A threat hunting team has a mature SIEM with a large volume of logs and a dedicated hunting platform. They want to adopt a methodology that is driven by specific hypotheses about attacker behavior, rather than relying on known indicators. Which methodology should they choose?

A combination of all three methodologies, applied randomly to each hunt.

Analytics-driven hunting, using machine learning and anomaly detection to find unusual behavior.

Hypothesis-driven hunting, where the team develops hypotheses based on threat intelligence and adversary TTPs, then searches for evidence.

IOC-based hunting, using threat intelligence feeds to search for known malicious hashes and IPs.

Which data source is most likely to provide evidence of lateral movement within a network?

Endpoint detection and response (EDR) telemetry

A company wants to establish a sustainable threat hunting program. They have a small security team that also handles daily alert triage. The management wants to see measurable value from the program within six months. Which approach would BEST help achieve this?

Purchase an expensive threat hunting platform and rely on its automated reports.

Implement a structured hunting process with defined hypotheses, data sources, and metrics, and integrate findings into existing workflows.

Assign one analyst to hunt full-time and create a quarterly report of findings.

Conduct ad-hoc hunts whenever there is a new threat intelligence report.

A detection team has developed a new detection rule and wants to measure its effectiveness before deployment. They have a labeled dataset of 10,000 alerts, of which 500 are true positives. The rule produces 1,200 alerts, of which 400 are true positives. What is the most important metric to evaluate the rule's practical usefulness?

Precision, because it indicates how many alerts are true positives and thus how much analyst time is wasted on false positives

Recall, because it shows how many true positives were detected out of all actual positives

F1-score, because it balances precision and recall

Accuracy, because it shows the overall percentage of correct alerts

Which metric is most useful for measuring the effectiveness of a threat hunting program?

Number of hypotheses tested and validated

Number of alerts generated per day

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 7Objective 1

Threat Hunting and Detection CTIA Practice Questions (Page 9)

Part of the Threat Hunting and Operational Integration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 41–45

41application · medium
A threat hunting team has a mature SIEM with a large volume of logs and a dedicated hunting platform. They want to adopt a methodology that is driven by specific hypotheses about attacker behavior, rather than relying on known indicators. Which methodology should they choose?
Select an answer first
42foundation · easy
Which data source is most likely to provide evidence of lateral movement within a network?
Select an answer first
43application · medium
A company wants to establish a sustainable threat hunting program. They have a small security team that also handles daily alert triage. The management wants to see measurable value from the program within six months. Which approach would BEST help achieve this?
Select an answer first
44expert · hard
A detection team has developed a new detection rule and wants to measure its effectiveness before deployment. They have a labeled dataset of 10,000 alerts, of which 500 are true positives. The rule produces 1,200 alerts, of which 400 are true positives. What is the most important metric to evaluate the rule's practical usefulness?
Select an answer first
45foundation · easy
Which metric is most useful for measuring the effectiveness of a threat hunting program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.