A threat intelligence analyst at a financial institution is considering using data from government and law enforcement sources to enhance their threat intelligence. The analyst must ensure compliance with legal and regulatory requirements. Which action should the analyst take first?

Collect all available government data and analyze it later for compliance issues.

Directly contact law enforcement agencies to request threat intelligence data.

Subscribe to a commercial threat intelligence feed that aggregates government alerts.

Review the organization's legal and compliance policies to understand what data can be collected and how it can be used.

A threat intelligence team wants to expand its collection of external threat data by participating in information-sharing communities and subscribing to commercial feeds. The team's budget is limited, and they need to prioritize sources that provide the most relevant and timely data for their sector (healthcare). Which approach should they take?

Subscribe to multiple general-purpose feeds to increase the volume of data.

Rely only on free open-source feeds to avoid costs.

Join a healthcare-specific information sharing and analysis center (ISAC) and subscribe to a commercial feed that offers healthcare-focused indicators.

Subscribe to a general-purpose commercial threat feed that covers a wide range of industries.

Which of the following is a common challenge when collecting data from authentication logs for threat intelligence purposes?

Authentication logs do not record timestamps

Logs are often stored in inconsistent formats across different systems

Authentication logs only record successful logins

Authentication logs are encrypted by default

A threat intelligence team is implementing a Threat Intelligence Platform (TIP) to aggregate data from multiple sources, including commercial feeds, open-source lists, and internal incident reports. The team's goal is to reduce alert fatigue by deduplicating and correlating indicators. Which TIP capability is most important to achieve this goal?

Data normalization and enrichment of indicators with context.

Automated ingestion of feeds via APIs and connectors.

Integration with the existing SIEM for automated alerting.

Deduplication and correlation engine that merges duplicate indicators and links related ones.

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 1

Threat Intelligence Data Collection CTIA Practice Questions (Page 30)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 175 practice questions to prepare you well beyond it. (estimate)

175questions here

35free pages

62concepts

62 Concepts in This Objective

Threat Intelligence Data Collection Overview
Data Collection Planning
Automated Data Collection Tools
Manual Data Collection Techniques
Data Source Validation
Data Collection from Open Sources
Data Collection from Technical Sources
Data Collection from Human Sources
Data Collection from Internal Sources
Data Collection from External Sources
Data Collection from Dark Web and Deep Web
Data Collection from Social Media and Forums
Data Collection from Malware Analysis
Data Collection from Network Traffic
Data Collection from Logs and Events
Data Collection from Threat Intelligence Platforms
Data Collection from Honeypots and Honeynets
Data Collection from Sandboxing
Data Collection from OSINT Tools
Data Collection from HUMINT
Data Collection from SIGINT
Data Collection from Cyber Threat Intelligence Feeds
Data Collection from Government and Law Enforcement Sources
Data Collection from Industry-Specific Sources
Data Collection from Academic and Research Sources
Data Collection from Vulnerability Databases
Data Collection from Incident Response Reports
Data Collection from Threat Actor Communication
Data Collection from Geolocation and IP Intelligence
Data Collection from DNS and Domain Intelligence
Data Collection from File and Hash Intelligence
Data Collection from Email and Phishing Analysis
Data Collection from Web and URL Analysis
Data Collection from Social Engineering Intelligence
Data Collection from Physical Security Sources
Data Collection from Supply Chain Sources
Data Collection from Insider Threat Sources
Data Collection from Threat Modeling
Data Collection from Cyber Kill Chain and MITRE ATT&CK
Data Collection from Threat Hunting
Data Collection from Deception Technologies
Data Collection from Cloud and Virtual Environments
Data Collection from IoT and OT Sources
Data Collection from Mobile and Endpoint Sources
Data Collection from Application and Database Logs
Data Collection from Authentication and Access Logs
Data Collection from Firewall and IDS/IPS Logs
Data Collection from Proxy and Web Filter Logs
Data Collection from Email Gateway Logs
Data Collection from Endpoint Detection and Response (EDR)
Data Collection from Security Information and Event Management (SIEM)
Data Collection from Threat Intelligence Sharing Platforms
Data Collection from Legal and Regulatory Sources
Data Collection from Ethical and Privacy Considerations
Data Collection from Data Quality and Relevance
Data Collection from Data Normalization and Standardization
Data Collection from Data Storage and Management
Data Collection from Data Retention and Disposal
Data Collection from Automation and Orchestration
Data Collection from Integration with Existing Security Tools
Data Collection from Continuous Monitoring
Data Collection from Feedback and Improvement

Questions 146–150

146foundation · easy
Which data field is commonly found in a web proxy log and is essential for correlating web activity to a specific user?
Select an answer first
147application · medium
A threat intelligence analyst at a financial institution is considering using data from government and law enforcement sources to enhance their threat intelligence. The analyst must ensure compliance with legal and regulatory requirements. Which action should the analyst take first?
Select an answer first
148application · medium
A threat intelligence team wants to expand its collection of external threat data by participating in information-sharing communities and subscribing to commercial feeds. The team's budget is limited, and they need to prioritize sources that provide the most relevant and timely data for their sector (healthcare). Which approach should they take?
Select an answer first
149foundation · easy
Which of the following is a common challenge when collecting data from authentication logs for threat intelligence purposes?
Select an answer first
150application · medium
A threat intelligence team is implementing a Threat Intelligence Platform (TIP) to aggregate data from multiple sources, including commercial feeds, open-source lists, and internal incident reports. The team's goal is to reduce alert fatigue by deduplicating and correlating indicators. Which TIP capability is most important to achieve this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Threat Intelligence Data Collection CTIA Practice Questions (Page 30)

Questions 146–150

Which data field is commonly found in a web proxy log and is essential for correlating web activity to a specific user?

A threat intelligence analyst at a financial institution is considering using data from government and law enforcement sources to enhance their threat intelligence. The analyst must ensure compliance with legal and regulatory requirements. Which action should the analyst take first?

Which of the following is a common challenge when collecting data from authentication logs for threat intelligence purposes?

Keep studying — Data Collection and Processing