A security manager wants to shift the organization from a purely reactive security posture to a more proactive one. The team currently relies on alerts from signature-based tools. What is the best first step to introduce threat hunting?

Replace all signature-based tools with a threat hunting platform

Conduct a hunt based on a hypothesis about a specific adversary that targets the industry

Increase the number of alerts generated by existing tools

Wait for the next major security incident to learn from it

A detection engineer is writing a Sigma rule to detect suspicious use of PowerShell that downloads an executable from an external IP address. The rule should minimize false positives while still catching the behavior. Which detection logic is most appropriate?

Alert when any process makes an outbound connection to an external IP address

Alert when PowerShell creates a process and the command line contains 'DownloadString' and a URL with an IP address

Alert when PowerShell is used and the user is a local administrator

Alert on any PowerShell process creation event

A security operations center (SOC) has implemented a new detection rule that flags any process creating a scheduled task with the name 'UpdateTask'. During a two-week validation period, the rule fired 500 times, but only 10 were confirmed as malicious. The SOC wants to improve the rule's precision without losing true positives. What should they do?

Increase the rule's alert severity to ensure analysts pay more attention.

Change the rule to alert on any scheduled task creation, regardless of name.

Add a condition that the scheduled task runs a binary from a user-writable directory or a remote share.

Disable the rule because it has too many false positives.

In the threat hunting process, what is the purpose of validating findings?

To automate the hunting process for future use

To collect more data from additional sources

To determine whether the observed activity is truly malicious or benign

To confirm that the hypothesis was correct and the hunt is complete

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 7Objective 1

Threat Hunting and Detection CTIA Practice Questions (Page 4)

Part of the Threat Hunting and Operational Integration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 16–20

16foundation · easy
Which data source is most useful for identifying command-and-control (C2) communication?
Select an answer first
17application · medium
A security manager wants to shift the organization from a purely reactive security posture to a more proactive one. The team currently relies on alerts from signature-based tools. What is the best first step to introduce threat hunting?
Select an answer first
18application · medium
A detection engineer is writing a Sigma rule to detect suspicious use of PowerShell that downloads an executable from an external IP address. The rule should minimize false positives while still catching the behavior. Which detection logic is most appropriate?
Select an answer first
19application · medium
A security operations center (SOC) has implemented a new detection rule that flags any process creating a scheduled task with the name 'UpdateTask'. During a two-week validation period, the rule fired 500 times, but only 10 were confirmed as malicious. The SOC wants to improve the rule's precision without losing true positives. What should they do?
Select an answer first
20foundation · easy
In the threat hunting process, what is the purpose of validating findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Threat Hunting and Detection CTIA Practice Questions (Page 4)

Questions 16–20

Which data source is most useful for identifying command-and-control (C2) communication?

A security manager wants to shift the organization from a purely reactive security posture to a more proactive one. The team currently relies on alerts from signature-based tools. What is the best first step to introduce threat hunting?

A detection engineer is writing a Sigma rule to detect suspicious use of PowerShell that downloads an executable from an external IP address. The rule should minimize false positives while still catching the behavior. Which detection logic is most appropriate?

In the threat hunting process, what is the purpose of validating findings?

Keep studying — Threat Hunting and Operational Integration