A malware analyst is examining a new sample that appears to be a downloader. Static analysis shows the sample is packed and contains encrypted strings. The analyst needs to determine the C2 domain and the file it downloads. Which approach is most efficient?

Run the sample in a sandbox and monitor network traffic and file system changes.

Compare the sample's hash to known malware databases.

Submit the sample to a public malware analysis service and wait for the report.

Manually unpack the sample and decrypt the strings using a debugger.

In threat data analysis, what does the mean of a dataset represent?

The middle value when the data is sorted

The difference between the highest and lowest values

The most frequently occurring value

The average of all values in the dataset

A SOC analyst is reviewing a set of IoCs extracted from a recent malware sample. The IoCs include a file hash, a C2 domain, and a registry key. The analyst wants to determine which IoCs are most likely to be useful for detecting future infections. What should the analyst consider?

The reliability depends on the context and the ability to correlate with other indicators.

The C2 domain is the most reliable because it is required for the malware to communicate.

The file hash is the most reliable because it uniquely identifies the malware file.

The registry key is the most reliable because it persists on the system.

What is the main goal of relationship analysis in threat intelligence?

To identify the geographic origin of an attack

To determine the statistical significance of data

To map connections between entities to reveal hidden associations

To analyze the timing of attack patterns

What is the primary purpose of data analysis in the threat intelligence lifecycle?

To store threat data in a secure repository for future reference

To replace human judgment with automated decision-making

To transform raw data into actionable intelligence that supports decision-making

To automate the collection of threat data from multiple sources

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 5Objective 1

Data Analysis Techniques CTIA Practice Questions (Page 6)

Part of the Data Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 26–30

26expert · hard
A malware analyst is examining a new sample that appears to be a downloader. Static analysis shows the sample is packed and contains encrypted strings. The analyst needs to determine the C2 domain and the file it downloads. Which approach is most efficient?
Select an answer first
27foundation · easy
In threat data analysis, what does the mean of a dataset represent?
Select an answer first
28application · medium
A SOC analyst is reviewing a set of IoCs extracted from a recent malware sample. The IoCs include a file hash, a C2 domain, and a registry key. The analyst wants to determine which IoCs are most likely to be useful for detecting future infections. What should the analyst consider?
Select an answer first
29foundation · easy
What is the main goal of relationship analysis in threat intelligence?
Select an answer first
30foundation · easy
What is the primary purpose of data analysis in the threat intelligence lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.