A security operations center is considering adding a TIP visualization that shows the geographic origin of incoming attacks on a live map. The SOC manager wants to use this visualization to improve situational awareness, but the team is concerned that the map may distract analysts from more critical tasks. Which approach best addresses this concern?

Remove all other visualizations and rely solely on the geographic map

Integrate the map into the main alert queue so analysts see it constantly

Disable the map entirely to avoid any distraction

Place the geographic map on a separate monitoring screen that is not part of the primary alert triage workflow

During a threat hunting investigation, an analyst needs to quickly see which of several malware families share common command-and-control (C2) infrastructure. Which TIP visualization is best suited?

A pie chart of malware family proportions

A bar chart of malware family counts

A link analysis graph connecting malware families to C2 domains

A threat intelligence team must deliver a report to a technical incident response team that will use it to contain an active ransomware campaign. Which report format and content is most appropriate?

An operational report summarizing weekly alert volumes and trends

A strategic report with high-level risk ratings and business recommendations

A tactical report with indicators of compromise (IOCs), TTPs, and recommended containment actions

A visual dashboard with only charts and no textual recommendations

A threat intelligence team must produce a report on a new advanced persistent threat (APT) group. The report will be used by both the SOC for detection and the executive team for risk acceptance. Which reporting strategy best satisfies both audiences?

A single operational report with weekly metrics

A single strategic report with business impact analysis

A single tactical report with IOCs and TTPs

A tactical report for the SOC and a strategic summary for the executive team

EC-CouncilThreat Intelligence Essentials

Domain 5Objective 5

Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 7)

Part of the Threat Intelligence Platforms domain, which makes up ~13% of our current practice bank.

40questions here

8free pages

5concepts

Questions 31–35

31expert · hard
A security operations center is considering adding a TIP visualization that shows the geographic origin of incoming attacks on a live map. The SOC manager wants to use this visualization to improve situational awareness, but the team is concerned that the map may distract analysts from more critical tasks. Which approach best addresses this concern?
Select an answer first
32application · medium
During a threat hunting investigation, an analyst needs to quickly see which of several malware families share common command-and-control (C2) infrastructure. Which TIP visualization is best suited?
Select an answer first
33foundation · easy
A threat intelligence analyst needs to visually represent the relationships between malicious domains, IP addresses, and malware families to identify shared infrastructure. Which visualization technique is most appropriate for this purpose?
Select an answer first
34application · medium
A threat intelligence team must deliver a report to a technical incident response team that will use it to contain an active ransomware campaign. Which report format and content is most appropriate?
Select an answer first
35expert · hard
A threat intelligence team must produce a report on a new advanced persistent threat (APT) group. The report will be used by both the SOC for detection and the executive team for risk acceptance. Which reporting strategy best satisfies both audiences?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 7)

Questions 31–35

During a threat hunting investigation, an analyst needs to quickly see which of several malware families share common command-and-control (C2) infrastructure. Which TIP visualization is best suited?

A threat intelligence analyst needs to visually represent the relationships between malicious domains, IP addresses, and malware families to identify shared infrastructure. Which visualization technique is most appropriate for this purpose?

A threat intelligence team must deliver a report to a technical incident response team that will use it to contain an active ransomware campaign. Which report format and content is most appropriate?

A threat intelligence team must produce a report on a new advanced persistent threat (APT) group. The report will be used by both the SOC for detection and the executive team for risk acceptance. Which reporting strategy best satisfies both audiences?

Keep studying — Threat Intelligence Platforms