EC-Council CTIA Module 8.2 Practice Test 001

This practice test covers Module 8 (Threat Intelligence in SOC Operations, Incident Response, and Risk Management) Sub-module 2 (Threat Intelligence in Risk Management).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 8.2 Practice Test 001

10 questions • Single best answer

Question 1

A manufacturing firm's risk committee bases cyber risk scores on outdated assumptions about likely attacks. The CTI lead offers current adversary data to ground these estimates in evidence. How does threat intelligence improve risk management?

A. It eliminates all residual cyber risk B. It replaces guesswork with evidence-based likelihood C. It removes the need for risk assessments D. It guarantees no breach will occur

Question 2

A risk analyst combines the likelihood of a threat exploiting a weakness with the business impact if it does. An instructor asks what fundamental risk equation this reflects. Which is correct?

A. Risk = Budget x Headcount B. Risk = Uptime x Bandwidth C. Risk = Alerts x Logs D. Risk = Threat x Vulnerability x Impact

Question 3

A CTI team provides intelligence showing a threat actor actively targeting the organization's specific industry and technologies. A risk manager asks how this most directly affects the risk register. Which answer is most accurate?

A. It raises the likelihood rating for relevant risks B. It deletes the affected risk entries C. It converts the register into an incident report D. It freezes the register from any updates

Question 4

After threat intelligence elevates the risk of a ransomware campaign, leadership chooses to invest in offline backups and segmentation. A risk manager asks which risk treatment option this represents. Which is correct?

A. Risk acceptance B. Risk transfer C. Risk mitigation D. Risk avoidance

Question 5

A risk team uses strategic threat intelligence about long-term adversary trends to guide multi-year security investment planning. An analyst asks which intelligence tier best informs this executive-level risk planning. Which is correct?

A. Technical intelligence B. Tactical intelligence C. Operational intelligence D. Strategic intelligence

Question 6

A risk manager wants intelligence to help focus limited budget on the threats most likely to cause severe business harm. An analyst asks what this intelligence-driven approach to risk primarily enables. Which answer is most accurate?

A. Prioritization of resources by likely impact B. Equal spending across every possible threat C. Removal of the need for executive approval D. Guaranteed prevention of all incidents

Question 7

A CTI team feeds continuous threat updates into the risk process so assessments reflect the changing threat landscape rather than a single annual snapshot. A manager asks what this continuous input makes the risk process. Which answer is most accurate?

A. Static and reviewed once a year B. Dynamic and continuously updated C. Independent of any threat data D. Limited to historical incidents only

Question 8

A risk committee decides to purchase cyber insurance to offset potential losses from a threat intelligence highlights as severe but unlikely. An analyst asks which risk treatment this choice represents. Which is correct?

A. Risk mitigation B. Risk avoidance C. Risk transfer D. Risk acceptance

Question 9

A risk analyst maps intelligence about adversary capabilities to the organization's known vulnerabilities to see where exposure is greatest. A manager asks what this mapping primarily produces. Which answer is most accurate?

A. A clearer view of exploitable exposure B. A guarantee of zero vulnerabilities C. An automatic patch for every system D. A removal of all threat actors

Question 10

An executive asks the CTI team to express cyber risk in business terms, such as potential financial and operational impact, rather than purely technical detail. An analyst asks why this framing matters for risk management. Which answer is most accurate?

A. It hides the technical indicators entirely B. It replaces the need for any controls C. It converts risk into a marketing function D. It enables informed business decisions on risk

EC-Council CTIA Module 8.2 Practice Test 001

Related Posts

Leave a Comment Cancel Reply