EC-Council CTIA Module 3.7 Practice Test 003

This practice test covers Module 3 (Planning, Direction, and Review) Sub-module 7 (Review Threat Intelligence Programence Sharing).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Practice Test of the Day 260628

10 questions • Single best answer

Question 1

A CTI lead at a critical-infrastructure operator periodically assesses whether the program meets its objectives and delivers value. They name this recurring assessment for the board. What is it called?

A. Threat hunting B. Intelligence dissemination C. Collection planning D. Threat intelligence program review

Question 2

To measure performance, the team tracks metrics such as time-to-detect and the number of actionable reports delivered. They need a term for these measures. What are they called?

A. Indicators of compromise B. Key performance indicators C. Rules of engagement D. Sharing partners

Question 3

After each cycle, stakeholders give input on whether intelligence met their needs, which the team uses to refine future requirements. They name this recurring mechanism. What does it create?

A. A feedback loop B. A malware sandbox C. A YARA rule D. A project charter

Question 4

Review findings show some feeds add little value while others are heavily used, so the team adjusts accordingly. A peer asks the aim. What is the primary goal of acting on these findings?

A. To eliminate management support B. To increase attacker dwell time C. Continuous improvement of the program D. To remove all stakeholders

Question 5

During review, the lead checks whether the intelligence produced actually answered the defined priority requirements. A reviewer asks the focus. What is this evaluation primarily assessing?

A. The malware sample count B. The SIEM vendor's revenue C. The attacker's nationality D. Program effectiveness against requirements

Question 6

Following a major engagement, the team documents what worked, what failed, and how to improve next time. They label this record. What is it called?

A. Lessons learned B. An indicator feed C. A traffic light protocol D. A sharing community

Question 7

The lead evaluates how advanced the program's capabilities are against a staged model running from initial to optimized. They name this evaluation. Which assessment is it?

A. A penetration test B. A threat intelligence maturity assessment C. An incident report D. A collection plan

Question 8

To gauge value, the team surveys executives and SOC managers on how useful the intelligence has been to their decisions. A peer asks what this captures. What does this measure?

A. The number of raw logs B. The malware family observed C. Stakeholder satisfaction with the intelligence D. The attacker's infrastructure

Question 9

The review reveals stakeholder priorities have shifted toward cloud threats, so the team revisits its requirements. A colleague asks what review enabled. What does the process directly support here?

A. Permanent freezing of requirements B. Removal of the SOC team C. Elimination of dissemination D. Updating requirements to current needs

Question 10

An executive asks why the program needs periodic review at all. The lead summarizes the core reason in business terms. What does regular review fundamentally ensure?

A. That all attacks stop B. That the program stays aligned and effective C. That analysts are no longer needed D. That data collection ceases

EC-Council CTIA Module 3.7 Practice Test 003

Related Posts

Leave a Comment Cancel Reply