EC-Council CTIA Module 6.3 Practice Test 002

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 3 (Participate in Sharing Relationships).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.3 Practice Test 002

10 questions • Single best answer

Question 1

A national CSIRT wants to exchange threat data with peer agencies and industry partners to strengthen collective defense. The team debates which collaborative structure to formally join. What term describes a trusted group whose members regularly exchange threat intelligence?

A. Threat feed aggregator B. Intrusion set C. Collection plan D. Sharing community

Question 2

A financial-sector ISAC routes every member submission through a central coordinating body that validates and then redistributes intelligence to participants. An analyst is asked to name this topology. Which information sharing model is described?

A. Hub-and-spoke model B. Peer-to-peer model C. Source-subscriber model D. Mesh model

Question 3

A small group of healthcare security teams trades indicators directly with one another, with no central intermediary involved. Each member exchanges bilaterally based on established trust. Which sharing model does this arrangement reflect?

A. Hub-and-spoke model B. Source-subscriber model C. Peer-to-peer model D. Broadcast model

Question 4

A commercial vendor publishes curated intelligence feeds that paying customers consume but never contribute back to. A SOC lead must classify this relationship. Which information sharing model applies?

A. Peer-to-peer model B. Source-subscriber model C. Hub-and-spoke model D. Mesh model

Question 5

An enterprise CTI team maps out who it will collaborate with: industry peers, government bodies, vendors, and an ISAC. Leadership wants a single category for these relationships. These groups are best described as what?

A. Threat actors B. Collection sources C. Sharing partners D. Data custodians

Question 6

Before distributing a report to partner organizations, an analyst must mark how widely each item may be redistributed. The team adopts a standardized color-coded handling scheme. Which framework governs this?

A. STIX B. TAXII C. MoSCoW method D. Traffic Light Protocol

Question 7

A critical-infrastructure operator joins an Information Sharing and Analysis Center to receive sector-specific threat warnings. Leadership asks what primary benefit membership provides. What is the main value?

A. Sector-focused threat intelligence sharing B. Guaranteed prevention of all breaches C. Outsourcing of incident response D. Replacement of the internal SOC

Question 8

A new member of a sharing community consistently consumes intelligence but never contributes its own findings. Other members grow reluctant to share sensitive data with it. Which principle is being undermined?

A. Data normalization B. Reciprocity and trust C. Attribution confidence D. Feed deduplication

Question 9

A CTI team wants machine-to-machine exchange of indicators with partners over a standardized transport so data flows automatically. They evaluate available options. Which pairing best supports this goal?

A. PDF email reports B. Verbal briefings C. Spreadsheet attachments D. STIX/TAXII

Question 10

Some members of a sharing community hesitate to disclose that they were victims of an attack. To encourage participation, the community permits submissions that strip identifying details. Which technique enables this?

A. Anonymization B. Encryption at rest C. Tokenized authentication D. Geofencing

EC-Council CTIA Module 6.3 Practice Test 002

Related Posts

Leave a Comment Cancel Reply