A threat intelligence analyst has collected a large dataset of indicators from an automated feed. The analyst notices that many indicators are duplicates or have incomplete fields, such as missing hashes. Before using this data for a report, what should the analyst do?

Aggregate the data and present it without further processing

Perform data validation and quality assurance to remove duplicates and fill or flag missing fields

Filter out all indicators with missing fields, regardless of their potential value

Use the data as-is because the feed is automated and likely accurate

A threat intelligence team must present a comprehensive view of a multi-stage attack to both technical and non-technical stakeholders. The technical team needs detailed indicators and correlation data, while executives need a high-level summary of impact and risk. The team has limited time to prepare the presentation. What is the most effective way to communicate the intelligence?

Create a layered dashboard with a high-level executive summary and drill-down views for technical details

Present only the executive summary to all stakeholders

Send a raw data dump and let stakeholders interpret it

Present only the technical details to all stakeholders

A junior analyst is tasked with processing raw threat data from various sources. The analyst asks what the first step should be after collecting the data. Based on the data processing lifecycle, what should the analyst do?

Publish the data to stakeholders

Normalize the data into a standard format

Store the data in a repository without any transformation

A threat intelligence platform receives IP addresses from firewall logs, domain names from DNS logs, and file hashes from antivirus reports. To correlate these indicators across the platform, what must be done first?

Aggregate the data into a single database table

Enrich the data with threat intelligence feeds

Visualize the data on a dashboard

Normalize the data into a common format, such as STIX or a defined schema

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 2

Data Processing and Exploitation CTIA Practice Questions (Page 1)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 1–5

1application · medium
A threat intelligence analyst has collected a large dataset of indicators from an automated feed. The analyst notices that many indicators are duplicates or have incomplete fields, such as missing hashes. Before using this data for a report, what should the analyst do?
Select an answer first
2expert · hard
A threat intelligence team must present a comprehensive view of a multi-stage attack to both technical and non-technical stakeholders. The technical team needs detailed indicators and correlation data, while executives need a high-level summary of impact and risk. The team has limited time to prepare the presentation. What is the most effective way to communicate the intelligence?
Select an answer first
3foundation · easy
In the threat intelligence data processing pipeline, which stage is primarily responsible for converting raw data from its original format into a consistent, structured representation that can be used by downstream analysis tools?
Select an answer first
4application · medium
A junior analyst is tasked with processing raw threat data from various sources. The analyst asks what the first step should be after collecting the data. Based on the data processing lifecycle, what should the analyst do?
Select an answer first
5foundation · easy
A threat intelligence platform receives IP addresses from firewall logs, domain names from DNS logs, and file hashes from antivirus reports. To correlate these indicators across the platform, what must be done first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Data Processing and Exploitation CTIA Practice Questions (Page 1)

Questions 1–5

A threat intelligence analyst has collected a large dataset of indicators from an automated feed. The analyst notices that many indicators are duplicates or have incomplete fields, such as missing hashes. Before using this data for a report, what should the analyst do?

In the threat intelligence data processing pipeline, which stage is primarily responsible for converting raw data from its original format into a consistent, structured representation that can be used by downstream analysis tools?

A junior analyst is tasked with processing raw threat data from various sources. The analyst asks what the first step should be after collecting the data. Based on the data processing lifecycle, what should the analyst do?

A threat intelligence platform receives IP addresses from firewall logs, domain names from DNS logs, and file hashes from antivirus reports. To correlate these indicators across the platform, what must be done first?

Keep studying — Data Collection and Processing