EC-Council CTIA Module 5.8 Practice Test 001

This practice test covers Module 5 (Data Analysis) Sub-module 8 (Threat Intelligence Tools).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 5.8 Practice Test 001

10 questions • Single best answer

Question 1

A threat analyst at a critical-infrastructure operator needs to map observed adversary behaviors to a standardized catalog of techniques and tactics for detection planning. She wants a community-maintained knowledge base. Which resource should she use?

A. MITRE ATT&CK B. Nmap C. Wireshark D. Splunk forwarder

Question 2

A CTI team wants to query and visualize relationships among indicators, actors, and campaigns to support pivoting during analysis. They need a platform that aggregates and links intelligence. Which category of tool fits this need?

A. A packet sniffer B. A threat intelligence platform C. A password cracker D. A disk imaging tool

Question 3

An analyst wants to submit a suspicious file and receive a report on its hashes, detections, and related indicators from many engines and sources. Which type of service is most appropriate?

A. A vulnerability scanner B. A SIEM correlation rule C. A malware analysis and lookup service D. A ticketing system

Question 4

A SOC engineer wants to share and ingest structured indicators with trusted partners using an open-source platform built specifically for storing and correlating IoCs. Which tool best matches this purpose?

A. MISP B. Metasploit C. John the Ripper D. Burp Suite

Question 5

A threat intelligence lead evaluates tools and stresses that the right choice depends on the program's goals, data sources, and integrations. A new analyst asks what should drive tool selection. What is the primary consideration?

A. Choosing whichever tool is newest B. Selecting the tool with the most plugins C. Picking the cheapest available option D. Alignment with program requirements and use cases

Question 6

A CTI analyst maps an intrusion across four interconnected features: adversary, capability, infrastructure, and victim. She uses a framework purpose-built for this structured intrusion analysis. Which framework is she applying?

A. OWASP Top 10 B. Diamond Model C. NIST CSF D. ISO 27001

Question 7

An analyst needs to research a domain's registration history, passive DNS, and associated infrastructure while investigating a phishing campaign. Which category of tooling best supports this enrichment?

A. OSINT and infrastructure investigation tools B. Endpoint encryption utilities C. Patch management software D. Backup and recovery tools

Question 8

A CTI team wants automated playbooks that ingest intelligence, enrich alerts, and trigger response actions across multiple security tools. Which technology category provides this orchestration capability?

A. DLP appliances B. Network tap hardware C. SOAR platforms D. Honeypot sensors

Question 9

A threat hunter writes detection logic to match files by specific byte patterns and string signatures during malware triage. She uses a rule language built for identifying and classifying malware samples. Which language is this?

A. YARA B. SQL C. Regex-only grep D. Markdown

Question 10

A CTI program integrates several tools and finds analysts wasting time copying data between them manually. Leadership asks what most improves efficiency. Which capability should the team prioritize when selecting tools?

A. Support for the fewest data formats B. The largest possible storage capacity C. The most colorful user interface D. Interoperability and integration via APIs

EC-Council CTIA Module 5.8 Practice Test 001

Related Posts

Leave a Comment Cancel Reply