EC-Council CTIA Module 6.1 Practice Test 001

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 1 (Threat Intelligence Reports).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.1 Practice Test 001

10 questions • Single best answer

Question 1

An intelligence lead briefing a hospital network's board must convey long-term threat trends, adversary motivations, and business risk without technical jargon. She is preparing a report for non-technical executives. Which report type fits this audience?

A. Strategic report B. Tactical report C. Operational report D. Technical indicator feed

Question 2

A CTI analyst produces a document detailing an actor's TTPs so detection engineers can build and tune rules. The content centers on adversary behaviors and methods. Which type of report is this?

A. Strategic report B. Executive summary C. Tactical report D. Budget forecast

Question 3

A CTI manager insists every report start with a concise section that states key judgments and recommendations so busy readers grasp the essentials immediately. Which report component is being described?

A. Appendix of raw logs B. Executive summary C. Reference bibliography D. Glossary of acronyms

Question 4

A financial-sector analyst is told her report must let readers trust and verify the conclusions. She is asked to document where each judgment came from. Which reporting practice satisfies this requirement?

A. Omitting sources to keep it short B. Using only verbal briefings C. Clearly citing and characterizing sources D. Replacing analysis with raw indicators

Question 5

A CTI team supporting an incident response unit produces a report on an active campaign, including timing, targeting, and likely next moves. The content guides ongoing operational planning. Which report type is this?

A. Operational report B. Strategic report C. Marketing brief D. Compliance attestation

Question 6

A new analyst drafts a report packed with technical depth but the SOC manager cannot quickly find what action to take. A senior analyst gives the key fix. What quality should an effective intelligence report prioritize?

A. Maximum possible length B. Use of rare technical jargon C. Actionable, audience-appropriate findings D. Inclusion of every collected log

Question 7

A CTI program manager wants to streamline production and formatting of recurring reports across the team. She seeks software that helps draft, structure, and standardize intelligence products. Which category should she evaluate?

A. Report writing and authoring tools B. Network intrusion sensors C. Disk defragmentation utilities D. Email spam filters

Question 8

A government CTI cell tailors each report differently for analysts, SOC operators, and ministers. A reviewer explains the underlying principle. Why must report content and format vary by recipient?

A. To inflate the page count B. To match each audience's needs and decisions C. To comply with antivirus licensing D. To reduce the number of sources cited

Question 9

An analyst includes a section in her report rating how certain she is about each key judgment and noting intelligence gaps. A reviewer asks why. What does adding confidence levels and gaps accomplish?

A. It guarantees the conclusions are correct B. It replaces the need for sources C. It hides weaknesses from readers D. It helps readers weigh certainty and limitations

Question 10

A CTI team distributes a sensitive report and must signal who may share it and with whom. They apply standardized handling labels to the document. Which convention are they most likely using?

A. Traffic Light Protocol markings B. CVSS base scores C. MAC address tags D. RFC 1918 ranges

EC-Council CTIA Module 6.1 Practice Test 001

Related Posts

Leave a Comment Cancel Reply