After correlating network traffic with known malware signatures, an analyst identifies a pattern of beaconing to a command-and-control server. What should the analyst do next to support decision-making?

Delete the correlated data to reduce noise

Store the raw data without any interpretation

Immediately disconnect the server without further analysis

Apply analytical methods to assess the severity and impact of the beaconing activity

An analyst is building a threat intelligence report and has collected indicators from multiple open-source feeds. Some feeds contradict each other: one flags an IP as malicious, another lists it as clean. Before including the IP in the report, what should the analyst do?

Normalize the IP to a standard format and include it as a confirmed indicator

Cross-validate the indicator against multiple independent sources and assess the credibility of each feed

Choose the feed that is most convenient to access and use its data

Include the IP in the report with a note that sources disagree

A threat intelligence team needs to store processed indicators for long-term retention and compliance. The team must ensure data integrity, support rapid retrieval for investigations, and comply with data retention policies. The team is considering different storage solutions. What is the best approach?

Store all data in a cloud storage bucket without access controls

Keep data in a local spreadsheet with no backup

Use a structured database with encryption, access controls, and automated retention policies

Delete all data after analysis to avoid compliance issues

A security operations center receives millions of raw log events daily, but only a small fraction are relevant to active threats. The analyst needs to focus on actionable intelligence without losing important context. Which approach best achieves this?

Aggregate all events into a single summary report

Apply filtering criteria to remove known benign and redundant events while retaining events that match threat indicators

Enrich every event with external threat intelligence

Store all raw events without any processing

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 2

Data Processing and Exploitation CTIA Practice Questions (Page 5)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 21–25

21application · medium
After correlating network traffic with known malware signatures, an analyst identifies a pattern of beaconing to a command-and-control server. What should the analyst do next to support decision-making?
Select an answer first
22application · medium
An analyst is building a threat intelligence report and has collected indicators from multiple open-source feeds. Some feeds contradict each other: one flags an IP as malicious, another lists it as clean. Before including the IP in the report, what should the analyst do?
Select an answer first
23expert · hard
A threat intelligence team needs to store processed indicators for long-term retention and compliance. The team must ensure data integrity, support rapid retrieval for investigations, and comply with data retention policies. The team is considering different storage solutions. What is the best approach?
Select an answer first
24foundation · easy
An analyst has a list of IP addresses from a security incident. To better understand the threat actor's infrastructure, the analyst looks up WHOIS information, geolocation, and open ports for each IP. This process is known as:
Select an answer first
25application · medium
A security operations center receives millions of raw log events daily, but only a small fraction are relevant to active threats. The analyst needs to focus on actionable intelligence without losing important context. Which approach best achieves this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Data Processing and Exploitation CTIA Practice Questions (Page 5)

Questions 21–25

After correlating network traffic with known malware signatures, an analyst identifies a pattern of beaconing to a command-and-control server. What should the analyst do next to support decision-making?

An analyst is building a threat intelligence report and has collected indicators from multiple open-source feeds. Some feeds contradict each other: one flags an IP as malicious, another lists it as clean. Before including the IP in the report, what should the analyst do?

An analyst has a list of IP addresses from a security incident. To better understand the threat actor's infrastructure, the analyst looks up WHOIS information, geolocation, and open ports for each IP. This process is known as:

A security operations center receives millions of raw log events daily, but only a small fraction are relevant to active threats. The analyst needs to focus on actionable intelligence without losing important context. Which approach best achieves this?

Keep studying — Data Collection and Processing