When triaging security alerts, how does threat intelligence help prioritize which alerts to investigate first?

By providing a list of all employees' login times

By assigning a severity score based on the relevance of the threat to the organization

By automatically closing all low-priority alerts

By identifying which alerts are generated by the SIEM

How does threat intelligence guide proactive threat hunting?

By providing hypotheses about potential adversary behaviors based on known TTPs

By automatically blocking all suspicious traffic

By providing a list of all vulnerabilities in the environment

By replacing the need for manual analysis

A SOC analyst is triaging alerts and sees that one alert matches a known threat actor's infrastructure, but the affected asset is a test server. Another alert is for a low-severity malware signature on a domain controller. How should the analyst prioritize?

Prioritize the threat actor alert because it matches known malicious infrastructure.

Treat both alerts equally because they both require investigation.

Escalate both alerts to the IR team immediately.

Prioritize the malware alert on the domain controller because the asset is critical, even though the malware is low severity.

Why is it important to have a process for updating threat intelligence within a SOC?

To comply with all international laws automatically

To reduce the number of security tools needed

To eliminate the need for human analysts

Threats evolve, and outdated intelligence can lead to false confidence and missed detections

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 7Objective 2

Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 6)

Part of the Threat Hunting and Operational Integration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 26–30

26foundation · easy
When triaging security alerts, how does threat intelligence help prioritize which alerts to investigate first?
Select an answer first
27foundation · easy
How does threat intelligence guide proactive threat hunting?
Select an answer first
28application · medium
A SOC analyst is triaging alerts and sees that one alert matches a known threat actor's infrastructure, but the affected asset is a test server. Another alert is for a low-severity malware signature on a domain controller. How should the analyst prioritize?
Select an answer first
29foundation · easy
Why is it important to have a process for updating threat intelligence within a SOC?
Select an answer first
30foundation · easy
In a SOC, threat intelligence feeds are commonly integrated into which component to enhance monitoring and detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.