A threat intelligence team has aggregated data on a phishing campaign that targeted multiple departments. The team needs to present the findings to both technical and non-technical stakeholders. The technical team wants to see the infrastructure relationships, while executives want to see the business impact. What should the team do?

Create a single detailed technical report for all stakeholders

Present the raw aggregated data to both groups

Create two visualizations: a technical graph for the infrastructure and a high-level dashboard for the business impact

Create a single executive summary and skip the technical details

A threat intelligence platform is receiving a high volume of low-quality indicators from a new feed. The analyst wants to ensure that only high-confidence indicators are stored in the platform to avoid false positives. What should the analyst do?

Store all indicators from the feed and rely on analysts to manually review them later

Aggregate the indicators into a single list and store it as one record

Enrich all indicators with geolocation data to increase their value

Apply filtering rules based on confidence scores and validate indicators against known threat intelligence

What is the main purpose of data visualization in threat intelligence?

To store data in a structured repository

To normalize data from various sources

To automatically detect new threats

To communicate processed data and intelligence effectively to stakeholders

A threat intelligence team has been storing processed data in a shared network drive with no version control. Analysts have accidentally overwritten each other's work, and the team cannot determine which version of an indicator set is current. The team needs a solution that ensures data integrity and supports concurrent access. What should the team implement?

A policy that requires analysts to email changes to a single coordinator

A shared spreadsheet with read-only permissions for all analysts

A structured threat intelligence platform with versioning, access controls, and audit logging

A backup schedule that runs nightly on the network drive

A threat intelligence analyst has correlated data from multiple sources and identified a new malware variant. The analyst needs to determine the malware's capabilities and potential impact on the organization. What should the analyst do to extract actionable insights?

Filter the data to only include high-severity alerts

Perform behavioral analysis of the malware in a sandbox and map the findings to the organization's assets

Store the malware sample in the threat intelligence repository

Visualize the malware's network connections on a graph

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 2

Data Processing and Exploitation CTIA Practice Questions (Page 8)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 36–40

36expert · hard
A threat intelligence team has aggregated data on a phishing campaign that targeted multiple departments. The team needs to present the findings to both technical and non-technical stakeholders. The technical team wants to see the infrastructure relationships, while executives want to see the business impact. What should the team do?
Select an answer first
37application · medium
A threat intelligence platform is receiving a high volume of low-quality indicators from a new feed. The analyst wants to ensure that only high-confidence indicators are stored in the platform to avoid false positives. What should the analyst do?
Select an answer first
38foundation · easy
What is the main purpose of data visualization in threat intelligence?
Select an answer first
39expert · hard
A threat intelligence team has been storing processed data in a shared network drive with no version control. Analysts have accidentally overwritten each other's work, and the team cannot determine which version of an indicator set is current. The team needs a solution that ensures data integrity and supports concurrent access. What should the team implement?
Select an answer first
40application · medium
A threat intelligence analyst has correlated data from multiple sources and identified a new malware variant. The analyst needs to determine the malware's capabilities and potential impact on the organization. What should the analyst do to extract actionable insights?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Data Processing and Exploitation CTIA Practice Questions (Page 8)

Questions 36–40

A threat intelligence platform is receiving a high volume of low-quality indicators from a new feed. The analyst wants to ensure that only high-confidence indicators are stored in the platform to avoid false positives. What should the analyst do?

What is the main purpose of data visualization in threat intelligence?

A threat intelligence analyst has correlated data from multiple sources and identified a new malware variant. The analyst needs to determine the malware's capabilities and potential impact on the organization. What should the analyst do to extract actionable insights?

Keep studying — Data Collection and Processing