EC-Council CTIA Module 7.1 Practice Test 003

This practice test covers Module 7 (Threat Hunting and Detection) Sub-module 1 (Threat Hunting Concepts).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Practice Test of the Day 260702

10 questions • Single best answer

Question 1

An incident response team at a manufacturing plant proactively searches internal systems for hidden adversaries that bypassed alerts. A manager names this discipline. Which practice is being described?

A. Passive log archival B. Vendor patch management C. Firewall rule auditing D. Threat hunting

Question 2

A hunt lead starts investigations from a specific intelligence-driven premise about an adversary's behavior. A colleague names this style. Which type of hunting is it?

A. Random keyword searching B. Hypothesis-driven hunting C. Automated patch scanning D. Passive alert triage

Question 3

A CISO asks how mature the hunting team is, from ad hoc to fully automated. An analyst names the assessment model. Which framework applies?

A. Hunting Maturity Model (HMM) B. The Cyber Kill Chain C. The Diamond Model D. The MoSCoW method

Question 4

A hunter forms a hypothesis, investigates with tools, uncovers new patterns, and feeds findings back into future hunts. A colleague names this cycle. What is it?

A. The incident recovery plan B. The risk register C. The threat hunting loop D. The disclosure timeline

Question 5

A hunting program manager wants a repeatable methodology that embeds threat intelligence into structured hunts. An analyst names the approach. Which methodology fits?

A. CAN-SPAM compliance B. PCI DSS scoping C. OWASP Top 10 D. TaHiTI

Question 6

A new hunter asks which skills matter most for the role. The lead lists core competencies. Which set best reflects a threat hunter skillset?

A. Data analysis, OS knowledge, and adversary TTP understanding B. Graphic design and copywriting C. Payroll accounting and auditing D. Facilities and HVAC maintenance

Question 7

A SOC director distinguishes proactively searching for hidden threats from responding after an alert fires. An analyst clarifies the difference. Which statement is accurate?

A. Hunting only occurs after incidents close B. Hunting is proactive; incident response is reactive C. Both wait passively for alerts D. Incident response never uses intelligence

Question 8

A hunter bases a hunt on known adversary TTPs mapped in a behavioral framework rather than single indicators. A colleague names the framework. Which is most suitable?

A. The CAN-SPAM Act B. GDPR articles C. MITRE ATT&CK D. The Sarbanes-Oxley Act

Question 9

A program lead wants hunts to begin with clearly defined objectives before data collection and analysis. An analyst names the first phase. What comes first in the hunting process?

A. Publishing the final report B. Closing the investigation C. Purging all logs D. Defining the hypothesis and scope

Question 10

A manager values hunting because it surfaces threats that automated tools missed, strengthening defenses. An analyst names the primary benefit. What does hunting mainly improve?

A. Earlier detection of hidden threats B. Guaranteed elimination of all risk C. Lower electricity consumption D. Automatic regulatory immunity

EC-Council CTIA Module 7.1 Practice Test 003

Related Posts

Leave a Comment Cancel Reply