A defense contractor has been targeted by a series of attacks. The attacks include spear-phishing emails with zero-day exploits, use of custom malware, and lateral movement to systems containing military project data. The attackers have not demanded ransom and have not defaced any websites. The company's threat intelligence team must determine the most likely threat actor and motivation to prioritize defenses. Which assessment is most accurate?

Nation-state actors motivated by espionage, seeking military intelligence.

Cybercriminals motivated by financial gain, seeking to sell the stolen data.

Insiders motivated by revenge, leaking sensitive information.

Hacktivists motivated by ideology, aiming to expose military projects.

Which of the following is a behavioral indicator of compromise that might signal an APT?

A suspicious domain name in DNS logs

A file hash that matches a known malware signature

A user account logging in at unusual hours and accessing large volumes of data

An IP address that is blacklisted

A security analyst is reviewing a series of alerts and needs to identify which are strong indicators of an APT. Select all that apply.

A workstation beaconing to an external IP every 5 minutes with small encrypted packets.

A user account logging in from a new geographic location at 3:00 AM.

Large data transfer to a cloud storage service during business hours.

A scheduled task that runs a PowerShell script to download a file from a remote server.

A single failed login attempt on a user account.

Which of the following best defines a cyber threat?

A specific instance of an attack that has already occurred

Any potential event or action that could exploit a vulnerability and lead to unauthorized access, damage, or disruption of a system or data

A weakness in a system that could be exploited by an attacker

A measure taken to protect a system from unauthorized access

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 2Objective 1

Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 1)

Part of the Cyber Threats and Attack Frameworks domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 1–5

1expert · hard
A defense contractor has been targeted by a series of attacks. The attacks include spear-phishing emails with zero-day exploits, use of custom malware, and lateral movement to systems containing military project data. The attackers have not demanded ransom and have not defaced any websites. The company's threat intelligence team must determine the most likely threat actor and motivation to prioritize defenses. Which assessment is most accurate?
Select an answer first
2foundation · easy
Which of the following is a behavioral indicator of compromise that might signal an APT?
Select an answer first
3expert · hard · select all that apply
A security analyst is reviewing a series of alerts and needs to identify which are strong indicators of an APT. Select all that apply.
Select an answer first
4foundation · easy
Which of the following best defines a cyber threat?
Select an answer first
5foundation · easy
A group of attackers defaces a government website to protest a political decision. Which type of threat actor is most likely responsible?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 1)

Questions 1–5

Which of the following is a behavioral indicator of compromise that might signal an APT?

A security analyst is reviewing a series of alerts and needs to identify which are strong indicators of an APT. Select all that apply.

Which of the following best defines a cyber threat?

A group of attackers defaces a government website to protest a political decision. Which type of threat actor is most likely responsible?

Keep studying — Cyber Threats and Attack Frameworks