Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which report type is most appropriate for a CISO who needs to understand the overall threat landscape and its potential business impact to justify security investments?

   • AThreat hunting report
   • BIncident response report
   • CTactical report
   • DStrategic report
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat intelligence analyst has identified a new malware family targeting the organization's finance team. The analyst must brief the Chief Financial Officer (CFO) on the potential business impact and the recommended budget for additional security controls. Which report format is most appropriate for this audience?

   • AAn operational report with step-by-step incident response procedures
   • BA strategic report with high-level risk summaries and business impact analysis
   • CA tactical report with detailed indicators of compromise (IOCs) and detection rules
   • DA raw intelligence feed with all technical indicators and raw logs
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat intelligence team wants to measure whether the TIP's reports are actually helping the incident response team reduce response time. Which key performance indicator (KPI) would best capture this impact?

   • ANumber of TIP reports generated per month
   • BNumber of analysts with access to the TIP
   • CAverage time from initial alert to containment for incidents that used TIP reports
   • DPercentage of TIP data sources that are updated daily
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is deciding whether to block a newly discovered malicious domain. The domain is associated with a low-likelihood phishing campaign, but blocking it could disrupt a legitimate business service that shares the same infrastructure. What should the team do?

   • ABlock the domain immediately to eliminate the threat
   • BConduct a risk assessment weighing the threat likelihood against the business impact of blocking
   • CIgnore the threat because the likelihood is low
   • DBlock the domain only during business hours
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team wants to evaluate whether the TIP's reporting is helping reduce the number of recurring incidents. Which KPI is most appropriate?

   • AAverage severity of all incidents
   • BNumber of reports distributed per week
   • CNumber of analysts subscribed to the TIP
   • DPercentage of incidents that are repeat or recurring
   Reveal Solution Discussion Select an answer first