During an incident response, an analyst discovers that several internal hosts communicated with the same external IP. The analyst also finds that the external IP resolves to a domain that was registered by the same person who registered a domain used in a previous phishing campaign. What technique would best reveal the full extent of the infrastructure?

Conduct static analysis of the malware used in the phishing campaign.

Calculate the frequency of communications between hosts and the external IP.

Build a relationship graph linking the domains, IPs, and registration details.

Perform a time-series analysis of the communications.

An analyst has created a complex graph showing the relationships between various threat actors, malware families, and campaigns. The analyst needs to present this to a non-technical audience and highlight the most important relationships. Which visualization technique is most effective?

Use a table listing all relationships in text form.

Present the full graph with all nodes and edges, and let the audience explore it.

Simplify the graph to show only the top relationships and use color coding to distinguish between actors, malware, and campaigns.

Use a pie chart showing the proportion of each type of entity.

An analyst receives an unknown executable from a compromised host. The analyst needs to determine the malware's behavior, such as file system changes, registry modifications, and network connections, without risking the production environment. Which approach should the analyst take?

Run the executable in a controlled sandbox environment and monitor its system calls, file activity, and network traffic.

Execute the executable on a production host with endpoint detection and response (EDR) monitoring.

Perform static analysis by examining the executable's strings and imports without executing it.

Upload the executable to a public malware analysis service and wait for the report.

A threat intelligence team is correlating data from a commercial feed that flags a domain as malicious and from an internal proxy log that shows a single user visited that domain. The commercial feed has a known false positive rate of 5%. The team must decide whether to block the domain. Which decision-making approach is most appropriate?

Block the domain only if the user visited it more than once.

Block the domain immediately because the feed is commercial and likely accurate.

Do not block the domain because the false positive rate is too high.

Consider the false positive rate of the feed and the potential impact of blocking the domain on business operations before deciding.

What is the primary function of a platform like MISP in threat intelligence analysis?

To perform packet capture and analysis

To scan networks for vulnerabilities

To share and correlate indicators of compromise

To automate penetration testing

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 5Objective 1

Data Analysis Techniques CTIA Practice Questions (Page 1)

Part of the Data Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 1–5

1application · medium
During an incident response, an analyst discovers that several internal hosts communicated with the same external IP. The analyst also finds that the external IP resolves to a domain that was registered by the same person who registered a domain used in a previous phishing campaign. What technique would best reveal the full extent of the infrastructure?
Select an answer first
2application · medium
An analyst has created a complex graph showing the relationships between various threat actors, malware families, and campaigns. The analyst needs to present this to a non-technical audience and highlight the most important relationships. Which visualization technique is most effective?
Select an answer first
3application · medium
An analyst receives an unknown executable from a compromised host. The analyst needs to determine the malware's behavior, such as file system changes, registry modifications, and network connections, without risking the production environment. Which approach should the analyst take?
Select an answer first
4expert · hard
A threat intelligence team is correlating data from a commercial feed that flags a domain as malicious and from an internal proxy log that shows a single user visited that domain. The commercial feed has a known false positive rate of 5%. The team must decide whether to block the domain. Which decision-making approach is most appropriate?
Select an answer first
5foundation · easy
What is the primary function of a platform like MISP in threat intelligence analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Data Analysis Techniques CTIA Practice Questions (Page 1)

Questions 1–5

An analyst has created a complex graph showing the relationships between various threat actors, malware families, and campaigns. The analyst needs to present this to a non-technical audience and highlight the most important relationships. Which visualization technique is most effective?

An analyst receives an unknown executable from a compromised host. The analyst needs to determine the malware's behavior, such as file system changes, registry modifications, and network connections, without risking the production environment. Which approach should the analyst take?

What is the primary function of a platform like MISP in threat intelligence analysis?

Keep studying — Data Analysis