A security operations center (SOC) analyst is reviewing logs and notices that a workstation has been beaconing to an external IP every 60 seconds with small encrypted payloads. The workstation also shows a new scheduled task that runs a PowerShell script. Which set of indicators most strongly suggests an APT presence?

Network beaconing to an external IP and a suspicious scheduled task.

A single failed login attempt and an outdated antivirus signature.

An employee receiving a phishing email that was quarantined by the email gateway.

High CPU usage and a large number of open browser tabs.

A threat intelligence analyst is compiling indicators of compromise (IoCs) for an APT group that has been active in the organization. Which set of indicators would be most useful for detecting the APT's presence?

Behavioral indicators such as unusual lateral movement patterns and abnormal PowerShell usage.

A combination of network IoCs, file hashes, and behavioral indicators.

A list of known malicious IP addresses and domains used for C2.

File hashes of known malware samples used by the group.

A company is reviewing its attack surface after a breach that started with a phishing email and then exploited a vulnerability in a legacy VPN appliance. Which two attack surfaces were directly exploited in this incident?

Web server and database server.

Physical security and removable media.

Endpoint devices and cloud infrastructure.

Email gateway and VPN appliance.

A security operations center (SOC) is monitoring for APT activity. Which indicator would be most indicative of an APT rather than a common malware infection?

Repeated failed login attempts from a single IP address.

A spike in CPU usage on a single server.

A single alert for a known malware signature.

Unusual outbound connections to a domain registered three years ago.

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 2Objective 1

Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 8)

Part of the Cyber Threats and Attack Frameworks domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 36–40

36application · medium
A security operations center (SOC) analyst is reviewing logs and notices that a workstation has been beaconing to an external IP every 60 seconds with small encrypted payloads. The workstation also shows a new scheduled task that runs a PowerShell script. Which set of indicators most strongly suggests an APT presence?
Select an answer first
37application · medium
A threat intelligence analyst is compiling indicators of compromise (IoCs) for an APT group that has been active in the organization. Which set of indicators would be most useful for detecting the APT's presence?
Select an answer first
38application · medium
A company is reviewing its attack surface after a breach that started with a phishing email and then exploited a vulnerability in a legacy VPN appliance. Which two attack surfaces were directly exploited in this incident?
Select an answer first
39application · medium
A security operations center (SOC) is monitoring for APT activity. Which indicator would be most indicative of an APT rather than a common malware infection?
Select an answer first
40application · medium
An organization has been breached by an APT that maintained access for over a year. The attackers used multiple backdoors, rotated C2 infrastructure, and slowly exfiltrated data. Which characteristic of APTs is most clearly demonstrated by the attackers' use of multiple backdoors and rotating C2?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 8)

Questions 36–40

A threat intelligence analyst is compiling indicators of compromise (IoCs) for an APT group that has been active in the organization. Which set of indicators would be most useful for detecting the APT's presence?

A company is reviewing its attack surface after a breach that started with a phishing email and then exploited a vulnerability in a legacy VPN appliance. Which two attack surfaces were directly exploited in this incident?

A security operations center (SOC) is monitoring for APT activity. Which indicator would be most indicative of an APT rather than a common malware infection?

An organization has been breached by an APT that maintained access for over a year. The attackers used multiple backdoors, rotated C2 infrastructure, and slowly exfiltrated data. Which characteristic of APTs is most clearly demonstrated by the attackers' use of multiple backdoors and rotating C2?

Keep studying — Cyber Threats and Attack Frameworks