single technical report with all IOCs and TTPs

A security operations center (SOC) analyst is investigating a phishing campaign that used a newly registered domain. The analyst needs to quickly show the timeline of when the domain was registered, when the first email was sent, and when the first user clicked the link. Which TIP visualization is most appropriate for this analysis?

A bar chart comparing the number of clicks per hour

A pie chart showing the proportion of emails sent to each department

A link analysis graph connecting the domain to the email server

A timeline chart with events plotted along a time axis

EC-CouncilThreat Intelligence Essentials

Domain 5Objective 5

Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 1)

Part of the Threat Intelligence Platforms domain, which makes up ~13% of our current practice bank.

40questions here

8free pages

5concepts

Questions 1–5

1expert · hard
A threat intelligence analyst must produce a report that serves two audiences: the executive board, which needs a high-level risk overview, and the SOC team, which needs actionable indicators and detection guidance. The analyst has limited time and must produce a single report. What is the best approach?
Select an answer first
2expert · hard
A threat intelligence analyst is preparing a report on a new ransomware campaign. The report will be read by the executive team, the IT security team, and the legal department. The executive team needs a business impact summary, the IT security team needs technical indicators and mitigation steps, and the legal department needs information about regulatory notification requirements. The analyst must produce a single report. Which structure best meets all three needs?
Select an answer first
3expert · hard
A SOC uses a TIP to generate alerts. The team is overwhelmed by the volume of alerts and is considering using the TIP's visualization and reporting features to reduce alert fatigue. Which approach is most effective?
Select an answer first
4application · medium
A threat intelligence analyst must produce a weekly report for a mixed audience of SOC analysts and IT managers. The SOC analysts need technical indicators, while IT managers need a summary of risks and resource implications. What is the best approach?
Select an answer first
5application · medium
A security operations center (SOC) analyst is investigating a phishing campaign that used a newly registered domain. The analyst needs to quickly show the timeline of when the domain was registered, when the first email was sent, and when the first user clicked the link. Which TIP visualization is most appropriate for this analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 1)

Questions 1–5

A SOC uses a TIP to generate alerts. The team is overwhelmed by the volume of alerts and is considering using the TIP's visualization and reporting features to reduce alert fatigue. Which approach is most effective?

A threat intelligence analyst must produce a weekly report for a mixed audience of SOC analysts and IT managers. The SOC analysts need technical indicators, while IT managers need a summary of risks and resource implications. What is the best approach?

Keep studying — Threat Intelligence Platforms