EC-Council CTIA Module 3.3 Practice Test 002

This practice test covers Module 3 (Planning, Direction, and Review) Sub-module 3 (Plan a Threat Intelligence Program).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 3.3 Practice Test 002

10 questions • Single best answer

Question 1

A SOC director at a regional healthcare provider is launching a formal threat intelligence program. She wants a single foundational document that authorizes the effort and defines its purpose, objectives, and boundaries. Which artifact should she create first?

A. Collection management framework B. Incident response runbook C. Project charter D. Threat data feed inventory

Question 2

An MSSP is designing a threat intelligence program for a new client. Before selecting tools or feeds, the lead insists the team must first define what the program is expected to achieve. Which element should be established earliest?

A. Program goals and objectives B. Vendor licensing agreements C. SIEM correlation rules D. Malware sandbox configuration

Question 3

A financial services firm is planning its intelligence program and must define what activities are permitted, who may perform them, and the limits analysts must observe. Which component captures these operational boundaries and constraints?

A. Maturity model B. Rules of engagement C. Pyramid of Pain D. Dissemination matrix

Question 4

A government agency's CTI lead is documenting which assets, threats, and business functions the new program will cover. Leadership wants clear limits so effort is not spread too thin. Which planning element is the lead defining?

A. Threat attribution B. Collection plan C. Knowledge base D. Program scope

Question 5

A critical infrastructure operator is formalizing rules and standards that govern how its intelligence program operates and how analysts handle sensitive data. Which preparation activity addresses these governing documents?

A. Policy preparation B. Data normalization C. Indicator validation D. Hypothesis testing

Question 6

A retail enterprise's program manager must show leadership that the new intelligence effort delivers value. She plans to track measurable indicators tied to program objectives. What should she define to demonstrate progress and effectiveness?

A. Threat actor profiles B. Success metrics C. Kill chain phases D. IoC categories

Question 7

A cloud-focused security team is planning its program and wants to clarify which teams receive intelligence, how often, and through which channels. Which planning element addresses these coordination details among stakeholders?

A. Communication plan B. Project charter C. Bulk data collection D. Threat modeling

Question 8

A bank's CISO has approved an intelligence program in principle but the team cannot proceed without funding, staff, and tooling allocations. Which planning step ensures these are formally secured before execution?

A. Indicator enrichment B. Dissemination C. Resource and budget allocation D. Attribution analysis

Question 9

A new analyst asks where program planning fits relative to other intelligence activities. The lead explains that planning must be completed before any data gathering begins. Which activity correctly follows program planning?

A. Defining the project charter B. Data collection C. Establishing rules of engagement D. Setting program objectives

Question 10

A manufacturing firm's leadership questions why a formal program plan is needed instead of having analysts react to threats ad hoc. The CTI lead explains the plan's core purpose. What does a threat intelligence program plan primarily provide?

A. A signature database for detection B. Automated incident containment C. Structured direction aligned to business needs D. Guaranteed prevention of all breaches

EC-Council CTIA Module 3.3 Practice Test 002

Related Posts

Leave a Comment Cancel Reply