Exam 312-85 topic 1 question 85 discussion

Actual exam question from ECCouncil's 312-85

Question #: 85
Topic #: 1

An organization, namely, Highlander, Inc., decided to integrate threat intelligence into the incident response process for rapid detection and recovery from various security incidents.

In which of the following phases of the incident response management does the organization utilize operational and tactical threat intelligence to provide context to the alerts generated by various security mechanisms?

A. Phase 2: event
B. Phase 1: preplanning
C. Phase 3: incident
D. Phase 4: breach

Show Suggested Answer

Suggested Answer: C 🗳️

by Esste at Nov. 17, 2024, 3 p.m.

Comments

Submit Cancel

DTsg

4 days, 6 hours ago

Selected Answer: C

Module 01 Page 2 Many organizations use threat intelligence to enhance areas such as network security, incident response, and risk management. Threat intelligence helps enterprise security teams to enhance, implement, and manage various security controls to protect their IT assets from emerging threats.

upvoted 1 times

DTsg

2 days, 12 hours ago

Sorry, it's EVENT Module 01 Page 46 Phase 2: Event Operational and "tactical threat intelligence" helps to provide context to alerts generated by an organization’s security mechanisms such as SIEM, SOC, or other security tools

upvoted 1 times

...

thamior666

2 months, 4 weeks ago

Selected Answer: A

Event (Detection & Analysis) → Alerts are generated by SIEM/EDR/IDS → analysts validate & enrich with tactical & operational TI (IOCs, TTPs, context).

upvoted 1 times

...

Esste

1 year ago

Selected Answer: B

upvoted 1 times

...