A small security team wants to enrich its threat detection with external indicators but has a limited budget and no dedicated threat intelligence platform. They need a source that is freely accessible, provides a wide range of indicators, and can be integrated into their existing SIEM via a standard protocol. Which approach best meets these constraints?

Manually download indicators from a public website and enter them into the SIEM

Subscribe to open-source threat intelligence feeds and integrate them via STIX/TAXII

Purchase a commercial threat intelligence subscription and use a proprietary API

Rely solely on internal telemetry and historical incident data

A threat intelligence analyst is tasked with building a new intelligence capability. The analyst has gathered requirements from stakeholders, identified relevant sources, and started collecting data. According to the threat intelligence lifecycle, what should the analyst do next?

Process and analyze the collected data to produce intelligence

Collect more data from additional sources to ensure completeness

Immediately disseminate the raw data to all stakeholders

Solicit feedback from stakeholders before analysis

A mid-sized e-commerce company wants to prioritize its security investments for the next fiscal year. The security team has collected threat data from multiple sources but lacks a clear process to turn it into actionable insights for management. Which primary goal of threat intelligence should the team focus on to address this gap?

Collecting as much threat data as possible from all sources

Informing decisions with analyzed, contextualized data

Automatically blocking all indicators from external feeds

Sharing all collected data with industry partners immediately

A multinational corporation is establishing a threat intelligence program. The SOC requires tactical intelligence for daily alert triage, while the executive team needs strategic intelligence for risk reporting. The program has limited staff and must avoid overwhelming analysts with false positives. The team plans to use open-source feeds and internal telemetry. Which lifecycle approach best balances these competing needs?

Focus only on strategic intelligence for executives and skip tactical intelligence for the SOC

Use only commercial feeds and automate all blocking without human analysis

Collect as much data as possible from all sources, then disseminate everything to all stakeholders

Plan with stakeholders, collect from selected sources, process and analyze to produce both tactical and strategic products, disseminate appropriately, and gather feedback to refine

How do false positives affect threat intelligence?

They have no impact on security operations

They are always caused by malware

They reduce the credibility of intelligence and waste analyst time

They increase the accuracy of threat detection

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 1Objective 1

Introduction to Threat Intelligence CTIA Practice Questions (Page 6)

Part of the Threat Intelligence Fundamentals domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

12 Concepts in This Objective

Definition of Threat Intelligence
Threat Intelligence vs. Threat Data vs. Threat Information
Goals of Threat Intelligence
Threat Intelligence Users and Use Cases
Threat Intelligence Lifecycle
Strategic, Tactical, Operational, and Technical Intelligence
Threat Intelligence Sources
Threat Intelligence Feeds and APIs
Indicators of Compromise (IoCs)
Threat Intelligence Sharing and Communities
Challenges in Threat Intelligence
Threat Intelligence Standards and Frameworks

Questions 26–30

26application · medium
A small security team wants to enrich its threat detection with external indicators but has a limited budget and no dedicated threat intelligence platform. They need a source that is freely accessible, provides a wide range of indicators, and can be integrated into their existing SIEM via a standard protocol. Which approach best meets these constraints?
Select an answer first
27application · medium
A threat intelligence analyst is tasked with building a new intelligence capability. The analyst has gathered requirements from stakeholders, identified relevant sources, and started collecting data. According to the threat intelligence lifecycle, what should the analyst do next?
Select an answer first
28application · medium
A mid-sized e-commerce company wants to prioritize its security investments for the next fiscal year. The security team has collected threat data from multiple sources but lacks a clear process to turn it into actionable insights for management. Which primary goal of threat intelligence should the team focus on to address this gap?
Select an answer first
29expert · hard
A multinational corporation is establishing a threat intelligence program. The SOC requires tactical intelligence for daily alert triage, while the executive team needs strategic intelligence for risk reporting. The program has limited staff and must avoid overwhelming analysts with false positives. The team plans to use open-source feeds and internal telemetry. Which lifecycle approach best balances these competing needs?
Select an answer first
30foundation · easy
How do false positives affect threat intelligence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Introduction to Threat Intelligence CTIA Practice Questions (Page 6)

Questions 26–30

A threat intelligence analyst is tasked with building a new intelligence capability. The analyst has gathered requirements from stakeholders, identified relevant sources, and started collecting data. According to the threat intelligence lifecycle, what should the analyst do next?

How do false positives affect threat intelligence?

Keep studying — Threat Intelligence Fundamentals