A threat intelligence analyst is investigating a complex attack chain that involves multiple stages: initial phishing, lateral movement, and data exfiltration. The analyst needs to present the findings to both the incident response team and the executive leadership. The presentation must clearly show the sequence of events and the relationships between the attacker's infrastructure and the affected systems. Which combination of visualizations would best serve this dual audience?

A timeline chart for the sequence of events and a link analysis graph for the infrastructure relationships

A pie chart showing the proportion of affected systems by department and a bar chart of alert counts

A single link analysis graph only

A security team is evaluating two potential threat intelligence feeds. Feed X provides high-confidence, low-volume alerts. Feed Y provides low-confidence, high-volume alerts. The team has limited analyst time. Which approach best supports decision-making?

Subscribe to Feed X only, because high confidence is always better

Subscribe to Feed Y only, because more data is always better

Subscribe to both feeds and use the TIP to correlate and prioritize alerts by confidence and impact

Subscribe to neither feed until the team can hire more analysts

A security team has limited resources and must prioritize which of several threat intelligence findings to address first. They have data on likelihood, potential impact, and the cost of mitigation. Which decision-making approach should they use?

Prioritize the threat with the highest likelihood of occurrence

Address threats in the order they were discovered

Use a risk matrix that combines likelihood and impact to rank threats

Prioritize the threat with the highest potential impact

A SOC manager wants to integrate TIP outputs into the daily threat hunting workflow. The team currently uses a ticketing system and a SIEM. Which integration would most directly enable hunters to act on TIP intelligence?

Export TIP reports to a PDF and email them to the team weekly

Store TIP data in a spreadsheet that hunters can access on a shared drive

Print TIP dashboards and post them on the office wall

Automatically create tickets in the ticketing system when the TIP identifies a new high-risk indicator

EC-CouncilThreat Intelligence Essentials

Domain 5Objective 5

Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 4)

Part of the Threat Intelligence Platforms domain, which makes up ~13% of our current practice bank.

40questions here

8free pages

5concepts

Questions 16–20

16expert · hard
A threat intelligence analyst is investigating a complex attack chain that involves multiple stages: initial phishing, lateral movement, and data exfiltration. The analyst needs to present the findings to both the incident response team and the executive leadership. The presentation must clearly show the sequence of events and the relationships between the attacker's infrastructure and the affected systems. Which combination of visualizations would best serve this dual audience?
Select an answer first
17expert · hard
A security team is evaluating two potential threat intelligence feeds. Feed X provides high-confidence, low-volume alerts. Feed Y provides low-confidence, high-volume alerts. The team has limited analyst time. Which approach best supports decision-making?
Select an answer first
18application · medium
A security team has limited resources and must prioritize which of several threat intelligence findings to address first. They have data on likelihood, potential impact, and the cost of mitigation. Which decision-making approach should they use?
Select an answer first
19foundation · easy
Which metric is most appropriate for evaluating the effectiveness of TIP-driven reporting in reducing the time to detect a security incident?
Select an answer first
20application · medium
A SOC manager wants to integrate TIP outputs into the daily threat hunting workflow. The team currently uses a ticketing system and a SIEM. Which integration would most directly enable hunters to act on TIP intelligence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 4)

Questions 16–20

A security team is evaluating two potential threat intelligence feeds. Feed X provides high-confidence, low-volume alerts. Feed Y provides low-confidence, high-volume alerts. The team has limited analyst time. Which approach best supports decision-making?

A security team has limited resources and must prioritize which of several threat intelligence findings to address first. They have data on likelihood, potential impact, and the cost of mitigation. Which decision-making approach should they use?

Which metric is most appropriate for evaluating the effectiveness of TIP-driven reporting in reducing the time to detect a security incident?

A SOC manager wants to integrate TIP outputs into the daily threat hunting workflow. The team currently uses a ticketing system and a SIEM. Which integration would most directly enable hunters to act on TIP intelligence?

Keep studying — Threat Intelligence Platforms