EC-Council CTIA Module 6.8 Practice Test 002

This practice test covers Module 6 (Intelligence Reporting and Dissemination) Sub-module 8 (Threat Intelligence Integration).

These questions are inspired by the EC-Council CTIA exam and are designed to help you test your knowledge of cyber threat intelligence, threats and frameworks, and other related topics. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CTIA exam.

Note: CTIA is a registered trademark of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CTIA practice tests based on specific modules and sub-modules, click that link

EC-Council CTIA Module 6.8 Practice Test 002

10 questions • Single best answer

Question 1

An MSSP integration engineer is connecting a curated threat feed to a client's defensive stack. The goal is to automatically block known malicious indicators before they reach internal hosts. Where should these indicators be pushed?

A. SIEM dashboards only B. Firewalls and IDS/IPS C. Threat intelligence reports D. Analyst runbooks

Question 2

A SOC analyst wants collected indicators automatically matched against incoming log events to trigger alerts. She needs the platform that correlates intelligence with internal telemetry in real time. Which system should receive the feed?

A. SIEM B. Ticketing system C. Wiki knowledge base D. Email gateway

Question 3

An incident response team is overwhelmed by manual enrichment of alerts. Their lead wants intelligence-driven playbooks that automatically gather context and execute response actions. Which platform best enables this orchestration?

A. SIEM B. TIP C. SOAR D. IDS

Question 4

A threat intelligence team integrates feeds from multiple vendors into one platform. To ensure machine-readable, structured exchange across these tools, they adopt a common representation language. Which standard structures the intelligence itself?

A. TAXII B. STIX C. YARA D. CSV exports

Question 5

After standardizing their intelligence format, a CTI engineer needs an automated protocol to transport and exchange feeds between servers and clients. He selects a dedicated application-layer service for this delivery. Which protocol handles the transport?

A. TAXII B. STIX C. SMTP D. SNMP

Question 6

A financial institution merges intelligence from six external sources, producing many overlapping and conflicting indicator entries. Before integration into the SIEM, analysts must reconcile these entries. What process removes redundant indicators?

A. Dissemination B. Attribution C. Deduplication D. Tagging

Question 7

A threat hunter wants newly discovered file hashes from intelligence feeds automatically searched across all workstations and servers. She integrates the feed with the agent-based detection layer. Which tool receives these indicators?

A. EDR platform B. Firewall C. Report template D. HR system

Question 8

An intelligence lead prepares output for the board of directors covering adversary trends and business risk, avoiding deep technical detail. She must choose the appropriate report category for this executive audience. Which report type fits best?

A. Tactical report B. Technical IoC feed C. Strategic report D. Operational alert

Question 9

After analysis, a CTI team must deliver finished intelligence to the specific internal stakeholders who requested it, in a usable format. A new analyst confuses this with publishing externally. What is this internal delivery step called?

A. Collection B. Dissemination C. Integration D. Attribution

Question 10

A malware analyst studies a new trojan and writes pattern-based detection rules describing its strings and byte sequences. She shares them so other teams can scan their own environments. Which rule format is she using?

A. Snort signatures B. Sigma rules C. STIX objects D. YARA rules

EC-Council CTIA Module 6.8 Practice Test 002

Related Posts

Leave a Comment Cancel Reply