A malware analyst has received a suspicious executable file from a threat intelligence sharing community. The analyst needs to collect indicators of compromise (IOCs) and behavioral data from the file. Which approach should be taken?

Perform static analysis only by examining the file's strings and metadata.

Delete the file immediately to avoid infection.

Run the executable in a sandbox environment and observe its behavior, then extract file hashes and network indicators.

Upload the file to VirusTotal and rely solely on its report.

When an analyst pulls indicators from a TISP into their internal threat intelligence platform, which of the following is the most important first step before using those indicators in detection rules?

Delete any indicators that do not include a full malware sample.

Immediately convert all indicators into blocking rules on all perimeter devices.

Validate the indicators for accuracy, relevance, and trustworthiness of the source.

Encrypt the indicators using the organization's public key to ensure confidentiality during storage.

A mid-sized company wants to enhance its threat intelligence capabilities by collecting external data. They have a limited budget and want to start with free or low-cost sources. Which external source should they prioritize?

Commercial threat intelligence feeds with comprehensive coverage.

Information sharing and analysis centers (ISACs) relevant to their industry.

Hiring a dedicated threat intelligence analyst to manually collect data.

Dark web monitoring services that require a subscription.

Which of the following is a common use case for a custom script in automated threat data collection?

Conducting the final analysis and producing the intelligence report

Providing a user interface for analysts to manually review collected data

Replacing the need for a SIEM system in log aggregation

Parsing and extracting indicators from a non-standard or proprietary data source

Which of the following is a key characteristic of data collected through continuous monitoring?

It is collected in real time or near real time to provide up-to-date information

It is collected only after a formal request from an analyst

It is collected at regular intervals, such as once per day

It is collected only from internal network sensors

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 1

Threat Intelligence Data Collection CTIA Practice Questions (Page 15)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 175 practice questions to prepare you well beyond it. (estimate)

175questions here

35free pages

62concepts

62 Concepts in This Objective

Threat Intelligence Data Collection Overview
Data Collection Planning
Automated Data Collection Tools
Manual Data Collection Techniques
Data Source Validation
Data Collection from Open Sources
Data Collection from Technical Sources
Data Collection from Human Sources
Data Collection from Internal Sources
Data Collection from External Sources
Data Collection from Dark Web and Deep Web
Data Collection from Social Media and Forums
Data Collection from Malware Analysis
Data Collection from Network Traffic
Data Collection from Logs and Events
Data Collection from Threat Intelligence Platforms
Data Collection from Honeypots and Honeynets
Data Collection from Sandboxing
Data Collection from OSINT Tools
Data Collection from HUMINT
Data Collection from SIGINT
Data Collection from Cyber Threat Intelligence Feeds
Data Collection from Government and Law Enforcement Sources
Data Collection from Industry-Specific Sources
Data Collection from Academic and Research Sources
Data Collection from Vulnerability Databases
Data Collection from Incident Response Reports
Data Collection from Threat Actor Communication
Data Collection from Geolocation and IP Intelligence
Data Collection from DNS and Domain Intelligence
Data Collection from File and Hash Intelligence
Data Collection from Email and Phishing Analysis
Data Collection from Web and URL Analysis
Data Collection from Social Engineering Intelligence
Data Collection from Physical Security Sources
Data Collection from Supply Chain Sources
Data Collection from Insider Threat Sources
Data Collection from Threat Modeling
Data Collection from Cyber Kill Chain and MITRE ATT&CK
Data Collection from Threat Hunting
Data Collection from Deception Technologies
Data Collection from Cloud and Virtual Environments
Data Collection from IoT and OT Sources
Data Collection from Mobile and Endpoint Sources
Data Collection from Application and Database Logs
Data Collection from Authentication and Access Logs
Data Collection from Firewall and IDS/IPS Logs
Data Collection from Proxy and Web Filter Logs
Data Collection from Email Gateway Logs
Data Collection from Endpoint Detection and Response (EDR)
Data Collection from Security Information and Event Management (SIEM)
Data Collection from Threat Intelligence Sharing Platforms
Data Collection from Legal and Regulatory Sources
Data Collection from Ethical and Privacy Considerations
Data Collection from Data Quality and Relevance
Data Collection from Data Normalization and Standardization
Data Collection from Data Storage and Management
Data Collection from Data Retention and Disposal
Data Collection from Automation and Orchestration
Data Collection from Integration with Existing Security Tools
Data Collection from Continuous Monitoring
Data Collection from Feedback and Improvement

Questions 71–75

71application · medium
A malware analyst has received a suspicious executable file from a threat intelligence sharing community. The analyst needs to collect indicators of compromise (IOCs) and behavioral data from the file. Which approach should be taken?
Select an answer first
72foundation · easy
When an analyst pulls indicators from a TISP into their internal threat intelligence platform, which of the following is the most important first step before using those indicators in detection rules?
Select an answer first
73application · medium
A mid-sized company wants to enhance its threat intelligence capabilities by collecting external data. They have a limited budget and want to start with free or low-cost sources. Which external source should they prioritize?
Select an answer first
74foundation · easy
Which of the following is a common use case for a custom script in automated threat data collection?
Select an answer first
75foundation · easy
Which of the following is a key characteristic of data collected through continuous monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.