EC-Council CTIA Module 2.5 Practice Test 002

This practice test covers Module 2 (Cyber Threats and Attack Frameworks) Sub-module 5 (Indicators of Compromise).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 2.5 Practice Test 002

10 questions • Single best answer

Question 1

A SOC analyst at a regional healthcare provider reviews artifacts left after a malware infection, including suspicious file hashes, registry keys, and outbound connections. She wants to classify these forensic clues correctly. What term describes these observable signs of intrusion?

A. Tactics, techniques, and procedures B. Indicators of compromise C. Strategic threat intelligence D. Vulnerability disclosures

Question 2

An MSSP analyst is sorting collected indicators into categories. She separates malicious IP addresses, domain names, and URLs from items like file hashes and registry changes. Which category do the IP addresses, domains, and URLs belong to?

A. Host-based indicators B. Email indicators C. Network indicators D. Behavioral indicators

Question 3

A threat hunter at a financial institution maps indicators to the Pyramid of Pain to decide where to focus. She wants to inflict the greatest cost on adversaries by targeting the level hardest for them to change. Which level should she prioritize?

A. Hash values B. IP addresses C. Domain names D. Tactics, techniques, and procedures

Question 4

An incident response team at a cloud service provider receives a feed containing sender addresses, malicious subject lines, and weaponized attachments tied to a phishing wave. They need to label these artifacts by category. Which indicator category applies?

A. Network indicators B. Email indicators C. Host-based indicators D. Strategic indicators

Question 5

A CTI analyst at a government agency debates whether to alert on a single observed indicator. A colleague argues that one artifact alone may produce false positives and that context matters. What best describes the primary limitation of relying solely on indicators of compromise?

A. They reveal adversary intent and long-term strategy B. They are reactive and often detect threats only after a breach C. They are impossible to share between organizations D. They permanently disrupt an adversary's operations

Question 6

A threat intelligence team is normalizing collected artifacts and must distinguish low-level evidence from adversary behavior. An analyst notes that a malicious file hash differs fundamentally from a description of how the attacker moves laterally. What does the lateral-movement description represent?

A. An indicator of compromise B. A tactic, technique, or procedure C. A network indicator D. A vulnerability signature

Question 7

An analyst supporting a critical infrastructure operator collects artifacts directly from endpoints, including running processes, mutexes, and modified registry keys. She must tag these for the detection team. Which category covers these endpoint-resident artifacts?

A. Network indicators B. Email indicators C. Host-based indicators D. Operational indicators

Question 8

A SOC team enriches a newly received indicator before deploying it as a detection rule. The lead stresses that an artifact must be validated, contextualized, and confirmed malicious first. What is the main risk of deploying unvalidated indicators?

A. Reduced adversary dwell time B. Excessive false positives degrading detection C. Automatic attribution to a threat actor D. Permanent loss of the threat feed

Question 9

A threat hunter wants to move detection up the Pyramid of Pain from easily changed artifacts toward more durable signals. She currently alerts on file hashes and IP addresses. Which shift increases adversary cost the most?

A. Switching from hashes to domain names B. Switching from IP addresses to hashes C. Switching from hashes to adversary behaviors D. Switching from domains to IP addresses

Question 10

An intelligence lead briefs the detection team on why indicators alone are insufficient against an advanced persistent threat that constantly rotates infrastructure. She recommends complementing artifacts with behavioral analysis. What concept best supports this recommendation?

A. Indicators of compromise are durable and rarely change B. Behavioral patterns are harder for adversaries to alter than artifacts C. Strategic intelligence replaces the need for detection rules D. Network indicators are the most painful for adversaries to change

EC-Council CTIA Module 2.5 Practice Test 002

Related Posts

Leave a Comment Cancel Reply