EC-Council CTIA Module 4.2 Practice Test 002

This practice test covers Module 4 (Data Collection and Processing) Sub-module 2 (Threat Intelligence Collection Management).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 4.2 Practice Test 002

10 questions • Single best answer

Question 1

A cyber threat intelligence program manager at a regional hospital network maps which sources satisfy each requirement. She wants a structured method to track coverage, gaps, and source performance over time. Which tool best supports this effort?

A. Cyber Kill Chain B. Diamond Model C. Collection Management Framework D. Pyramid of Pain

Question 2

A threat intelligence team at a cloud service provider is launching a new program. Before gathering any data, the lead wants a document defining what to collect, from where, and how often. What should they create first?

A. A threat intelligence collection plan B. An incident response runbook C. A dissemination report D. A risk register

Question 3

An intelligence lead at a federal agency must decide which data to gather first. Limited analysts mean collection must align to the questions leadership most needs answered. What primarily guides this prioritization?

A. Available disk storage B. Number of open feeds C. Analyst seniority D. Priority intelligence requirements

Question 4

A CTI analyst at a manufacturing firm reviews the collection framework. She finds a requirement with no source mapped to satisfy it. What does this finding indicate?

A. Data redundancy B. A collection gap C. Over-collection D. Source saturation

Question 5

An analyst at an MSSP imports threat data arriving as free-form incident write-ups and blog posts. The content lacks a predefined schema or fields. How is this data best categorized?

A. Structured data B. Normalized data C. Metadata D. Unstructured data

Question 6

A threat hunting team at a bank collects indicators from its own SIEM logs, firewall events, and endpoint telemetry. These all originate from within the organization. What type of source is this?

A. Internal sources B. Open-source feeds C. Commercial feeds D. Sharing communities

Question 7

A CTI analyst gathers adversary information by directly interacting with a threat actor's infrastructure, accepting some risk of detection. This contrasts with quietly observing public records. Which collection method is being used?

A. Passive collection B. Bulk normalization C. Active collection D. Data sampling

Question 8

Before adding a new external feed, an analyst at a healthcare provider assesses its accuracy, timeliness, and track record. This step prevents low-quality data from polluting the program. What is the analyst performing?

A. Data enrichment B. Source reliability evaluation C. Dissemination D. Threat attribution

Question 9

A program manager at a critical infrastructure operator translates broad intelligence requirements into specific, actionable items naming the exact data to acquire. These narrower items direct day-to-day gathering. What are these called?

A. Indicators of compromise B. Dissemination plans C. Runbooks D. Collection requirements

Question 10

A CTI lead at an MSSP periodically measures whether mapped sources still satisfy requirements and retires underperforming ones. This ongoing activity keeps the program effective. What does this best represent?

A. Threat attribution B. Collection management C. Incident containment D. Report dissemination

EC-Council CTIA Module 4.2 Practice Test 002

Related Posts

Leave a Comment Cancel Reply