Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A threat hunting team is planning a hunt for a newly discovered malware family. They have limited time and need to decide where to focus. Which TIP output is most useful for guiding the hunt?

   • AA dashboard with only high-level charts
   • BA tactical report with IOCs, TTPs, and recommended hunt queries
   • CAn operational report on alert volumes
   • DA strategic report on the malware's business impact
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A threat intelligence team must decide whether to allocate resources to investigate a new threat actor group that has been observed targeting similar organizations. The team has limited resources and must weigh the potential impact against the likelihood of being targeted. The team also needs to justify its decision to management. Which approach best supports this decision and its justification?

   • ADecide based on the threat actor's activity level in the media
   • BConduct a formal risk assessment that scores the likelihood of being targeted and the potential impact, and document the results in a strategic report
   • CDecide based on the number of IOCs available for the threat actor group
   • DDecide to investigate all threat actor groups equally
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security operations team is evaluating whether to integrate TIP visualizations into their SIEM dashboards. The team wants to improve the speed of incident triage, but they are concerned about alert fatigue from too many visualizations. Which approach best balances these concerns?

   • AIntegrate only a single visualization, such as a pie chart of threat types
   • BIntegrate all available TIP visualizations into the SIEM dashboard
   • CDo not integrate any TIP visualizations; rely on raw logs only
   • DIntegrate a limited set of high-value TIP visualizations, such as link analysis for active campaigns, into the SIEM dashboard
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   When prioritizing which vulnerabilities to remediate first, which structured approach is most commonly used to combine the likelihood of exploitation with the potential impact on the organization?

   • ASWOT analysis
   • BRoot cause analysis
   • CCost-benefit analysis
   • DRisk assessment
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A threat intelligence report is intended for SOC analysts who need to know specific indicators of compromise (IOCs) and recommended detection rules. Which type of report is most appropriate?

   • AStrategic report
   • BExecutive summary
   • COperational report
   • DTactical report
   Reveal Solution Discussion Select an answer first