A threat intelligence analyst is tasked with monitoring social media and public forums for early signs of a new malware campaign targeting the organization's industry. The analyst has access to OSINT tools that can automate collection from Twitter, Reddit, and various security blogs. The analyst needs to set up a continuous monitoring process that minimizes noise and focuses on relevant discussions. Which approach is most effective?

Subscribe to a commercial threat intelligence feed that covers social media monitoring and rely on it exclusively.

Manually browse Twitter and Reddit every few hours to look for relevant posts.

Use an OSINT tool to collect all posts containing the organization's name and industry keywords, then manually review them daily.

Create targeted searches for known malware family names, campaign indicators, and industry-specific terms, and use an OSINT tool to aggregate results into a single dashboard.

During the data collection phase, an analyst identifies a set of raw threat intelligence feeds that are no longer needed for active analysis. According to threat intelligence lifecycle best practices, what is the PRIMARY reason to follow a formal data retention and disposal policy for this data?

To ensure that data is kept only as long as necessary and then disposed of securely, reducing legal and security risks

To make the data available to other analysts for future correlation and historical analysis

To reduce storage costs by deleting all data as soon as it is no longer actively used

To comply with the vendor's licensing agreement for the threat intelligence platform

Which type of data is most commonly collected from a SIEM for threat intelligence purposes?

DNS query logs from external resolvers

Security alerts and normalized event logs from network and host devices

Raw packet captures from network taps

Publicly available threat intelligence reports

In the context of threat intelligence data collection, which characteristic is MOST directly associated with data quality?

The data is relevant to the organization's specific threat landscape.

The data is accurate, complete, and timely.

The data is stored in a centralized repository.

The data is collected from a wide variety of sources.

What is the first step in developing an effective data collection plan for threat intelligence?

Selecting the most advanced automated collection tools

Establishing a data storage and retention policy

Defining clear intelligence requirements and objectives

Identifying all potential data sources, regardless of relevance

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 4Objective 1

Threat Intelligence Data Collection CTIA Practice Questions (Page 9)

Part of the Data Collection and Processing domain, which makes up ~29% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 8–12 from this objective — we provide 175 practice questions to prepare you well beyond it. (estimate)

175questions here

35free pages

62concepts

62 Concepts in This Objective

Threat Intelligence Data Collection Overview
Data Collection Planning
Automated Data Collection Tools
Manual Data Collection Techniques
Data Source Validation
Data Collection from Open Sources
Data Collection from Technical Sources
Data Collection from Human Sources
Data Collection from Internal Sources
Data Collection from External Sources
Data Collection from Dark Web and Deep Web
Data Collection from Social Media and Forums
Data Collection from Malware Analysis
Data Collection from Network Traffic
Data Collection from Logs and Events
Data Collection from Threat Intelligence Platforms
Data Collection from Honeypots and Honeynets
Data Collection from Sandboxing
Data Collection from OSINT Tools
Data Collection from HUMINT
Data Collection from SIGINT
Data Collection from Cyber Threat Intelligence Feeds
Data Collection from Government and Law Enforcement Sources
Data Collection from Industry-Specific Sources
Data Collection from Academic and Research Sources
Data Collection from Vulnerability Databases
Data Collection from Incident Response Reports
Data Collection from Threat Actor Communication
Data Collection from Geolocation and IP Intelligence
Data Collection from DNS and Domain Intelligence
Data Collection from File and Hash Intelligence
Data Collection from Email and Phishing Analysis
Data Collection from Web and URL Analysis
Data Collection from Social Engineering Intelligence
Data Collection from Physical Security Sources
Data Collection from Supply Chain Sources
Data Collection from Insider Threat Sources
Data Collection from Threat Modeling
Data Collection from Cyber Kill Chain and MITRE ATT&CK
Data Collection from Threat Hunting
Data Collection from Deception Technologies
Data Collection from Cloud and Virtual Environments
Data Collection from IoT and OT Sources
Data Collection from Mobile and Endpoint Sources
Data Collection from Application and Database Logs
Data Collection from Authentication and Access Logs
Data Collection from Firewall and IDS/IPS Logs
Data Collection from Proxy and Web Filter Logs
Data Collection from Email Gateway Logs
Data Collection from Endpoint Detection and Response (EDR)
Data Collection from Security Information and Event Management (SIEM)
Data Collection from Threat Intelligence Sharing Platforms
Data Collection from Legal and Regulatory Sources
Data Collection from Ethical and Privacy Considerations
Data Collection from Data Quality and Relevance
Data Collection from Data Normalization and Standardization
Data Collection from Data Storage and Management
Data Collection from Data Retention and Disposal
Data Collection from Automation and Orchestration
Data Collection from Integration with Existing Security Tools
Data Collection from Continuous Monitoring
Data Collection from Feedback and Improvement

Questions 41–45

41application · medium
A threat intelligence analyst is tasked with monitoring social media and public forums for early signs of a new malware campaign targeting the organization's industry. The analyst has access to OSINT tools that can automate collection from Twitter, Reddit, and various security blogs. The analyst needs to set up a continuous monitoring process that minimizes noise and focuses on relevant discussions. Which approach is most effective?
Select an answer first
42foundation · easy
During the data collection phase, an analyst identifies a set of raw threat intelligence feeds that are no longer needed for active analysis. According to threat intelligence lifecycle best practices, what is the PRIMARY reason to follow a formal data retention and disposal policy for this data?
Select an answer first
43foundation · easy
Which type of data is most commonly collected from a SIEM for threat intelligence purposes?
Select an answer first
44foundation · easy
In the context of threat intelligence data collection, which characteristic is MOST directly associated with data quality?
Select an answer first
45foundation · easy
What is the first step in developing an effective data collection plan for threat intelligence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.