A SOC manager wants to measure the effectiveness of the threat intelligence program in improving detection and response. The team has implemented intelligence-driven workflows. Which metric would best demonstrate the value of threat intelligence in reducing the impact of incidents?

The number of IOCs published to the threat intelligence platform each month.

The number of threat intelligence feeds subscribed to by the organization.

The average time to detect (MTTD) and time to respond (MTTR) for incidents that involved threat intelligence.

The total number of incidents handled per month.

Which of the following best describes the purpose of integrating threat intelligence into SOC monitoring?

To replace the need for human analysts

To automatically remediate all security incidents

To provide context that helps distinguish malicious activity from benign activity

To eliminate the need for log collection

Which of the following is an example of using threat intelligence to triage an alert?

Checking if the source IP address in the alert appears in a known malicious IP feed

Escalating the alert to the legal department

Updating the antivirus signatures

After a security incident is contained, the incident response team is conducting lessons learned. Threat intelligence played a role in identifying the attack vector. Which action best incorporates threat intelligence into the lessons-learned phase?

Document how threat intelligence contributed to detection and response, and identify gaps in intelligence coverage that could be improved.

Focus only on the technical response and ignore the intelligence aspects.

Delete all threat intelligence data related to the incident to avoid clutter.

Share the incident report only with the SOC team and not with the risk team.

In the 'lessons learned' phase of incident response, threat intelligence is used primarily to:

Identify the attacker's identity for legal prosecution

Update detection rules and share insights to improve future defenses

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 7Objective 2

Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 4)

Part of the Threat Hunting and Operational Integration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 16–20

16application · medium
A SOC manager wants to measure the effectiveness of the threat intelligence program in improving detection and response. The team has implemented intelligence-driven workflows. Which metric would best demonstrate the value of threat intelligence in reducing the impact of incidents?
Select an answer first
17foundation · easy
Which of the following best describes the purpose of integrating threat intelligence into SOC monitoring?
Select an answer first
18foundation · easy
Which of the following is an example of using threat intelligence to triage an alert?
Select an answer first
19application · medium
After a security incident is contained, the incident response team is conducting lessons learned. Threat intelligence played a role in identifying the attack vector. Which action best incorporates threat intelligence into the lessons-learned phase?
Select an answer first
20foundation · easy
In the 'lessons learned' phase of incident response, threat intelligence is used primarily to:
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.