A security analyst at a mid-sized company notices an unusual pattern: several workstations are making DNS queries to a rarely-used domain at 3:00 AM, but no alerts have fired. The analyst wants to determine whether this is malicious activity. Which approach best aligns with a hypothesis-driven threat hunting process?

Form a hypothesis that the domain is a command-and-control channel, then collect DNS logs, proxy logs, and endpoint process data to test it.

Run an automated antivirus scan on all workstations and wait for results.

Search threat intelligence feeds for the domain and, if not listed, conclude it is benign.

Immediately block the domain at the firewall and close the investigation.

Which statement best describes the role of threat hunting in a defense-in-depth strategy?

It is a reactive measure that activates only after a confirmed breach

It is primarily a compliance requirement rather than a security function

It is a proactive layer that complements preventive and detective controls

It is the final layer of defense that catches all threats missed by other controls

What is the main goal of testing detection rules before deployment?

To make them run faster than other rules

To verify they detect real threats without excessive false positives

To ensure they generate as many alerts as possible

What is the first step in a systematic threat hunting process?

Validating findings with automated tools

Documenting lessons learned for future hunts

Forming a hypothesis about potential adversary behavior

Collecting data from all available sources

A detection team has created a new detection rule for a known adversary technique. Before deploying it to production, they want to ensure it works and does not generate excessive false positives. What is the best validation approach?

Ask the threat intelligence team to confirm the technique is still relevant

Deploy the rule to production immediately and monitor for alerts

Compare the rule to a similar rule from another organization

Run the rule against historical log data and a test environment that simulates the technique

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 7Objective 1

Threat Hunting and Detection CTIA Practice Questions (Page 8)

Part of the Threat Hunting and Operational Integration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 36–40

36application · medium
A security analyst at a mid-sized company notices an unusual pattern: several workstations are making DNS queries to a rarely-used domain at 3:00 AM, but no alerts have fired. The analyst wants to determine whether this is malicious activity. Which approach best aligns with a hypothesis-driven threat hunting process?
Select an answer first
37foundation · easy
Which statement best describes the role of threat hunting in a defense-in-depth strategy?
Select an answer first
38foundation · easy
What is the main goal of testing detection rules before deployment?
Select an answer first
39foundation · easy
What is the first step in a systematic threat hunting process?
Select an answer first
40application · medium
A detection team has created a new detection rule for a known adversary technique. Before deploying it to production, they want to ensure it works and does not generate excessive false positives. What is the best validation approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.