EC-Council CTIA Module 7.2 Practice Test 003

This practice test covers Module 7 (Threat Hunting and Detection) Sub-module 2 (Threat Hunting Automation).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Practice Test of the Day 260702

10 questions • Single best answer

Question 1

A threat hunting team at a cloud provider automates repetitive detection queries so analysts focus on complex investigations. A manager names the goal. What does hunting automation mainly deliver?

A. Efficiency and consistency at scale B. Guaranteed zero false positives C. Complete removal of analysts D. Slower, ad hoc searching

Question 2

An engineer scripts hunts in Python to query logs and flag suspicious patterns automatically. A colleague asks what tasks suit automation best. Which fits?

A. Novel hypothesis creation B. Executive strategy decisions C. Repetitive, well-defined queries D. Legal contract negotiation

Question 3

A team wants automated hunts to run on a fixed schedule without an analyst launching them. An engineer names the enabler. What should be configured?

A. A manual approval for each run B. A scheduled job or orchestration workflow C. A printed checklist D. A one-time script deletion

Question 4

A SOC integrates automated hunts with response tools so confirmed findings trigger containment actions. A colleague names this broader capability. What is it?

A. Manual quarterly audits B. Paper-based reporting C. Static asset inventory D. Security orchestration and automation

Question 5

An engineer worries fully automated hunts might miss creative adversary behavior. A senior hunter advises a balance. What approach is recommended?

A. Combine automation with human analysis B. Automate every decision entirely C. Abandon automation completely D. Only hunt once a year manually

Question 6

A developer's automated hunt pulls data from multiple APIs and must parse varied responses reliably. A reviewer names a needed feature. What should the script include?

A. Hardcoded single-format assumptions B. No response checking at all C. Robust parsing and error handling D. Deletion of all returned data

Question 7

A hunting lead wants automation to enrich flagged hosts with threat intelligence before an analyst reviews them. A colleague names the benefit. What does this enrichment provide?

A. Random reordering of alerts B. Removal of all context C. Longer manual lookups D. Faster, context-rich triage

Question 8

A manager measures whether automation actually reduces time from hunt start to detection. An analyst names the relevant metric type. What should be tracked?

A. Office coffee consumption B. Mean time to detect C. Number of desk chairs D. Parking lot capacity

Question 9

A team automates recurring hunts but wants each run's results stored for trend analysis over time. An engineer names the practice. What should the pipeline do?

A. Log and persist hunt results B. Discard results after each run C. Overwrite prior data silently D. Email results then delete them

Question 10

A new hunter confuses automating queries with replacing the whole hunting process. The lead clarifies. Which statement is most accurate?

A. Automation replaces hypotheses and judgment B. Automation only slows investigations C. Automation accelerates tasks while humans guide hunts D. Automation removes the need for data

EC-Council CTIA Module 7.2 Practice Test 003

Related Posts

Leave a Comment Cancel Reply