EC-Council CTIA Module 7.2 Practice Test 001

This practice test covers Module 7 (Threat Hunting and Detection) Sub-module 2 (Threat Hunting Automation).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 7.2 Practice Test 001

10 questions • Single best answer

Question 1

An energy utility's hunting team repeats the same queries daily and wants results auto-flagged for review when anomalies appear. The lead proposes a tool category that orchestrates and runs these hunts automatically. Which category best fits?

A. Spreadsheets B. Vulnerability scanners C. SOAR platforms D. Email gateways

Question 2

A CTI engineer scripts a recurring hunt in Python that pulls logs, applies detection logic, and reports matches on a schedule. A manager asks the main benefit of automating this hunt. Which answer is most accurate?

A. It eliminates the need for any data sources B. It frees analysts to focus on complex investigations C. It guarantees no adversary will ever succeed D. It removes the need for a hypothesis

Question 3

A team automates hunts that look for adversary behaviors mapped to a knowledge base of techniques so coverage gaps are visible. An analyst asks which framework is commonly used to map and prioritize these automated hunts. Which is correct?

A. GDPR B. ITIL C. COBIT D. MITRE ATT&CK

Question 4

An analyst warns that fully automating every hunt with no human review risks missing novel attacks that no rule anticipates. A colleague asks what balanced approach addresses this. Which is most appropriate?

A. Automate routine hunts while keeping analyst-led hunts for novel threats B. Automate everything and remove all analysts C. Stop hunting and rely only on alerts D. Run hunts manually only once per year

Question 5

A hunting team integrates automated hunts with their SIEM so detection rules created from past hunts run continuously against new data. A manager asks what this continuous execution primarily achieves. Which answer fits?

A. Permanent deletion of all historical logs B. Automatic legal prosecution of attackers C. Persistent detection of recurring adversary behavior D. Elimination of the need for log sources

Question 6

A CTI developer wants his automated hunt scripts to be reusable and shareable across teams as standardized workflows. An analyst asks what artifact typically encodes these repeatable automated steps. Which is correct?

A. A YARA rule B. An executive brief C. A risk register D. A playbook

Question 7

A team notices their automated hunts generate excessive false positives, overwhelming analysts. A manager asks what action will most improve the signal quality of automated hunts. Which is most appropriate?

A. Tune and refine the detection logic B. Disable logging across the environment C. Increase the alert volume further D. Remove analysts from the workflow

Question 8

An organization at a high hunting maturity level runs automated, continuous data analysis to surface anomalies for hunters. An analyst asks what this automation level represents in the Hunting Maturity Model. Which is correct?

A. The initial stage with no data collection B. The most advanced, automated hunting stage C. A purely manual, ad-hoc stage D. A stage that abandons threat intelligence

Question 9

A hunter automates enrichment so each suspicious indicator is automatically checked against threat intelligence before an analyst sees it. A manager asks what this enrichment automation primarily improves. Which answer fits?

A. Permanent removal of all malware B. Conversion of hunts into compliance audits C. Faster, context-rich triage of findings D. Elimination of the threat intelligence team

Question 10

A CTI manager argues that automation should accelerate hunts but the hunter's hypothesis and judgment still drive what gets automated. A new engineer asks what role automation plays relative to the human hunter. Which answer is most accurate?

A. Automation augments and scales human-led hunting B. Automation fully replaces human hunters C. Automation removes the need for hypotheses D. Automation only works without any data

EC-Council CTIA Module 7.2 Practice Test 001

Related Posts

Leave a Comment Cancel Reply