Certified Threat Intelligence Analyst (CTIA)

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Cyber Threats and Attack Frameworks

   Which framework maps adversary tactics and techniques in a matrix that is used to describe observed behaviour?

   1. AISO 27005, which describes the risk management process for information security across the whole organisation over time
   2. BThe Cyber Kill Chain, which describes seven phases of an attack in one linear sequence of stages from start to finish
   3. CMITRE ATT&CK, which maps adversary tactics and techniques in a matrix used to describe observed behaviour
   4. DNIST SP 800-53, which catalogues the security and privacy controls that organisations select and then implement in practice
   Show answer and explanationHide answer

   Correct answer: C

   ATT&CK is a matrix of tactics and techniques used to describe adversary behaviour. The Kill Chain is a linear model with different granularity, while ISO 27005 and NIST SP 800-53 address risk management and controls rather than adversary behaviour.

2. Question 2Data Collection and Processing

   Which collection source gives analysts visibility of attacker discussions and tool trading for early warning?

   1. AThe office printer logs, which show the number of pages each user printed on each day in each of the offices
   2. BThe organisation's payroll system, which records salaries and benefits for each employee in each pay period of the year
   3. CThe company's canteen menu, which lists the meals offered to staff across the business in each week of the year
   4. DOpen and closed forums, chat channels and paste sites that attackers use to trade tools, access and information
   Show answer and explanationHide answer

   Correct answer: D

   Forums, chat channels and paste sites are where attackers trade tools and information, which gives early warning. Payroll, canteen menus and printer logs have no bearing on attacker discussions.

3. Question 3Data Analysis

   Which technique tests competing hypotheses by looking for evidence that disconfirms each one?

   1. ABrainstorming without records, where the team agrees on an answer in a meeting and does not write down the evidence used
   2. BA single-theory approach, where the analyst accepts the first explanation that fits the data and writes the report on it
   3. CAnalysis of competing hypotheses, which weighs the evidence against each hypothesis and focuses on what disconfirms it
   4. DGuesswork based on the analyst's personal intuition, which is reviewed only after the report has already been published
   Show answer and explanationHide answer

   Correct answer: C

   Analysis of competing hypotheses weighs the evidence against each explanation and emphasises what disconfirms it, which reduces the risk of settling early. Single theories, unrecorded brainstorming and intuition do not test the hypotheses against the evidence.

4. Question 4Threat Hunting and SOC Integration

   Which hunting approach starts from a hypothesis about attacker behaviour and then searches the data to test it?

   1. ARandom searching of every log line in the environment, with no particular question in mind for the analysts to answer
   2. BHypothesis-driven hunting, which begins with a testable idea about adversary behaviour and checks the telemetry for evidence
   3. CWaiting for an alert to fire before looking at any data, so that effort is spent only when something has been detected
   4. DReading the vendor's marketing pages each morning, since they describe the attacks that the product is able to detect
   Show answer and explanationHide answer

   Correct answer: B

   Hypothesis-driven hunting tests a specific idea about attacker behaviour against telemetry, which makes results testable. Random searching, alert-only work and reading marketing material do not test a hypothesis.

5. Question 5Threat Intelligence Fundamentals and Planning

   Which phase of the threat intelligence lifecycle turns stakeholder needs into specific questions that guide collection and analysis?

   1. AFeedback, where the team reviews how often each report was opened by its recipients in the reporting tool it uses
   2. BCollection, where raw data is gathered from every source the team can reach across the internet and the internal systems it runs
   3. CDissemination, where finished products are sent to the stakeholders on the distribution list during each reporting cycle
   4. DPlanning and direction, where stakeholder requirements are turned into specific intelligence questions and priorities for the team
   Show answer and explanationHide answer

   Correct answer: D

   Planning and direction capture stakeholder requirements and convert them into questions that guide everything after them. Collection, dissemination and feedback all depend on those questions being defined first.