EC-Council CTIA Module 3.4 Practice Test 001

This practice test covers Module 3 (Requirements, Planning, Direction, and Review) Sub-module 4 (Establish Management Support).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 3.4 Practice Test 001

10 questions • Single best answer

Question 1

A threat intelligence lead at a global pharmaceutical company is preparing to request dedicated budget and headcount for a formal CTI program. Before presenting to the CISO and CFO, what must the analyst develop to justify the investment and secure leadership approval?

A. A threat intelligence collection management plan B. A business case for threat intelligence C. A program scope statement D. A set of Priority Intelligence Requirements

Question 2

A newly formed CTI team at a national retail chain lacks authority to access cross-departmental data or compel IT teams to act on intelligence findings. Which management support mechanism would most directly resolve this limitation?

A. A formal intelligence sharing agreement with external partners B. A documented executive sponsorship appointment C. An updated Rules of Engagement document D. An expanded program scope statement

Question 3

A CISO at a mid-sized technology firm asks the CTI program manager to demonstrate program value to the board of directors at the next quarterly review. Which metric most effectively communicates CTI return on investment to non-technical executives?

A. Total number of YARA rules deployed in the SIEM B. Volume of raw threat data ingested from subscribed feeds per month C. Mean time to detect and respond to threats attributed to CTI-driven alerts, compared to baseline D. Count of unique IoC types normalized per collection cycle

Question 4

A CTI program manager at a federal contractor is systematically identifying every team, department, and executive whose operations depend on or benefit from threat intelligence outputs. What activity is the manager performing to structure management support?

A. Threat actor profiling and attribution analysis B. Priority Intelligence Requirements development C. Threat intelligence stakeholder mapping D. Intelligence collection planning and source identification

Question 5

A CTI lead preparing a monthly executive briefing must choose metrics that reflect program impact rather than collection volume. Which KPI set best demonstrates threat intelligence program effectiveness to senior leadership?

A. Number of threat feeds subscribed to and total IoCs ingested per month B. Mean time to detect, percentage of incidents with prior CTI warning, and decision-support rate C. Number of analyst hours spent on collection versus analysis tasks D. Count of malware samples processed and YARA signatures created quarterly

Question 6

An analyst is asked to brief the board of directors on a nation-state campaign targeting the company's supply chain. What communication approach is most appropriate when presenting threat intelligence to non-technical senior executives?

A. Share full technical IoCs, YARA rules, and STIX/TAXII feed details for transparency B. Focus on strategic business risk implications, likelihood of impact, and recommended decisions C. Present raw threat actor TTPs mapped to MITRE ATT&CK sub-techniques D. Provide a detailed malware reverse engineering report with behavioral analysis findings

Question 7

A CTI program lead at a healthcare organization notes that while the CISO verbally supports the program, staffing requests are routinely rejected at the executive committee level. What is the most likely root cause of this failure to obtain management support?

A. The program's Rules of Engagement have not been formally approved B. The program lacks a formal executive sponsor with organizational authority to commit resources C. The program scope statement is insufficiently defined D. The CTI team is not producing sufficient operational intelligence output

Question 8

A CTI manager building a business case includes documented cost savings from prevented incidents, estimated breach cost avoidance, and measurable efficiency gains from intelligence-driven alert triage. What component of the business case do these items collectively represent?

A. Threat intelligence maturity assessment B. Risk appetite documentation C. Return on investment (ROI) calculation D. Priority Intelligence Requirements justification

Question 9

A CTI analyst discovers during an active intrusion investigation that a threat actor has compromised an executive's corporate email account. Per the CTI program's escalation policy, what is the most appropriate immediate action?

A. Add the associated indicators to the SIEM and wait for automated detection to trigger B. Publish the findings in the next scheduled weekly threat intelligence report C. Escalate immediately to senior management and legal counsel in accordance with the escalation policy D. Share the indicators via ISAC channels to alert the broader community

Question 10

A CTI program manager asked by the CISO to demonstrate measurable program value after six months of operations decides to compile documented cases. Which approach most effectively shows management that CTI outputs are supporting business decisions?

A. Increasing the number of intelligence feeds consumed and data sources monitored B. Publishing a higher volume of threat intelligence reports each week C. Expanding the collection team headcount and analyst training investment D. Documenting use cases where CTI outputs directly influenced security decisions or reduced incident response time

EC-Council CTIA Module 3.4 Practice Test 001

Related Posts

Leave a Comment Cancel Reply