Which of the following is a common internal source of threat intelligence?

A public vulnerability database

A commercial threat feed from a security vendor

Firewall logs from the organization's own network

Which of the following best describes threat information?

A collection of raw, unprocessed data points such as IP addresses and hashes

A type of malware that steals information from systems

Organized data that provides context but lacks the analysis needed for decisions

Contextualized data that has been analyzed to support decisions

What is the role of threat intelligence communities and platforms?

To provide a legal defense against cyberattacks

To replace the need for commercial antivirus products

To facilitate the exchange of threat data and insights among members

To automate all security operations

A threat intelligence platform needs to share structured indicators (e.g., IP addresses, hashes) with partner organizations. The platform must also support automated transport of these indicators. Which combination of standards best fulfills this requirement?

STIX for transport and OpenIOC for representation

TAXII for representation and STIX for transport

Cyber Kill Chain for representation and OpenIOC for transport

STIX for representation and TAXII for transport

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 1Objective 1

Introduction to Threat Intelligence CTIA Practice Questions (Page 1)

Part of the Threat Intelligence Fundamentals domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

12 Concepts in This Objective

Definition of Threat Intelligence
Threat Intelligence vs. Threat Data vs. Threat Information
Goals of Threat Intelligence
Threat Intelligence Users and Use Cases
Threat Intelligence Lifecycle
Strategic, Tactical, Operational, and Technical Intelligence
Threat Intelligence Sources
Threat Intelligence Feeds and APIs
Indicators of Compromise (IoCs)
Threat Intelligence Sharing and Communities
Challenges in Threat Intelligence
Threat Intelligence Standards and Frameworks

Questions 1–5

1foundation · easy
Which type of threat intelligence consists of indicators of compromise such as IP addresses and hashes?
Select an answer first
2foundation · easy
Which of the following is a common internal source of threat intelligence?
Select an answer first
3foundation · easy
Which of the following best describes threat information?
Select an answer first
4foundation · easy
What is the role of threat intelligence communities and platforms?
Select an answer first
5application · medium
A threat intelligence platform needs to share structured indicators (e.g., IP addresses, hashes) with partner organizations. The platform must also support automated transport of these indicators. Which combination of standards best fulfills this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.