During a major incident, the SOC identifies a new malware variant and creates indicators of compromise (IOCs). The IR team is containing the incident, and the risk team needs to assess the potential business impact. How should the teams coordinate to ensure effective response and risk management?

The SOC should share the IOCs with the IR team, and the IR team should provide containment updates to the risk team for impact assessment.

The risk team should independently research the malware variant without input from the SOC or IR.

The SOC should keep the IOCs confidential until the incident is fully contained.

The IR team should focus only on containment and not share details with the risk team until the incident is over.

A SOC analyst is triaging alerts during a shift. The threat intelligence feed has just been updated with a new indicator for an active ransomware campaign. One alert matches this new indicator, while other alerts are for low-severity policy violations. What should the analyst do first?

Wait for the next shift to investigate the ransomware alert because it is late in the shift.

Continue triaging alerts in chronological order to avoid missing anything.

Close the policy violation alerts first because they are quick to resolve.

Investigate the alert matching the new ransomware indicator immediately because it is highly relevant and time-sensitive.

A SOC team wants to design a workflow that uses threat intelligence to improve alert triage. The goal is to reduce the time analysts spend on false positives while ensuring that high-priority alerts are escalated. Which workflow design best achieves this?

Escalate all alerts that match any indicator in the threat intelligence feed without further analysis.

Automatically enrich every alert with threat intelligence context and apply a scoring model that adjusts priority based on the relevance and confidence of the intelligence.

Manually check each alert against the threat intelligence portal before deciding on escalation.

Suppress all alerts that do not match the threat intelligence feed to reduce noise.

Which practice best supports coordination between SOC, IR, and risk teams regarding threat intelligence?

Keeping intelligence strictly within the SOC to avoid confusion

Having the risk team make all detection decisions

Sharing intelligence only after an incident is fully resolved

Holding regular cross-functional meetings to review intelligence and its impact on operations

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 7Objective 2

Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 1)

Part of the Threat Hunting and Operational Integration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 1–5

1application · medium
During a major incident, the SOC identifies a new malware variant and creates indicators of compromise (IOCs). The IR team is containing the incident, and the risk team needs to assess the potential business impact. How should the teams coordinate to ensure effective response and risk management?
Select an answer first
2application · medium
A SOC analyst is triaging alerts during a shift. The threat intelligence feed has just been updated with a new indicator for an active ransomware campaign. One alert matches this new indicator, while other alerts are for low-severity policy violations. What should the analyst do first?
Select an answer first
3application · medium
A SOC team wants to design a workflow that uses threat intelligence to improve alert triage. The goal is to reduce the time analysts spend on false positives while ensuring that high-priority alerts are escalated. Which workflow design best achieves this?
Select an answer first
4foundation · easy
Which step in an intelligence-driven SOC workflow would most likely involve updating threat intelligence based on findings from an investigation?
Select an answer first
5foundation · easy
Which practice best supports coordination between SOC, IR, and risk teams regarding threat intelligence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.