During an incident investigation, a security analyst finds a suspicious file hash, a command-and-control domain, and a unique user-agent string in the network logs. Which of these findings are considered indicators of compromise (IoCs)?

All three: file hash, domain, and user-agent string

Only the file hash and the domain

Only the domain and the user-agent string

Which statement best defines threat intelligence in the context of cybersecurity?

Raw logs and alerts collected from security devices without analysis

Evidence-based knowledge about threats that informs decision-making

A list of known malware hashes and malicious IP addresses

The process of patching vulnerabilities in an organization's systems

What is the purpose of the STIX standard in threat intelligence?

To provide a graphical interface for security analysts

To replace the need for firewalls

To provide a standardized language for describing threat information

To automate the patching of vulnerabilities

Which of the following is a key goal of threat intelligence?

To replace the need for security policies

To provide context that helps prioritize security efforts

To increase the number of security alerts

To automate all security operations

What is the definition of an indicator of compromise (IoC)?

A piece of evidence that suggests a system has been compromised

A security awareness training module

A tool used to patch vulnerabilities

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 1Objective 1

Introduction to Threat Intelligence CTIA Practice Questions (Page 5)

Part of the Threat Intelligence Fundamentals domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

12 Concepts in This Objective

Definition of Threat Intelligence
Threat Intelligence vs. Threat Data vs. Threat Information
Goals of Threat Intelligence
Threat Intelligence Users and Use Cases
Threat Intelligence Lifecycle
Strategic, Tactical, Operational, and Technical Intelligence
Threat Intelligence Sources
Threat Intelligence Feeds and APIs
Indicators of Compromise (IoCs)
Threat Intelligence Sharing and Communities
Challenges in Threat Intelligence
Threat Intelligence Standards and Frameworks

Questions 21–25

21application · medium
During an incident investigation, a security analyst finds a suspicious file hash, a command-and-control domain, and a unique user-agent string in the network logs. Which of these findings are considered indicators of compromise (IoCs)?
Select an answer first
22foundation · easy
Which statement best defines threat intelligence in the context of cybersecurity?
Select an answer first
23foundation · easy
What is the purpose of the STIX standard in threat intelligence?
Select an answer first
24foundation · easy
Which of the following is a key goal of threat intelligence?
Select an answer first
25foundation · easy
What is the definition of an indicator of compromise (IoC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.