EC-Council CTIA Module 3.7 Practice Test 002

This practice test covers Module 3 (Planning, Direction, and Review) Sub-module 7 (Review Threat Intelligence Program).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 3.7 Practice Test 002

10 questions • Single best answer

Question 1

A CTI lead at a federal agency conducts the annual review of the threat intelligence program. Leadership asks what the review primarily aims to determine. What is the main objective?

A. Recruiting additional analysts B. Whether intelligence met stakeholder requirements C. Replacing the existing TIP D. Counting total IoCs ingested

Question 2

An MSSP wants to demonstrate the performance of its threat intelligence program to clients. The analyst must select measurable indicators of effectiveness. Which choice best serves this purpose?

A. The number of analysts on staff B. The brand of the SIEM in use C. The size of the office network D. Defined key performance indicators

Question 3

After completing a threat intelligence engagement, a financial services CTI team wants to learn whether consumers found the products useful. The lead must choose the most direct method. What should the team do?

A. Collect stakeholder feedback B. Increase feed subscriptions C. Archive all prior reports D. Expand the collection scope

Question 4

A healthcare provider's CTI manager plans a threat intelligence-led engagement review. The team debates the appropriate timing for this assessment. When is it most appropriate to perform?

A. Before requirements are defined B. Only during a breach C. After the engagement concludes D. Never, if feeds are automated

Question 5

During a program review, a critical infrastructure CTI team finds that some leadership intelligence needs were never addressed. The analyst must name what this exercise revealed. What does this finding represent?

A. A successful dissemination cycle B. A coverage gap C. A false positive D. A confirmed attribution

Question 6

A SOC supporting a retail enterprise documents what worked and what failed after a threat intelligence engagement. The lead explains the purpose of capturing these notes. Why is this done?

A. To assign individual blame B. To inflate reporting volume C. To satisfy vendor contracts D. To improve future engagements

Question 7

Following a review, a cloud-services CTI team learns that stakeholders now prioritize ransomware over insider threats. The analyst must decide how the program should respond. What is the appropriate action?

A. Ignore the shift until next year B. Disband the intelligence team C. Update intelligence requirements D. Stop producing all reports

Question 8

An intelligence lead must justify continued funding for the threat intelligence program to the executive board. The lead needs to convey the program's worth in business terms. What should be demonstrated?

A. The value delivered to the organization B. The total petabytes of logs stored C. The number of feeds connected D. The count of dashboards built

Question 9

A government CTI program institutionalizes periodic reviews so findings continually shape the next cycle. The analyst must label the principle this reflects. What does this practice embody?

A. One-time program setup B. Static reporting only C. Ad hoc data dumping D. Continuous improvement

Question 10

While reviewing the program, a bank's CTI analyst notices several subscribed feeds rarely produce relevant or actionable intelligence. The lead asks what action the review supports. What should the analyst recommend?

A. Add every available commercial feed B. Reassess the value of current sources C. Disable all internal collection D. Stop validating any indicators

EC-Council CTIA Module 3.7 Practice Test 002

Related Posts

Leave a Comment Cancel Reply