An analyst is writing a threat intelligence report on a credential-stuffing campaign targeting the company's customer portal. The report will be disseminated to the incident response team, the application development team, and the customer support management. Which report element is essential to include to make the report actionable for all three audiences?

A statement that the campaign is ongoing and that no further action is needed at this time.

A copy of the raw HTTP logs from the credential-stuffing attempts.

A detailed list of all usernames and passwords that were compromised in the campaign.

A set of recommended actions, such as blocking IPs, implementing multi-factor authentication, and preparing customer notification scripts.

Which method is commonly used to disseminate an intelligence report to a broad internal audience?

Sending it via an internal email distribution list

Whispering the key points to each stakeholder individually

Posting it on a public social media platform

Printing and mailing physical copies to every employee

An analyst is writing a threat intelligence report about a series of data exfiltration incidents. The analyst has collected evidence from multiple sources, but some indicators are conflicting. Which of the following writing approaches best maintains objectivity and clarity?

Use strong language to emphasize the most likely conclusion, downplaying the conflicting indicators.

Present the conflicting indicators without comment, letting the reader draw their own conclusions.

Omit the conflicting indicators and only include the evidence that supports the main conclusion.

Acknowledge the conflicting indicators, explain the possible reasons for the discrepancies, and state the analyst's confidence in the overall assessment.

A threat intelligence team has produced a report on a new malware variant that is targeting the organization's point-of-sale systems. The report is approved for release to the IT security team and the fraud investigation team. Which dissemination method is most appropriate for this situation?

Verbally brief the teams on the report's contents and do not provide a written copy.

Publish the report on the company's internal wiki without any access restrictions.

Send the report via encrypted email to the distribution list of the IT security and fraud investigation teams.

Post the report on a public malware-analysis forum to get community feedback.

What is the primary benefit of writing an intelligence report in a clear and concise manner?

It ensures the report is longer and more comprehensive

It eliminates the need for an executive summary

It allows readers to quickly understand and act on the intelligence

It reduces the need for a review and approval process

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 6Objective 1

Intelligence Reporting CTIA Practice Questions (Page 6)

Part of the Intelligence Reporting and Dissemination domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

5concepts

Questions 26–30

26application · medium
An analyst is writing a threat intelligence report on a credential-stuffing campaign targeting the company's customer portal. The report will be disseminated to the incident response team, the application development team, and the customer support management. Which report element is essential to include to make the report actionable for all three audiences?
Select an answer first
27foundation · easy
Which method is commonly used to disseminate an intelligence report to a broad internal audience?
Select an answer first
28application · medium
An analyst is writing a threat intelligence report about a series of data exfiltration incidents. The analyst has collected evidence from multiple sources, but some indicators are conflicting. Which of the following writing approaches best maintains objectivity and clarity?
Select an answer first
29application · medium
A threat intelligence team has produced a report on a new malware variant that is targeting the organization's point-of-sale systems. The report is approved for release to the IT security team and the fraud investigation team. Which dissemination method is most appropriate for this situation?
Select an answer first
30foundation · easy
What is the primary benefit of writing an intelligence report in a clear and concise manner?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.