A threat intelligence team is comparing two incidents. Incident A: an attacker used a known exploit to install ransomware and demanded payment within 24 hours. Incident B: an attacker used a zero-day exploit, maintained access for six months, and exfiltrated data slowly. Which incident is more characteristic of an APT and why?

Incident B, because of the zero-day exploit and long-term persistence.

Incident B, because data exfiltration is always an APT objective.

Incident A, because ransomware is a sophisticated malware.

Incident A, because it caused immediate financial damage.

A security team notices a series of DDoS attacks against a company's website, accompanied by defacement of the homepage with political messages. The attacks appear coordinated and are timed around a company's announcement of a new product. Which threat actor profile best matches this behavior?

Nation-state actors conducting espionage.

Insiders with a grudge against the company.

Cybercriminals seeking financial gain through extortion.

Hacktivists motivated by ideology or political agenda.

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 2Objective 1

Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 6)

Part of the Cyber Threats and Attack Frameworks domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
Which stage of the Cyber Kill Chain involves the attacker gathering information about the target?
Select an answer first
27expert · hard
A threat intelligence team is comparing two incidents. Incident A: an attacker used a known exploit to install ransomware and demanded payment within 24 hours. Incident B: an attacker used a zero-day exploit, maintained access for six months, and exfiltrated data slowly. Which incident is more characteristic of an APT and why?
Select an answer first
28foundation · easy
Which of the following is a common threat vector?
Select an answer first
29application · medium
A security team notices a series of DDoS attacks against a company's website, accompanied by defacement of the homepage with political messages. The attacks appear coordinated and are timed around a company's announcement of a new product. Which threat actor profile best matches this behavior?
Select an answer first
30foundation · easy
Which characteristic is a defining feature of an Advanced Persistent Threat (APT)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 6)

Questions 26–30

Which stage of the Cyber Kill Chain involves the attacker gathering information about the target?

Which of the following is a common threat vector?

A security team notices a series of DDoS attacks against a company's website, accompanied by defacement of the homepage with political messages. The attacks appear coordinated and are timed around a company's announcement of a new product. Which threat actor profile best matches this behavior?

Which characteristic is a defining feature of an Advanced Persistent Threat (APT)?

Keep studying — Cyber Threats and Attack Frameworks