EC-Council CTIA Module 6.5 Practice Test 001

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 5 (Delivery Mechanisms).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.5 Practice Test 001

10 questions • Single best answer

Question 1

An analyst at a managed security provider must push real-time indicators directly into clients' SIEMs so detections update automatically without human steps. She needs a mechanism for continuous machine delivery. Which delivery method fits?

A. An automated data feed B. A quarterly printed bulletin C. An in-person workshop D. A mailed USB drive

Question 2

A CTI team must brief executives on a major emerging threat where discussion and questions matter more than machine data. A lead recommends a delivery mechanism suited to dialogue. Which mechanism is most appropriate?

A. A raw STIX feed B. A live briefing or presentation C. An automated API push D. A syslog stream

Question 3

A CTI manager stresses that the choice of delivery mechanism should follow the consumer and the intelligence type, not convenience. A new analyst asks what primarily drives the choice. What should guide mechanism selection?

A. The audience and intelligence type B. The analyst's favorite software C. Whatever is cheapest that day D. The phase of the moon

Question 4

A SOC wants partner indicators to flow into its tools through a programmatic interface that systems query directly. An engineer recommends a mechanism enabling system-to-system retrieval. Which delivery mechanism is this?

A. A faxed memo B. A bulletin board flyer C. An API integration D. A voicemail message

Question 5

A healthcare CTI team distributes a sensitive report and must ensure it cannot be intercepted or read in transit by unauthorized parties. A reviewer asks what the delivery mechanism must provide. Which property is essential?

A. Bright color formatting B. Maximum file size C. A catchy subject line D. Secure, encrypted transmission

Question 6

A CTI team uses a portal where consumers log in to read, search, and download products on demand rather than receiving pushes. A reviewer classifies this approach. Which delivery model does this represent?

A. A pull-based portal B. An unsolicited mass email C. A push-only feed D. A printed newspaper

Question 7

A CTI lead notes that some consumers need immediate alerts the moment a critical indicator appears, while others need periodic summaries. A new analyst asks how to serve both. What does this imply about delivery mechanisms?

A. Only one mechanism should ever be used B. Different consumers need different mechanisms C. All intelligence must be delivered yearly D. Alerts should never be automated

Question 8

A CTI manager wants confirmation that delivered intelligence actually reached and was used by intended consumers. A reviewer suggests building a capability into the delivery process. What should the mechanism support?

A. Tracking delivery and consumption B. Random recipient selection C. Hiding the sender identity D. Disabling all logging

Question 9

A financial institution sends tactical indicators to its SIEM but a strategic risk memo to the board by briefing. A reviewer notes both reached the right consumers effectively. What principle does this illustrate?

A. Strategic memos belong in machine feeds B. One channel suits every product C. Mechanism should fit content and audience D. Indicators are best delivered verbally

Question 10

A CTI team's email-attached reports are often missed in crowded inboxes, delaying action on urgent threats. A lead proposes adding a complementary channel. Which addition best ensures urgent intelligence is noticed promptly?

A. A real-time alerting or notification channel B. A slower monthly digest only C. Removing all summaries from reports D. Switching to handwritten notes

EC-Council CTIA Module 6.5 Practice Test 001

Related Posts

Leave a Comment Cancel Reply