A threat intelligence manager needs to present the top 10 malware families targeting the organization over the past quarter. The data is available in a structured database. The manager wants the presentation to be easily understood by non-technical executives. What should the manager do?

Create a bar chart showing the frequency of each malware family

Provide a raw database export of all malware detections

Write a detailed technical report on each malware family's behavior

List the malware families in a table without any visual representation

A threat intelligence analyst at a financial institution is ingesting firewall logs, DNS logs, and threat feeds. The firewall logs use a proprietary timestamp format, DNS logs use UTC, and threat feeds use ISO 8601. The analyst needs to correlate events across these sources to identify a potential command-and-control beacon. What should the analyst do FIRST to enable effective correlation?

Enrich the DNS logs with geolocation data before attempting correlation

Convert all timestamps to a single standard format and map fields to a common schema

Aggregate all logs into a single file and then filter for suspicious domains

Visualize the raw logs on a timeline to spot the beacon pattern manually

A threat intelligence team is monitoring a phishing campaign that uses multiple domains and IP addresses. The team needs to present a unified view of the campaign's infrastructure to executives. The raw data is stored in separate spreadsheets per source. What should the team do to create a comprehensive overview?

Enrich each domain with WHOIS information and present the raw spreadsheets

Aggregate the data from all sources into a single dataset, then visualize the relationships between domains and IPs

Filter the data to only include domains that are currently active

Normalize the data into a common format and store it in a database

Why is data validation and quality assurance important in the threat intelligence processing pipeline?

It ensures that the intelligence derived from the data is trustworthy and reliable

It standardizes data formats for easier analysis

It automatically generates threat intelligence reports

It reduces the storage space required for processed data

Before publishing a threat intelligence report, an analyst checks that the indicators are accurate, complete, and come from reliable sources. This process is known as:

Data validation and quality assurance

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 2

Data Processing and Exploitation CTIA Practice Questions (Page 2)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 6–10

6application · medium
A threat intelligence manager needs to present the top 10 malware families targeting the organization over the past quarter. The data is available in a structured database. The manager wants the presentation to be easily understood by non-technical executives. What should the manager do?
Select an answer first
7application · medium
A threat intelligence analyst at a financial institution is ingesting firewall logs, DNS logs, and threat feeds. The firewall logs use a proprietary timestamp format, DNS logs use UTC, and threat feeds use ISO 8601. The analyst needs to correlate events across these sources to identify a potential command-and-control beacon. What should the analyst do FIRST to enable effective correlation?
Select an answer first
8application · medium
A threat intelligence team is monitoring a phishing campaign that uses multiple domains and IP addresses. The team needs to present a unified view of the campaign's infrastructure to executives. The raw data is stored in separate spreadsheets per source. What should the team do to create a comprehensive overview?
Select an answer first
9foundation · easy
Why is data validation and quality assurance important in the threat intelligence processing pipeline?
Select an answer first
10foundation · easy
Before publishing a threat intelligence report, an analyst checks that the indicators are accurate, complete, and come from reliable sources. This process is known as:
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Data Processing and Exploitation CTIA Practice Questions (Page 2)

Questions 6–10

A threat intelligence manager needs to present the top 10 malware families targeting the organization over the past quarter. The data is available in a structured database. The manager wants the presentation to be easily understood by non-technical executives. What should the manager do?

Why is data validation and quality assurance important in the threat intelligence processing pipeline?

Before publishing a threat intelligence report, an analyst checks that the indicators are accurate, complete, and come from reliable sources. This process is known as:

Keep studying — Data Collection and Processing