EC-Council CTIA Module 4.4 Practice Test 001

This practice test covers Module 4 (Data Collection and Processing) Sub-module 4 (Threat Intelligence Data Collection and Acquisition).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 4.4 Practice Test 001

10 questions • Single best answer

Question 1

A CTI team lead at an e-commerce company is mapping the organization's data collection capabilities. She needs to classify intelligence derived from publicly available internet sources such as social media, forums, and news sites. Which collection discipline describes this method?

A. HUMINT B. OSINT C. SIGINT D. TECHINT

Question 2

A threat intelligence analyst needs to identify subdomains, mail server records, and zone transfer vulnerabilities associated with a suspected threat actor's infrastructure. Which data collection technique directly supports this goal?

A. Email footprinting B. WHOIS record aggregation C. DNS interrogation D. Passive network traffic capture

Question 3

An analyst wants to collect metadata, directory structure information, and technology stack details from a threat actor's public-facing website without triggering intrusion detection alerts. Which collection technique is most appropriate?

A. Active vulnerability scanning B. Social engineering C. Website footprinting D. Packet interception

Question 4

A SOC team receives a phishing email suspected to originate from a nation-state actor. An analyst examines the email headers to trace routing hops, originating IP addresses, and mail server relay chains. This activity is an example of which threat data collection technique?

A. DNS interrogation B. Email footprinting C. SIGINT collection D. Passive DNS replication

Question 5

A threat intelligence analyst wants to automate the retrieval of IoC data from multiple vendor REST APIs, deduplicate entries, and output structured JSON for ingestion into the team's TIP. Which approach best supports scalable, repeatable data acquisition?

A. Manually downloading indicator lists from each vendor portal B. Configuring RSS feed aggregation within the SIEM C. Python scripting using requests and JSON processing libraries D. Bulk downloading vendor-published PDF intelligence reports

Question 6

A CTI analyst at an MSSP needs to map the digital footprint of a vendor flagged in an alert. She runs a tool that automatically correlates domain names, IP addresses, email addresses, and social profiles into a visual link graph for adversary profiling. Which type of tool is she using?

A. Passive DNS replication service B. Threat intelligence feed aggregator C. Automated OSINT platform such as Maltego D. Security information and event management (SIEM) system

Question 7

An incident response team asks the CTI team to collect IoC data generated within the organization's own environment, including endpoint alerts, firewall logs, and EDR telemetry from an active intrusion. Which source category does this represent?

A. OSINT feeds from external threat intelligence platforms B. Third-party commercial threat intelligence subscriptions C. Internal sources such as SIEM logs and EDR telemetry D. ISAC peer-sharing community feeds

Question 8

A CTI analyst uses advanced search operators in a public search engine to discover exposed configuration files, unsecured login pages, and database error messages linked to infrastructure associated with a ransomware group. This technique is commonly known as what?

A. Passive network reconnaissance B. Google dorking or search engine footprinting C. Active web scraping D. Passive DNS querying

Question 9

A government CTI team embeds an analyst to monitor and participate in a closed threat actor forum, gathering adversary intentions, planned targets, and attack timelines. This collection activity — designed to penetrate adversary operations — is classified under which discipline?

A. OSINT B. HUMINT C. Cyber counterintelligence (CCI) D. SIGINT

Question 10

A threat intelligence team receives a malware sample attributed to an APT group. After detonating it in a sandbox, they extract C2 server addresses, persistence mechanisms, and behavioral signatures. This process is best described as which threat data collection method?

A. SIGINT collection via network traffic interception B. Digital forensics artifact triage C. Malware analysis as a threat data collection technique D. Website footprinting of adversary infrastructure

EC-Council CTIA Module 4.4 Practice Test 001

Related Posts

Leave a Comment Cancel Reply