An analyst is analyzing a dataset of malware hashes collected from a single sandbox environment over the past year. The dataset contains many hashes that are unique to that sandbox and have never been seen in the wild. The analyst wants to identify which hashes are most likely to be relevant to the organization's threat landscape. Which pitfall in data analysis is most important to avoid?

Failing to visualize the data, which may obscure patterns.

Overfitting to the sandbox's unique environment, which may generate artifacts not representative of real-world threats.

Using a small sample size, which may not be statistically significant.

Ignoring the temporal distribution of the hashes, which may hide trends.

An analyst is using a threat intelligence platform (TIP) to manage IoCs from multiple sources. The analyst notices that the same IP address is flagged as malicious by one source and benign by another. What is the best way to handle this discrepancy within the TIP?

Rely on the source with the highest reputation without further analysis.

Manually mark the IP as malicious based on the first source that flagged it.

Delete the IP from the TIP to avoid confusion.

Create a custom correlation rule that combines the IP with other indicators to determine a confidence score.

What is the primary difference between static and dynamic malware analysis?

Static analysis is faster, while dynamic analysis is more accurate

Static analysis is automated, while dynamic analysis is manual

Static analysis is used for network malware, while dynamic analysis is used for file-based malware

Static analysis examines the malware without executing it, while dynamic analysis executes it in a controlled environment

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 5Objective 1

Data Analysis Techniques CTIA Practice Questions (Page 8)

Part of the Data Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

13concepts

Questions 36–40

36expert · hard
An analyst is analyzing a dataset of malware hashes collected from a single sandbox environment over the past year. The dataset contains many hashes that are unique to that sandbox and have never been seen in the wild. The analyst wants to identify which hashes are most likely to be relevant to the organization's threat landscape. Which pitfall in data analysis is most important to avoid?
Select an answer first
37foundation · easy
Which of the following is an example of a data visualization technique?
Select an answer first
38application · medium
An analyst is using a threat intelligence platform (TIP) to manage IoCs from multiple sources. The analyst notices that the same IP address is flagged as malicious by one source and benign by another. What is the best way to handle this discrepancy within the TIP?
Select an answer first
39foundation · easy
What is the primary difference between static and dynamic malware analysis?
Select an answer first
40foundation · easy
Which of the following is a common type of IoC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Data Analysis Techniques CTIA Practice Questions (Page 8)

Questions 36–40

Which of the following is an example of a data visualization technique?

An analyst is using a threat intelligence platform (TIP) to manage IoCs from multiple sources. The analyst notices that the same IP address is flagged as malicious by one source and benign by another. What is the best way to handle this discrepancy within the TIP?

What is the primary difference between static and dynamic malware analysis?

Which of the following is a common type of IoC?

Keep studying — Data Analysis