A threat intelligence analyst is evaluating two external threat intelligence feeds for integration into the SIEM. Feed A provides a high volume of indicators with a low false-positive rate but has a 48-hour delay in publishing new indicators. Feed B provides real-time indicators but has a 20% false-positive rate and requires weekly manual review to remove noise. The organization's primary requirement is to detect ongoing campaigns as early as possible, and the SOC has limited analyst time for triage. Which feed should the analyst prioritize for integration?

Feed A, because the low false-positive rate ensures higher data quality and reduces analyst workload.

Reject both feeds and rely solely on internal log analysis to avoid external data quality issues.

Combine both feeds equally, because more data always improves threat detection coverage.

Feed B, because real-time indicators align with the early-detection requirement, and the false positives can be managed with automated filtering rules.

What is the primary purpose of collecting data from an Endpoint Detection and Response (EDR) platform during the threat intelligence data collection phase?

To replace the need for network traffic analysis by providing a complete view of all external communications

To gather detailed telemetry about processes, file activity, registry changes, and other endpoint behaviors that may indicate malicious activity

To provide a centralized repository for all threat intelligence feeds and indicators of compromise (IOCs)

To automatically block all suspicious files before they can be executed on the endpoint

In the context of collecting threat intelligence from email gateway logs, what does the 'spam score' field typically represent?

The number of times the email was quarantined

The number of recipients the message was sent to

A numerical value indicating the likelihood that the message is spam or malicious

The size of the email in kilobytes

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 1

Threat Intelligence Data Collection CTIA Practice Questions (Page 29)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 175 practice questions to prepare you well beyond it. (estimate)

175questions here

35free pages

62concepts

62 Concepts in This Objective

Threat Intelligence Data Collection Overview
Data Collection Planning
Automated Data Collection Tools
Manual Data Collection Techniques
Data Source Validation
Data Collection from Open Sources
Data Collection from Technical Sources
Data Collection from Human Sources
Data Collection from Internal Sources
Data Collection from External Sources
Data Collection from Dark Web and Deep Web
Data Collection from Social Media and Forums
Data Collection from Malware Analysis
Data Collection from Network Traffic
Data Collection from Logs and Events
Data Collection from Threat Intelligence Platforms
Data Collection from Honeypots and Honeynets
Data Collection from Sandboxing
Data Collection from OSINT Tools
Data Collection from HUMINT
Data Collection from SIGINT
Data Collection from Cyber Threat Intelligence Feeds
Data Collection from Government and Law Enforcement Sources
Data Collection from Industry-Specific Sources
Data Collection from Academic and Research Sources
Data Collection from Vulnerability Databases
Data Collection from Incident Response Reports
Data Collection from Threat Actor Communication
Data Collection from Geolocation and IP Intelligence
Data Collection from DNS and Domain Intelligence
Data Collection from File and Hash Intelligence
Data Collection from Email and Phishing Analysis
Data Collection from Web and URL Analysis
Data Collection from Social Engineering Intelligence
Data Collection from Physical Security Sources
Data Collection from Supply Chain Sources
Data Collection from Insider Threat Sources
Data Collection from Threat Modeling
Data Collection from Cyber Kill Chain and MITRE ATT&CK
Data Collection from Threat Hunting
Data Collection from Deception Technologies
Data Collection from Cloud and Virtual Environments
Data Collection from IoT and OT Sources
Data Collection from Mobile and Endpoint Sources
Data Collection from Application and Database Logs
Data Collection from Authentication and Access Logs
Data Collection from Firewall and IDS/IPS Logs
Data Collection from Proxy and Web Filter Logs
Data Collection from Email Gateway Logs
Data Collection from Endpoint Detection and Response (EDR)
Data Collection from Security Information and Event Management (SIEM)
Data Collection from Threat Intelligence Sharing Platforms
Data Collection from Legal and Regulatory Sources
Data Collection from Ethical and Privacy Considerations
Data Collection from Data Quality and Relevance
Data Collection from Data Normalization and Standardization
Data Collection from Data Storage and Management
Data Collection from Data Retention and Disposal
Data Collection from Automation and Orchestration
Data Collection from Integration with Existing Security Tools
Data Collection from Continuous Monitoring
Data Collection from Feedback and Improvement

Questions 141–145

141application · medium
A threat intelligence analyst is evaluating two external threat intelligence feeds for integration into the SIEM. Feed A provides a high volume of indicators with a low false-positive rate but has a 48-hour delay in publishing new indicators. Feed B provides real-time indicators but has a 20% false-positive rate and requires weekly manual review to remove noise. The organization's primary requirement is to detect ongoing campaigns as early as possible, and the SOC has limited analyst time for triage. Which feed should the analyst prioritize for integration?
Select an answer first
142foundation · easy
What is the primary purpose of collecting data from an Endpoint Detection and Response (EDR) platform during the threat intelligence data collection phase?
Select an answer first
143foundation · easy
What type of insider threat data is typically obtained from an organization's physical access control system?
Select an answer first
144foundation · easy
In the context of collecting threat intelligence from email gateway logs, what does the 'spam score' field typically represent?
Select an answer first
145foundation · easy
During threat intelligence data collection, an analyst maps observed adversary actions to a standardized framework. Which framework is specifically designed to categorize the tactical objectives and techniques of an adversary based on the stages of an attack lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Threat Intelligence Data Collection CTIA Practice Questions (Page 29)

Questions 141–145

What is the primary purpose of collecting data from an Endpoint Detection and Response (EDR) platform during the threat intelligence data collection phase?

What type of insider threat data is typically obtained from an organization's physical access control system?

In the context of collecting threat intelligence from email gateway logs, what does the 'spam score' field typically represent?

During threat intelligence data collection, an analyst maps observed adversary actions to a standardized framework. Which framework is specifically designed to categorize the tactical objectives and techniques of an adversary based on the stages of an attack lifecycle?

Keep studying — Data Collection and Processing