EC-Council CTIA Module 6.7 Practice Test 001

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 7 (Intelligence Sharing Acts and Regulations).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.7 Practice Test 001

10 questions • Single best answer

Question 1

A healthcare provider's CTI lead wants to exchange malware indicators with the federal government but worries about lawsuits over shared data. She seeks the U.S. statute that grants liability protection for voluntary cyberthreat indicator sharing. Which law applies?

A. Sarbanes-Oxley Act B. Computer Fraud and Abuse Act C. Cybersecurity Information Sharing Act of 2015 D. Digital Millennium Copyright Act

Question 2

A CTI analyst at a multinational firm prepares to share indicators containing EU customers' personal data with partners. Legal counsel insists the exchange comply with the regulation protecting EU personal data. Which framework governs this requirement?

A. General Data Protection Regulation B. Health Insurance Portability and Accountability Act C. Payment Card Industry Data Security Standard D. Gramm-Leach-Bliley Act

Question 3

A government CERT distributes a report marked with a designation meaning recipients may share it only within their own organization. An analyst asks which handling protocol defines these sharing restrictions by color. What is being referenced?

A. STIX classification levels B. MoSCoW prioritization C. Diamond Model labeling D. Traffic Light Protocol

Question 4

A financial institution's CTI team receives a TLP:AMBER advisory from an ISAC. A junior analyst wants to post the details on a public vendor forum. According to TLP, what is the correct handling?

A. Share publicly with attribution removed B. Limit to the organization and its clients on a need-to-know basis C. Restrict to named recipients only D. Distribute freely across the entire community

Question 5

A critical-infrastructure operator joins a sector group that lets utilities exchange threat intelligence and coordinate defenses within their industry. An analyst asks what type of organization this is. Which best describes it?

A. Computer Emergency Response Team B. Managed Security Service Provider C. Security Operations Center D. Information Sharing and Analysis Center

Question 6

Before sharing enriched indicators internationally, a CTI manager must comply with laws restricting the cross-border movement of certain personal and sensitive data. An analyst asks what this category of legal constraint is generally called. Which term fits?

A. Data sovereignty regulations B. Service-level agreements C. Rules of engagement D. Acceptable use policies

Question 7

A CTI program manager argues that sharing acts and regulations exist mainly to encourage organizations to exchange intelligence without fear of legal exposure. A new analyst asks what primary benefit these frameworks provide to participants. Which answer is most accurate?

A. Guaranteed prosecution of identified threat actors B. Mandatory automation of all indicator feeds C. Liability protection and legal clarity for sharing D. Elimination of the need for data anonymization

Question 8

A bank's legal team reviews a proposed exchange and asks the CTI team to strip personally identifiable information from indicators before distribution. An analyst asks why this step is required despite liability protections. What is the main reason?

A. It increases the volume of shareable indicators B. Privacy regulations still apply to personal data C. It converts tactical intelligence into strategic intelligence D. It satisfies Traffic Light Protocol color requirements

Question 9

A U.S. retailer wants automated, machine-readable threat indicators from the Department of Homeland Security under a government program built for real-time bidirectional exchange. An analyst asks which initiative provides this capability. Which is correct?

A. Automated Indicator Sharing program B. MITRE ATT&CK framework C. Pyramid of Pain model D. Cyber Kill Chain methodology

Question 10

An intelligence lead briefing executives explains that compliance with sharing acts and privacy regulations is a governance obligation tied to legal risk. A director asks who is ultimately accountable for ensuring lawful sharing practices. Which answer is most appropriate?

A. The individual SOC tier-1 analysts B. The external ISAC coordinator C. The SIEM platform vendor D. Organizational leadership and governance

EC-Council CTIA Module 6.7 Practice Test 001

Related Posts

Leave a Comment Cancel Reply