A security operations center wants to automatically block known malicious domains and IP addresses in its firewall. The team has access to a commercial threat intelligence feed that provides indicators in STIX format. What is the most efficient way to operationalize this feed?

Manually copy indicators from the feed into the firewall's blocklist each day

Ask the feed provider to send indicators via email and then type them into the firewall

Export the feed to a CSV file and upload it to the firewall weekly

Use a TAXII client to pull the feed and push indicators to the firewall via API

A financial services company is considering joining a threat intelligence sharing community to improve its defenses. The company is concerned about exposing sensitive internal information. What is the primary benefit of participating in such a community, and how can the company mitigate its concern?

Gain early warnings about emerging threats while sharing only anonymized or sanitized indicators

Outsource all security monitoring to the community

Receive free threat intelligence without contributing any data

Access proprietary threat intelligence from competitors

Which of the following is an example of an open-source threat intelligence source?

Internal DNS logs from the organization's own network

A public blog post from a security researcher

A vendor-specific threat feed that requires a paid subscription

A private threat intelligence platform used only by a specific industry group

Why is threat intelligence sharing important in cybersecurity?

It allows organizations to benefit from each other's knowledge and improve collective defense

It guarantees that all threats are automatically blocked

It is only required by law in all countries

It eliminates the need for internal security teams

What is the primary purpose of a threat intelligence feed?

To store historical threat data for legal purposes

To replace the need for antivirus software

To generate reports for executive management only

To provide a continuous stream of updated threat data for integration into security systems

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 1Objective 1

Introduction to Threat Intelligence CTIA Practice Questions (Page 3)

Part of the Threat Intelligence Fundamentals domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

12 Concepts in This Objective

Definition of Threat Intelligence
Threat Intelligence vs. Threat Data vs. Threat Information
Goals of Threat Intelligence
Threat Intelligence Users and Use Cases
Threat Intelligence Lifecycle
Strategic, Tactical, Operational, and Technical Intelligence
Threat Intelligence Sources
Threat Intelligence Feeds and APIs
Indicators of Compromise (IoCs)
Threat Intelligence Sharing and Communities
Challenges in Threat Intelligence
Threat Intelligence Standards and Frameworks

Questions 11–15

11application · medium
A security operations center wants to automatically block known malicious domains and IP addresses in its firewall. The team has access to a commercial threat intelligence feed that provides indicators in STIX format. What is the most efficient way to operationalize this feed?
Select an answer first
12application · medium
A financial services company is considering joining a threat intelligence sharing community to improve its defenses. The company is concerned about exposing sensitive internal information. What is the primary benefit of participating in such a community, and how can the company mitigate its concern?
Select an answer first
13foundation · easy
Which of the following is an example of an open-source threat intelligence source?
Select an answer first
14foundation · easy
Why is threat intelligence sharing important in cybersecurity?
Select an answer first
15foundation · easy
What is the primary purpose of a threat intelligence feed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.