CertArea
All EC-Council exams

Free Certified Threat Intelligence Analyst (CTIA) practice test: 30 questions with answers

30 original questions for Certified Threat Intelligence Analyst (CTIA), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Certified Threat Intelligence Analyst (CTIA) exam guide: topics, cost and format

All 30 Certified Threat Intelligence Analyst (CTIA) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Cyber Threats and Attack Frameworks (5 questions)

  1. Question 1

    Which framework maps adversary tactics and techniques in a matrix that is used to describe observed behaviour?

    1. AISO 27005, which describes the risk management process for information security across the whole organisation over time
    2. BThe Cyber Kill Chain, which describes seven phases of an attack in one linear sequence of stages from start to finish
    3. CMITRE ATT&CK, which maps adversary tactics and techniques in a matrix used to describe observed behaviour
    4. DNIST SP 800-53, which catalogues the security and privacy controls that organisations select and then implement in practice
    Show answer and explanation
    Correct answer: C

    ATT&CK is a matrix of tactics and techniques used to describe adversary behaviour. The Kill Chain is a linear model with different granularity, while ISO 27005 and NIST SP 800-53 address risk management and controls rather than adversary behaviour.

  2. Question 2

    In the Diamond Model of intrusion analysis, what does the adversary element represent?

    1. AThe victim organisation that was targeted, whose assets and networks were affected by the intrusion event during the campaign
    2. BThe actor or group responsible for an intrusion, which is linked to the victim, the infrastructure and the capability used
    3. CThe software tool that was used to carry out the intrusion on each target system during the course of the campaign
    4. DThe internet infrastructure, such as the domains and servers used, to host the command components of the attack
    Show answer and explanation
    Correct answer: B

    The adversary vertex is the actor behind an intrusion, connected to the victim, infrastructure and capability vertices. The victim, tool and infrastructure are the other vertices, so only the first option describes the adversary.

  3. Question 3

    Which term describes an attacker's techniques for keeping access across restarts and changes to credentials?

    1. AReconnaissance, which describes the information gathering that the attacker performs before the first compromise is made
    2. BPersistence, which describes methods that let the attacker keep access across restarts and changes to credentials
    3. CExfiltration, which describes the transfer of data out of the network after the attacker has gathered the data it wanted
    4. DImpact, which describes actions that disrupt or destroy systems or data after the attacker has achieved the goals of the attack
    Show answer and explanation
    Correct answer: B

    Persistence covers techniques that keep an attacker's foothold across restarts and credential changes. The other terms describe earlier or later stages of the attack and do not cover keeping access.

  4. Question 4

    Which activity is an example of lateral movement?

    1. AEncrypting files on the local disk of the compromised workstation after the attacker has finished exploring the network fully
    2. BScanning the public internet for exposed services before any access to the target network has been gained by the attacker
    3. CSending a phishing email to a list of staff to obtain their first set of credentials for the corporate network at the start
    4. DUsing stolen credentials to sign in to another server on the network from a workstation the attacker has already compromised
    Show answer and explanation
    Correct answer: D

    Lateral movement is moving from one compromised system to others inside the network, which the stolen-credential login does. Scanning from outside, initial phishing and local encryption are different stages of the attack.

  5. Question 5

    Which two behaviours are typical indicators of credential abuse? (Choose two.)

    1. AA user account signing in from two distant locations within a short period that is too brief for real travel
    2. BA service account used interactively from a workstation at unusual hours, for a sustained period of time
    3. CA user changing their password once a year on the official schedule that the security policy sets for the business
    4. DA process reading the browser's cache folder during the normal working day, as part of routine activity by the user
    5. EA scheduled backup job using its service account at its usual time each night, as it always has done in the past
    Show answer and explanation
    Correct answer: A, B

    Impossible travel and interactive use of a service account are classic credential abuse signals. A yearly password change, routine cache access and a scheduled backup are normal activity.

Data Collection and Processing (5 questions)

  1. Question 6

    Which collection source gives analysts visibility of attacker discussions and tool trading for early warning?

    1. AThe office printer logs, which show the number of pages each user printed on each day in each of the offices
    2. BThe organisation's payroll system, which records salaries and benefits for each employee in each pay period of the year
    3. CThe company's canteen menu, which lists the meals offered to staff across the business in each week of the year
    4. DOpen and closed forums, chat channels and paste sites that attackers use to trade tools, access and information
    Show answer and explanation
    Correct answer: D

    Forums, chat channels and paste sites are where attackers trade tools and information, which gives early warning. Payroll, canteen menus and printer logs have no bearing on attacker discussions.

  2. Question 7

    What is the main risk of collecting intelligence from closed sources without a clear legal basis?

    1. ALegal and ethical exposure, such as breaching terms of service or privacy law, which can undermine the whole programme
    2. BThe intelligence becomes more accurate, since closed sources are always more reliable than the open sources that the team uses
    3. CThe analysts must work faster, since closed sources are always updated every second of the day by their operators
    4. DVendor support becomes unnecessary, since the closed sources include all of the vendor's own support content in full
    Show answer and explanation
    Correct answer: A

    Collecting without a legal basis can breach terms of service or privacy law, which can expose the organisation and damage the programme. The other options describe accuracy or speed claims that do not follow from the source being closed.

  3. Question 8

    Which practice improves the reliability of information gathered from open sources?

    1. AAccepting the first article found in a search, since search engines rank the most reliable results at the top of the list
    2. BCross-checking each claim against several independent sources, and recording the source and date of each item
    3. CUsing the most popular social media post as the main source, since its popularity suggests that its content is correct
    4. DKeeping the source's name off the record so that the report is shorter and easier to read for busy leaders in the business
    Show answer and explanation
    Correct answer: B

    Independent corroboration with recorded sources and dates is what makes open-source information reliable. Taking the first result, popularity and anonymous sourcing all remove the checks that reliability needs.

  4. Question 9

    Which processing step converts raw collected data into a consistent format that analysts can work with?

    1. ANormalisation, which maps fields from different sources into a common schema with consistent names and values
    2. BCompression, which reduces the size of each file on disk by removing the redundant data held within the stored files
    3. CEncryption, which protects the data from being read by unauthorised parties while it is held in storage on the system
    4. DPrinting, which creates paper copies of the data for the analysts to review by hand at their desks each day of the week
    Show answer and explanation
    Correct answer: A

    Normalisation maps fields from different sources into one schema so that they can be compared and analysed together. Compression, encryption and printing do not make disparate data consistent.

  5. Question 10

    Which two practices make a collection programme defensible? (Choose two.)

    1. ADocumenting the source of each item, its collection date and the method used to obtain it, for later review
    2. BCollecting only the data needed for the stated intelligence requirement, and keeping it only as long as policy allows
    3. CCollecting every personal detail available about each person, so that analysts have as much context as they could want
    4. DUsing accounts that impersonate employees of other companies to gain access to closed forums and private groups
    5. EKeeping collected material in a shared folder that every employee can read, to make it easier for analysts to work together
    Show answer and explanation
    Correct answer: A, B

    Source documentation and data minimisation with retention limits make collection auditable and proportionate. Excess personal data, impersonation and open internal sharing each create legal or ethical exposure.

Data Analysis (5 questions)

  1. Question 11

    Which technique tests competing hypotheses by looking for evidence that disconfirms each one?

    1. ABrainstorming without records, where the team agrees on an answer in a meeting and does not write down the evidence used
    2. BA single-theory approach, where the analyst accepts the first explanation that fits the data and writes the report on it
    3. CAnalysis of competing hypotheses, which weighs the evidence against each hypothesis and focuses on what disconfirms it
    4. DGuesswork based on the analyst's personal intuition, which is reviewed only after the report has already been published
    Show answer and explanation
    Correct answer: C

    Analysis of competing hypotheses weighs the evidence against each explanation and emphasises what disconfirms it, which reduces the risk of settling early. Single theories, unrecorded brainstorming and intuition do not test the hypotheses against the evidence.

  2. Question 12

    Which bias describes an analyst continuing to favour a theory after new evidence has contradicted it?

    1. ARecency bias only, the tendency to recall events that happened on the most recent working day of the month or quarter
    2. BSurvivorship bias, the tendency to focus on the cases that remain visible after others were removed from the data set
    3. CConfirmation bias, the tendency to seek and weigh evidence in ways that support an existing belief about the situation
    4. DSampling noise, which is the random variation in the data that appears when the sample size is too small to be reliable
    Show answer and explanation
    Correct answer: C

    Confirmation bias leads analysts to favour evidence that supports an existing view and discount contrary evidence. Survivorship, recency and sampling noise are different issues and do not describe continued support for a theory despite contrary evidence.

  3. Question 13

    Which confidence statement follows best practice in an intelligence assessment?

    1. AWe assess with moderate confidence that the group will target the sector within 90 days, based on two independent reports
    2. BIt is certain that the group will attack the company next week, because the analyst has a good feeling about the team
    3. CThe group might do something at some point, and no one can ever know what the attackers will do in the future
    4. DThe assessment is absolutely true, so no caveats or confidence levels are needed for the leaders who read the report
    Show answer and explanation
    Correct answer: A

    A calibrated statement with a confidence level, a time frame and the basis for it is what decision-makers need. Certainty, vague wording and denial of uncertainty each hide the real strength of the evidence.

  4. Question 14

    Which technique helps an analyst link indicators to one campaign across several incidents?

    1. AClustering shared infrastructure, such as domains, certificates and hosting addresses, to group related activity together
    2. BSorting all incidents alphabetically by the name of the employee who reported each one during the reporting period
    3. CRanking each incident by the length of the description that the reporting analyst wrote for it in the case system
    4. DCounting the number of emails each analyst sent to the team in each week of the month for the team's records
    Show answer and explanation
    Correct answer: A

    Clustering on shared infrastructure such as domains, certificates and hosting reveals activity that belongs to one campaign. Alphabetical sorting, description length and email counts do not link indicators to a campaign.

  5. Question 15

    Which two outputs strengthen an analytic product? (Choose two.)

    1. AA clear statement of key judgements, with the confidence level and the main assumptions stated alongside them
    2. BA list of every raw data field in the database, included as an appendix so that the reader can browse it in full
    3. CSource tags that show how each claim was supported, so that readers can trace every claim back to its evidence
    4. DLong technical jargon throughout the report, so that it looks more expert to the readers across the business units
    5. EA cover page with a colour scheme that matches the organisation's marketing deck for the year that is being published
    Show answer and explanation
    Correct answer: A, C

    Stated judgements with confidence and assumptions, and traceable sourcing, let decision-makers judge the product. Raw field dumps, jargon and cover styling do not improve the analysis.

Threat Hunting and SOC Integration (5 questions)

  1. Question 16

    Which hunting approach starts from a hypothesis about attacker behaviour and then searches the data to test it?

    1. ARandom searching of every log line in the environment, with no particular question in mind for the analysts to answer
    2. BHypothesis-driven hunting, which begins with a testable idea about adversary behaviour and checks the telemetry for evidence
    3. CWaiting for an alert to fire before looking at any data, so that effort is spent only when something has been detected
    4. DReading the vendor's marketing pages each morning, since they describe the attacks that the product is able to detect
    Show answer and explanation
    Correct answer: B

    Hypothesis-driven hunting tests a specific idea about attacker behaviour against telemetry, which makes results testable. Random searching, alert-only work and reading marketing material do not test a hypothesis.

  2. Question 17

    Which data source is most useful for hunting command-and-control beaconing?

    1. AThe office calendar, which lists the meetings that staff attend each day, together with the times of those meetings
    2. BNetwork flow and DNS logs, which show connections and lookups that repeat at regular intervals over time
    3. CThe printer queue, which records the documents waiting to be printed by each user in each of the offices on the site
    4. DThe cafeteria's point-of-sale data, which records the meals bought by staff at the company's own canteen each day of the week
    Show answer and explanation
    Correct answer: B

    Flow and DNS logs record the connections and lookups that beaconing repeats at regular intervals. Calendars, print queues and canteen sales have no bearing on command-and-control traffic.

  3. Question 18

    How does threat intelligence support detection engineering in a SOC?

    1. ABy removing the need for the SOC to monitor logs, since the intelligence team will report every incident that matters to the business
    2. BBy replacing the SOC's detection rules with a single vendor feed that is never tested against the environment before it is used
    3. CBy supplying indicators and techniques that are turned into detection rules, which are then tested and tuned in the environment
    4. DBy publishing the analysts' personal notes on the SOC's internal wiki for the staff to read on a daily basis as the work goes on
    Show answer and explanation
    Correct answer: C

    Intelligence provides indicators and techniques that become detection logic, which must then be tested and tuned. Replacing rules with an untested feed, dropping log monitoring and publishing personal notes each fail the purpose.

  4. Question 19

    Which step turns a threat intelligence indicator into a useful SOC action?

    1. ASending the indicator to the marketing team, which decides which of the company's customers should receive a warning about it
    2. BBlocking every indicator the moment it appears in a feed, without checking whether it matches the organisation's own traffic
    3. CFiling the indicator in a spreadsheet and deciding later whether it matters, once the spreadsheet has grown large enough
    4. DTesting the indicator against historical logs, deciding on the action to take, and tracking the outcome in the case system
    Show answer and explanation
    Correct answer: D

    Testing against history, choosing an action and tracking the result turns an indicator into a SOC action that is measurable. Blind blocking, deferred filing and marketing decisions each skip the validation and the accountability.

  5. Question 20

    Which two actions help a SOC integrate intelligence into incident response? (Choose two.)

    1. AEnriching alerts with the relevant intelligence context, so that analysts can see the attacker's known techniques and infrastructure
    2. BWaiting for the incident to close before any intelligence is shared with the response team, to keep the work simple
    3. CKeeping the intelligence in a separate tool that the response team is not permitted to access during an active incident at all
    4. DIgnoring intelligence that does not match the current incident, even when it may reveal related activity elsewhere in the estate
    5. EUpdating detections after each incident with the indicators and techniques that were observed in the case
    Show answer and explanation
    Correct answer: A, E

    Enrichment gives responders context, and feeding observed indicators and techniques back into detections closes the loop. Delaying, isolating and ignoring intelligence all slow or weaken the response.

Threat Intelligence Fundamentals and Planning (5 questions)

  1. Question 21

    Which phase of the threat intelligence lifecycle turns stakeholder needs into specific questions that guide collection and analysis?

    1. AFeedback, where the team reviews how often each report was opened by its recipients in the reporting tool it uses
    2. BCollection, where raw data is gathered from every source the team can reach across the internet and the internal systems it runs
    3. CDissemination, where finished products are sent to the stakeholders on the distribution list during each reporting cycle
    4. DPlanning and direction, where stakeholder requirements are turned into specific intelligence questions and priorities for the team
    Show answer and explanation
    Correct answer: D

    Planning and direction capture stakeholder requirements and convert them into questions that guide everything after them. Collection, dissemination and feedback all depend on those questions being defined first.

  2. Question 22

    What distinguishes strategic threat intelligence from tactical threat intelligence?

    1. AStrategic intelligence is produced only by government agencies, while tactical intelligence is produced only by private security companies in the market
    2. BStrategic intelligence lists individual malware hashes for analysts to block, while tactical intelligence summarises the annual budget plans of the sector
    3. CStrategic intelligence informs leaders about long-term risks and trends, while tactical intelligence describes the tools, techniques and procedures that attackers use
    4. DStrategic intelligence is always automated by software, while tactical intelligence must be written by hand by an analyst on each occasion
    Show answer and explanation
    Correct answer: C

    Strategic intelligence serves leaders with risk and trend assessments, and tactical intelligence describes attacker methods used by defenders and responders. The other options assign the wrong content or the wrong producers to each level.

  3. Question 23

    Which type of indicator is the most perishable, and therefore most useful for short-term blocking?

    1. AThe attacker's typical targeting of an industry sector, which is documented in strategic reports for leaders at each annual review
    2. BA description of the attacker's motivations, which changes slowly over the years as the group's strategy evolves in response
    3. CAn IP address or file hash, which attackers can change quickly, making it best suited to near-term detection and blocking
    4. DThe general tactics of a threat group, which are described in frameworks that rarely change over time for the analysts who use them
    Show answer and explanation
    Correct answer: C

    IP addresses and hashes are cheap for an attacker to change, so they are useful for quick blocking but decay fast. Motives, sector targeting and tactics change more slowly and suit longer-term analysis.

  4. Question 24

    Which two qualities make a threat intelligence feed suitable for an organisation? (Choose two.)

    1. AIts indicators are relevant to the organisation's sector, technologies and geography, so they match what it runs
    2. BEach indicator carries age, confidence and source information, so that analysts can prioritise and judge what they receive
    3. CIndicators are published with no context, age or confidence rating, so that each one must be decided on by the analyst alone
    4. DThe feed is updated only once a year, which keeps the indicator list stable for the team's planning over the years
    5. EThe feed is accepted without any evaluation of its accuracy, since the vendor is well known in the market already
    Show answer and explanation
    Correct answer: A, B

    Relevance to the organisation, and context such as age, confidence and source, let analysts prioritise and act on indicators. Feeds without context, annual updates or any accuracy evaluation give analysts little reason to trust or use them.

  5. Question 25

    Which type of requirement describes the intelligence needed to guide a long-term investment in defences?

    1. AOperational requirements, which describe the staffing rota for the monitoring team across the day and the night shifts
    2. BTactical requirements, which describe the attacker tools that the security staff must block on each network during the week
    3. CStrategic requirements, which inform long-range decisions on investment, policy and the organisation's risk appetite
    4. DTechnical requirements, which list the firewall rules needed for a single application that runs in the production environment
    Show answer and explanation
    Correct answer: C

    Strategic requirements support long-range decisions on investment and policy. Tactical, operational and technical requirements address shorter horizons or narrower issues and do not guide long-term investment.

Intelligence Reporting and Dissemination (5 questions)

  1. Question 26

    Which element should lead an intelligence report written for executives?

    1. AA bottom-line summary with the key judgement, its confidence level, and the decision that it supports
    2. BA full table of every indicator collected during the month, listed by timestamp and by the initials of each analyst
    3. CA quote from the search engine's first result, which is used as the opening statement of the report on each occasion
    4. DThe analyst's personal history at the company, with the years of service and the training courses completed by the analyst
    Show answer and explanation
    Correct answer: A

    Executives need the judgement, its confidence and the decision it supports first. Raw indicator tables, search quotes and personal histories do not help the reader decide.

  2. Question 27

    What is the purpose of a tailored product for a SOC audience?

    1. ATo publish the complete intelligence database so that the SOC staff can browse it at their own pace during the day
    2. BTo explain the company's long-term business strategy so that the SOC staff can comment on it in the annual review
    3. CTo list the names of the people who wrote each report, so that the authors can be recognised by the company's leaders
    4. DTo give actionable indicators, detection ideas and context that analysts can use to act within their own tools
    Show answer and explanation
    Correct answer: D

    SOC analysts need indicators, detection ideas and context that they can act on in their tools. Strategy comments, author lists and complete database dumps do not support SOC action.

  3. Question 28

    Which dissemination control stops sensitive intelligence reaching the wrong audience?

    1. AA bright yellow cover page, which makes every report easy to spot in a crowded inbox at the start of the working day
    2. BHandling markings, such as traffic light protocol labels, which define how far the information may be shared
    3. CA public mailing list that anyone can join without approval, so that the widest audience hears the intelligence quickly
    4. DPrinting every report and leaving it on the shared printer, so that anyone who passes by can read it at any time
    Show answer and explanation
    Correct answer: B

    Handling markings define sharing limits, so recipients know what they may do with the information. Visual cover pages, public lists and open printers ignore those limits and widen exposure.

  4. Question 29

    Which measure best shows the value of intelligence products to their consumers?

    1. AFeedback from consumers on whether each product changed a decision or an action, tracked over time
    2. BThe number of pages in each report, with longer reports taken to show more effort and better research at the team level
    3. CThe count of emails sent by the team to its distribution lists each week, which indicates the team's output for the period
    4. DThe number of times a product's file name was copied into a chat channel by any staff member, regardless of the purpose
    Show answer and explanation
    Correct answer: A

    Consumer feedback on decisions and actions shows whether the intelligence was used and made a difference. Page counts, email volumes and file-name copies measure output rather than value.

  5. Question 30

    Which format suits a fast alert that a critical vulnerability is being exploited in the wild?

    1. AA ninety-page annual report, with a glossary, a bibliography and an appendix of all the historical data held by the team
    2. BA short flash or alert product, with the affected products, the indicators, the recommended action and a time-sensitive summary
    3. CA slide deck of forty pages with animated transitions, prepared in advance for the next quarterly management meeting
    4. DA verbal update given at the end of the next week's staff meeting, after the vendor patch has already been released to customers
    Show answer and explanation
    Correct answer: B

    A short flash product delivers the time-critical facts and actions quickly, which is what a live exploitation alert needs. Long reports, slide decks and delayed verbal updates are too slow for the situation.