EC-Council CTIA Module 6.4 Practice Test 003

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 4 (Sharing Threat Intelligence).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Practice Test of the Day 260630

10 questions • Single best answer

Question 1

A malware analyst at a software firm writes pattern-based rules to detect a malware family by its strings and byte sequences, then shares them with peers. A colleague names the rule format. What is it?

A. YARA rules B. DHCP scopes C. BGP routes D. SMTP banners

Question 2

A CTI team at a bank wants to share indicators in a structured, machine-readable language that partner tools can parse automatically. An analyst names the standard. Which should they use?

A. Plain handwritten notes B. A scanned fax image C. A verbal phone call D. STIX

Question 3

A SOC at a hospital needs a transport protocol to automatically pull shared intelligence from a partner's server on a schedule. An analyst names it. Which protocol supports this exchange?

A. SMTP B. TAXII C. FTP banners D. ICMP

Question 4

A CTI analyst at an MSSP must decide how much detail to include when sharing indicators externally without exposing internal systems. A reviewer asks the guiding rule. What should she balance?

A. Maximizing file size B. Using the newest font C. Usefulness against protecting sensitive details D. Sharing only on weekends

Question 5

A government CTI unit shares a YARA rule but wants recipients to understand exactly what it detects and how confident they are. An analyst recommends an addition. What should accompany the rule?

A. Metadata and context describing the detection B. The author's personal phone number C. A random unrelated log file D. An empty file with no notes

Question 6

A CTI team at a retailer wants shared indicators expressed so any partner tool interprets them identically, regardless of vendor. An analyst states the benefit of standards. What do common formats provide?

A. Higher network bandwidth B. Interoperability across tools C. Cheaper office rent D. Stronger physical locks

Question 7

A CTI analyst at a cloud provider shares intelligence that a partner must not redistribute outside their organization. An analyst applies a handling label. Which marking enforces this limit?

A. A vulnerability CVSS score B. A MoSCoW priority tag C. A code commit hash D. A TLP designation

Question 8

A SOC analyst at a utility receives a shared STIX bundle and wants to ingest it directly into the TIP without manual re-entry. A teammate explains why this works. What enables it?

A. The bundle is a scanned PDF B. The bundle is handwritten C. The bundle is structured and machine-readable D. The bundle is a voicemail

Question 9

A CTI manager wants to share intelligence anonymously so contributors cannot be identified, encouraging more participation. An analyst names this exchange approach. Which describes it?

A. Mandatory attributed disclosure B. Anonymized sharing C. Public press release D. Signed legal affidavit

Question 10

A new analyst asks how YARA rules and STIX differ in sharing. The CTI lead answers concisely. Which statement is most accurate?

A. YARA expresses detection patterns; STIX expresses structured intelligence B. Both are transport protocols like TAXII C. STIX detects malware by byte patterns D. YARA is only used for executive reports

EC-Council CTIA Module 6.4 Practice Test 003

Related Posts

Leave a Comment Cancel Reply