EC-Council CTIA Module 6.4 Practice Test 002

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 4 (Sharing Threat Intelligence).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.4 Practice Test 002

10 questions • Single best answer

Question 1

A threat intelligence team at a regional hospital network joins a sector community to exchange adversary information with peer organizations. Members both contribute to and receive data through a trusted coordinating body. Which sharing architecture does this describe?

A. Peer-to-peer sharing B. Open-source feed ingestion C. Hub-and-spoke model D. Point-to-point exchange

Question 2

An analyst needs to encode threat information, including indicators, campaigns, and threat actors, in a standardized machine-readable language for exchange with partners. The goal is to represent the structured content itself. Which standard fits this need?

A. STIX B. TAXII C. YARA D. OpenVAS

Question 3

A CTI team has structured its threat data and now requires a protocol to automatically deliver it to partner organizations over HTTPS. The team focuses on the transport layer rather than the content format. Which mechanism handles this delivery?

A. STIX B. YARA C. OpenIOC D. TAXII

Question 4

A malware analyst at an MSSP writes pattern-based detection rules using textual and binary signatures to identify and classify malware families, then shares them with clients. Which rule format is the analyst using?

A. Snort rules B. YARA rules C. Sigma rules D. STIX patterns

Question 5

An intelligence lead at a financial services firm distributes a report and marks it so recipients may share it only inside their own organization, not with outside parties. Which handling designation enforces this restriction?

A. TLP:AMBER B. TLP:RED C. TLP:GREEN D. TLP:CLEAR

Question 6

A SOC subscribes to a partner's TAXII server and periodically requests the latest indicators on its own schedule rather than receiving them automatically. Which information exchange method is being used?

A. Push delivery B. Broadcast C. Multicast D. Pull delivery

Question 7

A critical infrastructure operator joins a body that collects, analyzes, and disseminates sector-specific threat information among member utilities. The entity coordinates trusted exchange across the industry. What type of organization has it joined?

A. CERT B. ISAC C. MSSP D. SIEM vendor

Question 8

Several CTI teams agree to exchange intelligence directly with one another without routing it through any coordinating authority. Each member shares bilaterally with its own trusted contacts. Which sharing model is in use?

A. Hub-and-spoke model B. Centralized model C. Peer-to-peer model D. Source-subscriber model

Question 9

An executive questions why the firm should contribute its own incident data to an external community. The CTI lead explains the chief reason for participating. What is the main benefit of threat intelligence sharing?

A. Stronger collective defense B. Guaranteed breach prevention C. Eliminating internal monitoring D. Lower compliance costs

Question 10

A government agency must share sensitive indicators with private partners but needs to remove attributable details that could expose its sources before distribution. Which practice should be applied to the data first?

A. Enrichment B. Normalization C. Aggregation D. Anonymization

EC-Council CTIA Module 6.4 Practice Test 002

Related Posts

Leave a Comment Cancel Reply