A threat intelligence team in the energy sector is tasked with collecting intelligence on supply chain risks from third-party vendors. The team has limited resources and must decide between two approaches: (1) subscribing to a general-purpose threat intelligence feed that includes supply chain indicators, or (2) joining an energy-sector information sharing and analysis center (ISAC) that provides vendor-specific threat reports. The team's primary requirement is to identify vulnerabilities in vendors that could impact operational technology (OT) systems. Which approach is more appropriate?

Subscribe to the general-purpose feed because it provides a broader range of indicators.

Join the energy-sector ISAC because it provides sector-specific and vendor-focused intelligence that directly addresses OT supply chain risks.

Use both approaches to maximize coverage, despite the limited resources.

Rely on open-source vulnerability databases to identify vendor vulnerabilities.

A security team wants to collect data on attacker behavior and tactics targeting their network. They are considering deploying a honeypot. Which consideration is most critical for the success of the honeypot?

The honeypot should be placed on the same subnet as production servers to attract the same traffic.

The honeypot should be configured with the same security controls as production servers to appear realistic.

The honeypot must be isolated from the production network to prevent attackers from using it as a pivot point.

The honeypot should be monitored only after an alert is triggered.

What type of threat-related information is commonly found on online forums?

Regulatory compliance requirements for data protection

Discussions on exploit techniques, malware, and potential targets

Standardized threat intelligence in STIX/TAXII format

Official security advisories from software vendors

During the data collection phase, a threat intelligence analyst needs to gather indicators from public websites, including malicious URLs, IP addresses, and file hashes. Which type of data source is most directly associated with this activity?

Open-source intelligence (OSINT) feeds

Human intelligence (HUMINT) reports

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 1

Threat Intelligence Data Collection CTIA Practice Questions (Page 28)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 175 practice questions to prepare you well beyond it. (estimate)

175questions here

35free pages

62concepts

62 Concepts in This Objective

Threat Intelligence Data Collection Overview
Data Collection Planning
Automated Data Collection Tools
Manual Data Collection Techniques
Data Source Validation
Data Collection from Open Sources
Data Collection from Technical Sources
Data Collection from Human Sources
Data Collection from Internal Sources
Data Collection from External Sources
Data Collection from Dark Web and Deep Web
Data Collection from Social Media and Forums
Data Collection from Malware Analysis
Data Collection from Network Traffic
Data Collection from Logs and Events
Data Collection from Threat Intelligence Platforms
Data Collection from Honeypots and Honeynets
Data Collection from Sandboxing
Data Collection from OSINT Tools
Data Collection from HUMINT
Data Collection from SIGINT
Data Collection from Cyber Threat Intelligence Feeds
Data Collection from Government and Law Enforcement Sources
Data Collection from Industry-Specific Sources
Data Collection from Academic and Research Sources
Data Collection from Vulnerability Databases
Data Collection from Incident Response Reports
Data Collection from Threat Actor Communication
Data Collection from Geolocation and IP Intelligence
Data Collection from DNS and Domain Intelligence
Data Collection from File and Hash Intelligence
Data Collection from Email and Phishing Analysis
Data Collection from Web and URL Analysis
Data Collection from Social Engineering Intelligence
Data Collection from Physical Security Sources
Data Collection from Supply Chain Sources
Data Collection from Insider Threat Sources
Data Collection from Threat Modeling
Data Collection from Cyber Kill Chain and MITRE ATT&CK
Data Collection from Threat Hunting
Data Collection from Deception Technologies
Data Collection from Cloud and Virtual Environments
Data Collection from IoT and OT Sources
Data Collection from Mobile and Endpoint Sources
Data Collection from Application and Database Logs
Data Collection from Authentication and Access Logs
Data Collection from Firewall and IDS/IPS Logs
Data Collection from Proxy and Web Filter Logs
Data Collection from Email Gateway Logs
Data Collection from Endpoint Detection and Response (EDR)
Data Collection from Security Information and Event Management (SIEM)
Data Collection from Threat Intelligence Sharing Platforms
Data Collection from Legal and Regulatory Sources
Data Collection from Ethical and Privacy Considerations
Data Collection from Data Quality and Relevance
Data Collection from Data Normalization and Standardization
Data Collection from Data Storage and Management
Data Collection from Data Retention and Disposal
Data Collection from Automation and Orchestration
Data Collection from Integration with Existing Security Tools
Data Collection from Continuous Monitoring
Data Collection from Feedback and Improvement

Questions 136–140

136foundation · easy
During a threat intelligence investigation, an analyst needs to review records of successful and failed login attempts, including timestamps and source IP addresses. Which type of log is the primary source for this data?
Select an answer first
137expert · hard
A threat intelligence team in the energy sector is tasked with collecting intelligence on supply chain risks from third-party vendors. The team has limited resources and must decide between two approaches: (1) subscribing to a general-purpose threat intelligence feed that includes supply chain indicators, or (2) joining an energy-sector information sharing and analysis center (ISAC) that provides vendor-specific threat reports. The team's primary requirement is to identify vulnerabilities in vendors that could impact operational technology (OT) systems. Which approach is more appropriate?
Select an answer first
138expert · hard
A security team wants to collect data on attacker behavior and tactics targeting their network. They are considering deploying a honeypot. Which consideration is most critical for the success of the honeypot?
Select an answer first
139foundation · easy
What type of threat-related information is commonly found on online forums?
Select an answer first
140foundation · easy
During the data collection phase, a threat intelligence analyst needs to gather indicators from public websites, including malicious URLs, IP addresses, and file hashes. Which type of data source is most directly associated with this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Threat Intelligence Data Collection CTIA Practice Questions (Page 28)

Questions 136–140

During a threat intelligence investigation, an analyst needs to review records of successful and failed login attempts, including timestamps and source IP addresses. Which type of log is the primary source for this data?

A security team wants to collect data on attacker behavior and tactics targeting their network. They are considering deploying a honeypot. Which consideration is most critical for the success of the honeypot?

What type of threat-related information is commonly found on online forums?

During the data collection phase, a threat intelligence analyst needs to gather indicators from public websites, including malicious URLs, IP addresses, and file hashes. Which type of data source is most directly associated with this activity?

Keep studying — Data Collection and Processing