EC-Council CTIA Module 6.9 Practice Test 002

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 9 (Threat Intelligence Sharing and Collaboration using Python Scripting).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.9 Practice Test 002

10 questions • Single best answer

Question 1

A SOC automation engineer at an MSSP writes a Python script that automatically forwards newly confirmed indicators to partner organizations. The team wants the output to be machine-readable across different tools. Which standardized representation should the script produce?

A. CSV email attachment B. Plain-text wiki entry C. STIX D. PDF incident report

Question 2

An analyst develops a Python client that retrieves shared threat content from a partner's intelligence server. The exchange relies on a protocol built specifically for moving threat content between organizations. What is this protocol's primary function?

A. Transporting structured threat data between parties B. Sandboxing suspicious binaries C. Correlating SIEM alerts D. Encrypting endpoint disks

Question 3

A CTI developer scripts automated pulls of indicators from a widely used open-source platform through its API. The platform supports correlation and community sharing of IoCs. Which platform is being used?

A. Wireshark B. Nessus C. Metasploit D. MISP

Question 4

A threat hunter writes a script that flags a malware family using distinctive strings and byte sequences in files. She wants to share the detection logic in a format built for identifying and classifying malware. Which format fits?

A. Snort signatures B. YARA rules C. Sigma rules D. Suricata rules

Question 5

A development team integrates threat sharing into their pipeline using a dedicated Python library that wraps a popular sharing platform's API. The library lets them create events and push indicators programmatically. Which library are they most likely using?

A. Scapy B. BeautifulSoup C. PyMISP D. Pandas

Question 6

An analyst writes Python code to ingest a threat feed delivered over the web. The feed returns lightweight, human-readable structured text that the script parses directly into objects. Which data format is most likely being consumed?

A. JSON B. PCAP C. ELF binary D. DOCX

Question 7

A CTI lead designs a sharing arrangement where one central organization collects intelligence and redistributes it to all members. Members do not exchange directly with each other. Which sharing model is described?

A. Peer-to-peer model B. Post-to-all model C. Open bus model D. Hub-and-spoke model

Question 8

A program manager clarifies team terminology. She notes that producing and packaging the finished report is one step, while delivering it to the right consumers is another. What term describes delivering intelligence to its intended audience?

A. Collection B. Dissemination C. Enrichment D. Normalization

Question 9

A compliance officer advises the CTI team on the U.S. law that encourages voluntary exchange of cyber threat indicators between private companies and the government, offering liability protections. Which law is being referenced?

A. Cybersecurity Information Sharing Act (CISA 2015) B. HIPAA C. Sarbanes-Oxley Act D. Gramm-Leach-Bliley Act

Question 10

An engineer automates outbound sharing so confirmed indicators reach partners within seconds instead of manual emails sent hours later. What is the main advantage of scripting threat intelligence sharing this way?

A. It guarantees zero false positives B. It removes the need for any data standards C. Faster, scalable distribution at machine speed D. It eliminates the need for analysts

EC-Council CTIA Module 6.9 Practice Test 002

Related Posts

Leave a Comment Cancel Reply