Which of the following is an example of dynamic malware analysis?

Disassembling the malware to analyze its code

Examining the malware's binary code for suspicious strings

Checking the file's hash against known malware databases

Running the malware in a sandbox to observe its behavior

An analyst is examining the timing of ransomware attacks against their organization. The attacks occurred at 2:00 AM, 3:00 AM, and 4:00 AM on three consecutive days. The analyst wants to determine if this pattern is meaningful. What is the best next step?

Create a heat map of attack times to visualize the pattern.

Conclude that the attacker operates only during early morning hours.

Collect more data over a longer period to see if the pattern holds.

Immediately change all passwords because the pattern indicates a targeted attack.

An analyst is investigating a series of login attempts against a corporate VPN. The source IP addresses are distributed across several countries, but the timestamps of the attempts show a consistent pattern: they occur during the business hours of a single time zone. The analyst wants to determine whether the attacks are likely from a single coordinated group or from multiple independent actors. Which combination of spatial and correlation analysis would best support this determination?

Map the source IPs to their geolocations and overlay the login timestamps converted to UTC, then cluster the attempts by time-of-day to see if they align to one region's working hours.

Perform a whois lookup on each IP and compare the registered owner names to find common organizations.

Count the number of unique source IPs per country and rank them by volume to identify the most active country.

Check whether the source IPs belong to known VPN providers and assume that any VPN usage indicates a single actor.

A SOC team has been using a single file hash as an IoC to detect a specific malware strain. Recently, the detection rate has dropped significantly. The team suspects the malware authors are using hash-changing techniques. What is the most effective response?

Increase the frequency of hash updates to keep up with the changes.

Switch to using behavioral indicators and YARA rules that detect the malware's common characteristics.

Update the hash by obtaining the new variant's hash from a threat feed.

Remove the IoC because it is no longer useful.

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 5Objective 1

Data Analysis Techniques CTIA Practice Questions (Page 5)

Part of the Data Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 21–25

21foundation · easy
Which of the following is an example of dynamic malware analysis?
Select an answer first
22foundation · easy
Which of the following is a common tool used for threat intelligence data analysis?
Select an answer first
23application · medium
An analyst is examining the timing of ransomware attacks against their organization. The attacks occurred at 2:00 AM, 3:00 AM, and 4:00 AM on three consecutive days. The analyst wants to determine if this pattern is meaningful. What is the best next step?
Select an answer first
24application · medium
An analyst is investigating a series of login attempts against a corporate VPN. The source IP addresses are distributed across several countries, but the timestamps of the attempts show a consistent pattern: they occur during the business hours of a single time zone. The analyst wants to determine whether the attacks are likely from a single coordinated group or from multiple independent actors. Which combination of spatial and correlation analysis would best support this determination?
Select an answer first
25expert · hard
A SOC team has been using a single file hash as an IoC to detect a specific malware strain. Recently, the detection rate has dropped significantly. The team suspects the malware authors are using hash-changing techniques. What is the most effective response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Data Analysis Techniques CTIA Practice Questions (Page 5)

Questions 21–25

Which of the following is an example of dynamic malware analysis?

Which of the following is a common tool used for threat intelligence data analysis?

An analyst is examining the timing of ransomware attacks against their organization. The attacks occurred at 2:00 AM, 3:00 AM, and 4:00 AM on three consecutive days. The analyst wants to determine if this pattern is meaningful. What is the best next step?

A SOC team has been using a single file hash as an IoC to detect a specific malware strain. Recently, the detection rate has dropped significantly. The team suspects the malware authors are using hash-changing techniques. What is the most effective response?

Keep studying — Data Analysis