EC-Council CTIA Module 5.7 Practice Test 001

This practice test covers Module 5 (Data Analysis) Sub-module 7 (Create Runbooks and Knowledge Base).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 5.7 Practice Test 001

10 questions • Single best answer

Question 1

An incident response team at a logistics firm keeps reacting to phishing inconsistently because each analyst handles it differently. The CTI lead wants a documented, repeatable set of step-by-step procedures. Which artifact should the team create?

A. A runbook B. A threat feed C. A risk register D. A SIEM dashboard

Question 2

A CTI manager wants new analysts to quickly look up past adversary profiles, prior investigations, and lessons learned in one organized repository. She is building a central reference resource. What is this resource called?

A. An incident ticket queue B. A threat knowledge base C. A packet capture archive D. A firewall rule set

Question 3

A SOC team automates a runbook so that when a known malicious hash is detected, containment and enrichment actions execute without manual steps. What is the primary benefit of automating runbook procedures?

A. It removes the need for any analysts B. It guarantees zero false positives C. It speeds and standardizes consistent response D. It eliminates the need for threat feeds

Question 4

A threat intelligence team debates what belongs in a runbook versus a knowledge base. A senior analyst clarifies the distinction. Which statement best describes a runbook compared to a knowledge base?

A. A runbook stores historical actor research for reference B. A runbook defines actionable step-by-step response procedures C. A runbook is a raw feed of indicators D. A runbook is an executive strategic briefing

Question 5

A healthcare CTI team finds that valuable findings from past investigations are lost when analysts leave. Leadership asks how a knowledge base addresses this. What organizational benefit does a maintained knowledge base provide?

A. It retains institutional knowledge and prevents loss B. It replaces the incident response plan C. It blocks malicious traffic automatically D. It grades source reliability numerically

Question 6

A CTI analyst drafts a runbook for ransomware events and wants it to remain useful as adversary behavior evolves. A colleague stresses one ongoing requirement. What practice keeps runbooks effective over time?

A. Encrypting the runbook at rest B. Storing it only in printed form C. Limiting access to one analyst D. Regularly reviewing and updating it

Question 7

During a tabletop exercise, a financial CTI team follows a documented playbook that lists triggers, decision points, and actions for a credential-stuffing scenario. Which type of content is the team primarily exercising?

A. A strategic intelligence estimate B. A runbook workflow C. A raw data sampling plan D. A vendor licensing agreement

Question 8

A CTI team integrates its knowledge base with a threat intelligence platform so analysts can pivot from a current indicator to all prior related findings. What capability does this integration most improve?

A. Physical security of the data center B. Compliance with payroll regulations C. Context and continuity across investigations D. Reduction of network bandwidth usage

Question 9

An MSSP standardizes runbooks across many client SOCs so junior analysts can handle common alerts without escalating every case. Which outcome most directly results from this standardization?

A. Consistent handling and reduced escalations B. Complete elimination of all alerts C. Automatic attribution of every attack D. Guaranteed prevention of all breaches

Question 10

A CTI program manager wants runbooks and the knowledge base organized so analysts can find the right procedure or prior case during a fast-moving incident. Which design principle best supports this need?

A. Maximizing the file size of each entry B. Clear structure, indexing, and searchability C. Restricting content to printed binders D. Removing all tags and metadata

EC-Council CTIA Module 5.7 Practice Test 001

Related Posts

Leave a Comment Cancel Reply