A threat intelligence team is analyzing a dataset of phishing URLs. They find that 95% of the URLs contain the word 'login'. They conclude that the word 'login' is a strong indicator of phishing. What is the primary flaw in this conclusion?

The conclusion is correct because the percentage is very high.

The team should have used a different statistical test.

The word 'login' is too common and therefore not a useful indicator.

The dataset may be biased because it only includes confirmed phishing URLs, not legitimate URLs.

A threat intelligence analyst is reviewing a year of data on ransomware attacks against the organization. The analyst notices that attacks are more frequent in the first quarter of the year. To determine if this is a real seasonal trend or just random variation, which analysis should the analyst perform?

Plot the data on a line chart and visually inspect for a pattern.

Compare the average number of attacks per quarter and perform a statistical test, such as a chi-square test, to see if the distribution differs from what would be expected by chance.

Calculate the median number of attacks per month and use that to predict next year's trend.

Simply count the attacks in each quarter and report the quarter with the highest count as the seasonal trend.

What is a key characteristic of quantitative analysis in threat intelligence?

It relies on expert opinions and narrative descriptions

It is used to create visual representations of data

It focuses on the motivations and intentions of threat actors

It uses numerical data and statistical methods to identify patterns

Which of the following is a common challenge in threat intelligence data analysis?

Excessive automation of analysis

Lack of any available threat data

Data overload from multiple sources

Inability to collect network logs

Which of the following is a benefit of correlating threat intelligence data?

It reduces the need for human analysis

It increases confidence in the accuracy of the intelligence

It guarantees the elimination of false positives

It automatically generates final intelligence reports

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 5Objective 1

Data Analysis Techniques CTIA Practice Questions (Page 7)

Part of the Data Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 31–35

31application · medium
A threat intelligence team is analyzing a dataset of phishing URLs. They find that 95% of the URLs contain the word 'login'. They conclude that the word 'login' is a strong indicator of phishing. What is the primary flaw in this conclusion?
Select an answer first
32application · medium
A threat intelligence analyst is reviewing a year of data on ransomware attacks against the organization. The analyst notices that attacks are more frequent in the first quarter of the year. To determine if this is a real seasonal trend or just random variation, which analysis should the analyst perform?
Select an answer first
33foundation · easy
What is a key characteristic of quantitative analysis in threat intelligence?
Select an answer first
34foundation · easy
Which of the following is a common challenge in threat intelligence data analysis?
Select an answer first
35foundation · easy
Which of the following is a benefit of correlating threat intelligence data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.