A security analyst receives a raw log containing an IP address that was flagged by an external feed. After cross-referencing with internal telemetry, the analyst determines that the IP is part of a known campaign targeting the organization's industry and adds it to the blocklist. In this scenario, which statement best describes the IP address before and after the analyst's action?

Before: threat information; After: threat data

Before: threat information; After: threat intelligence

Before: threat data; After: threat intelligence

Before: threat intelligence; After: threat information

A cybersecurity manager is explaining to a new analyst why threat intelligence is more than just a list of malicious IP addresses. The manager wants to emphasize that intelligence must be actionable and tailored to the organization. Which statement best captures this definition?

Threat intelligence is the process of sharing all threat data with industry partners

Threat intelligence is any data that indicates a potential threat, regardless of context

Threat intelligence is analyzed information about threats that is relevant and actionable for an organization's specific context

Threat intelligence is the collection of as many indicators as possible from external sources

What is a common use case for threat intelligence by an incident response team?

Identifying the scope and indicators of a current breach

Setting the annual budget for marketing

Determining executive compensation

What is a primary goal of threat intelligence?

To inform security decisions and improve the organization's security posture

To replace the need for incident response teams

To guarantee that no security breach will ever occur

To eliminate all cyber threats permanently

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 1Objective 1

Introduction to Threat Intelligence CTIA Practice Questions (Page 8)

Part of the Threat Intelligence Fundamentals domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

12 Concepts in This Objective

Definition of Threat Intelligence
Threat Intelligence vs. Threat Data vs. Threat Information
Goals of Threat Intelligence
Threat Intelligence Users and Use Cases
Threat Intelligence Lifecycle
Strategic, Tactical, Operational, and Technical Intelligence
Threat Intelligence Sources
Threat Intelligence Feeds and APIs
Indicators of Compromise (IoCs)
Threat Intelligence Sharing and Communities
Challenges in Threat Intelligence
Threat Intelligence Standards and Frameworks

Questions 36–40

36foundation · easy
What is the first stage of the threat intelligence lifecycle?
Select an answer first
37application · medium
A security analyst receives a raw log containing an IP address that was flagged by an external feed. After cross-referencing with internal telemetry, the analyst determines that the IP is part of a known campaign targeting the organization's industry and adds it to the blocklist. In this scenario, which statement best describes the IP address before and after the analyst's action?
Select an answer first
38application · medium
A cybersecurity manager is explaining to a new analyst why threat intelligence is more than just a list of malicious IP addresses. The manager wants to emphasize that intelligence must be actionable and tailored to the organization. Which statement best captures this definition?
Select an answer first
39foundation · easy
What is a common use case for threat intelligence by an incident response team?
Select an answer first
40foundation · easy
What is a primary goal of threat intelligence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Introduction to Threat Intelligence CTIA Practice Questions (Page 8)

Questions 36–40

What is the first stage of the threat intelligence lifecycle?

A cybersecurity manager is explaining to a new analyst why threat intelligence is more than just a list of malicious IP addresses. The manager wants to emphasize that intelligence must be actionable and tailored to the organization. Which statement best captures this definition?

What is a common use case for threat intelligence by an incident response team?

What is a primary goal of threat intelligence?

Keep studying — Threat Intelligence Fundamentals