A threat intelligence analyst needs to provide the head of security operations with a report that supports the weekly prioritization of patching efforts. The report should include the most relevant threat actors, their tactics, and the affected systems. Which report type is most appropriate?

A threat intelligence feed with raw data from multiple sources

A strategic report outlining long-term threat trends and business risks

A tactical report listing raw indicators of compromise (IOCs) and detection rules

An operational report focused on current threats and affected assets

A security manager wants to measure whether the TIP-driven reports are actually improving the speed of incident response. Which KPI is most appropriate?

Number of reports generated per month

Total number of IOCs in the TIP database

Average time from alert to containment (MTTC)

Number of threat intelligence analysts on staff

How do TIP visualizations and reports most directly support incident response activities?

By providing actionable IOCs and context that help responders identify, contain, and eradicate threats faster

By eliminating false positives from all security tools

By automatically remediating vulnerabilities without human intervention

By replacing the need for a SIEM system

A threat intelligence team must present the same intrusion analysis to two audiences: a technical IR team and a board of directors. The IR team needs to identify the attack path, while the board needs to understand the business risk. What is the most effective approach?

Use the same link analysis graph for both audiences

Create a link analysis graph for the IR team and a simplified risk-focused visual for the board

Use a timeline for both audiences

Provide only a written report without visuals

EC-CouncilThreat Intelligence Essentials

Domain 5Objective 5

Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 3)

Part of the Threat Intelligence Platforms domain, which makes up ~13% of our current practice bank.

40questions here

8free pages

5concepts

Questions 11–15

11application · medium
A threat intelligence analyst needs to provide the head of security operations with a report that supports the weekly prioritization of patching efforts. The report should include the most relevant threat actors, their tactics, and the affected systems. Which report type is most appropriate?
Select an answer first
12foundation · easy
Which visualization method is best suited to show the sequence of events in a multi-stage cyber attack, such as initial compromise, lateral movement, and data exfiltration?
Select an answer first
13application · medium
A security manager wants to measure whether the TIP-driven reports are actually improving the speed of incident response. Which KPI is most appropriate?
Select an answer first
14foundation · easy
How do TIP visualizations and reports most directly support incident response activities?
Select an answer first
15expert · hard
A threat intelligence team must present the same intrusion analysis to two audiences: a technical IR team and a board of directors. The IR team needs to identify the attack path, while the board needs to understand the business risk. What is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.