EC-Council CTIA Module 6.4 Practice Test 001

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 4 (Sharing Threat Intelligence).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.4 Practice Test 001

10 questions • Single best answer

Question 1

A CTI team creates YARA rules based on unique string patterns, file structures, and behavioral characteristics identified in a malware family targeting their sector. They share these rules with trusted partners. What type of intelligence are YARA rules?

A. Strategic intelligence for executive briefings B. Technical, machine-readable detection intelligence enabling automated malware identification C. Geopolitical threat landscape assessments D. Bulk raw data feeds without analytical context

Question 2

A CTI team shares STIX 2.1 objects representing a threat actor's campaign, including observed TTPs as ATT&CK patterns, associated malware objects, and network infrastructure indicators, via a TAXII server. What is the primary benefit of using STIX/TAXII for intelligence sharing?

A. STIX/TAXII automatically classifies intelligence and applies TLP markings B. STIX/TAXII enables standardized, machine-readable, automated exchange of structured intelligence between platforms C. STIX/TAXII encrypts all intelligence so it cannot be read by human analysts D. STIX/TAXII replaces the need for analytical quality review

Question 3

A threat intelligence analyst wants to share a set of malware indicators with a partner organization that uses a different TIP. To ensure compatibility, she converts the indicators to STIX 2.1 format before sending. What does this conversion address?

A. Indicator staleness and expiration B. Interoperability between different platforms through a common structured data format C. Indicator confidence scoring D. TLP marking assignment

Question 4

A CTI team shares network indicators via a TAXII 2.1 server using the 'Collection' and 'Channel' mechanisms. A partner organization's TIP connects to the TAXII server to pull the latest intelligence. Which information exchange model does this represent?

A. Human-to-human verbal intelligence exchange B. Automated machine-to-machine TAXII pull-based intelligence exchange C. Email-based manual indicator distribution D. Physical media transfer of intelligence files

Question 5

A CTI team shares a YARA rule with a trusted partner. The partner deploys it in their endpoint security platform and it generates a match on a malware sample two days later. What does this outcome demonstrate about the intelligence sharing relationship?

A. The YARA rule needs to be refined further before it has any value B. The shared technical intelligence provided direct, measurable defensive value to the partner C. YARA rules are only useful for the organization that created them D. The partner should have purchased a commercial feed instead

Question 6

A CTI analyst wants to share Snort IDS signatures with sector partners based on observed adversary network traffic patterns. Before sharing, she tests the signatures against a known clean traffic sample to verify the false positive rate. Why is this pre-sharing validation important?

A. To ensure the signatures comply with TLP requirements before dissemination B. To verify that shared detection signatures are accurate and will not generate excessive false positives in partner environments C. To convert the signatures to STIX format D. To classify the signatures at the appropriate confidentiality level

Question 7

A CTI team shares intelligence using the OpenIOC standard for a specific set of malware indicators. OpenIOC uses a hierarchical XML structure to describe indicator logic. What is OpenIOC primarily used for?

A. Describing geopolitical threat trends in structured text B. Expressing structured indicator logic for malware and intrusion detection in a machine-readable format C. Defining TLP markings for shared intelligence D. Scheduling TAXII feed subscriptions

Question 8

A threat intelligence team wants to share intelligence about a threat actor's campaign in a way that enables peer organizations to understand not just the indicators but also the adversary's goals, targeting rationale, and attribution evidence. Which sharing format best supports this rich contextual exchange?

A. A flat CSV file containing only IP addresses and domains B. A STIX 2.1 bundle containing Campaign, Threat Actor, Attack Pattern, and Indicator objects with explicit STIX relationships C. A plain-text email with a bulleted list of IoCs D. An Excel spreadsheet with two columns: indicator value and indicator type

Question 9

A CTI team is deciding whether to share details about a phishing campaign that successfully compromised their organization. They are concerned about reputational risk but recognize the defensive value for peers. Which principle should guide their decision?

A. Only share intelligence that portrays the organization positively B. Share sanitized details that provide defensive value to peers while protecting sensitive organizational information C. Withhold all intelligence about successful compromises to avoid reputational damage D. Share only with commercial vendors in exchange for payment

Question 10

A CTI analyst reviews an intelligence package received from a sector partner. The package contains STIX objects with TLP:GREEN markings. What is the maximum permissible redistribution scope for this intelligence?

A. The intelligence can be shared publicly with anyone B. The intelligence can be shared within the sector community but should not be made publicly available C. The intelligence is restricted to the receiving organization only and cannot be shared with any other party D. The intelligence can only be shared verbally in closed-door briefings

EC-Council CTIA Module 6.4 Practice Test 001

Related Posts

Leave a Comment Cancel Reply