Free Preparation Discussions
MENU
EC-Council Certified Threat Intelligence Analyst CTIA 312-85 Exam Questions
- Topic 1: Introduction to Threat Intelligence: Covers the fundamentals of threat intelligence, its types, and its role in strengthening an organization's cybersecurity posture.
- Topic 2: Cyber Threats and Attack Frameworks: Covers common cyber threats, attack stages, and frameworks like the Cyber Kill Chain, MITRE ATT&CK, and Diamond Model used to understand attacker behavior.
- Topic 3: Requirements, Planning, Direction, and Review: Covers the initial phase of the threat intelligence lifecycle, focusing on defining objectives, planning strategy, and reviewing intelligence needs.
- Topic 4: Data Collection and Processing: Covers methods and sources for gathering raw threat data and processing it into a usable format for analysis.
- Topic 5: Data Analysis: Covers techniques used to analyze processed data to identify patterns, trends, and actionable threat intelligence.
- Topic 6: Intelligence Reporting and Dissemination: Covers how finished threat intelligence is documented, formatted, and shared with relevant stakeholders.
- Topic 7: Threat Hunting and Detection: Covers proactive techniques for identifying hidden threats and detecting malicious activity within a network.
- Topic 8: Threat Intelligence in SOC Operations, Incident Response, and Risk Management: Covers how threat intelligence supports SOC functions, strengthens incident response, and aids in overall risk management.
Free EC-Council Certified Threat Intelligence Analyst CTIA 312-85 Exam Actual Questions
Note: Premium EC-Council Certified Threat Intelligence Analyst CTIA 312-85 Practice Questions — Last Updated: Sep. 27, 2026 (see below)
A team of threat intelligence analysts is performing threat analysis on malware, and each of them has come up with their own theory and evidence to support their theory on a given malware.
Now, to identify the most consistent theory out of all the theories, which of the following analytic processes must threat intelligence manager use?
Analysis of Competing Hypotheses (ACH) is an analytic process designed to help an analyst or a team of analysts evaluate multiple competing hypotheses on an issue fairly and objectively. ACH assists in identifying and analyzing the evidence for and against each hypothesis, ultimately aiding in determining the most likely explanation. In the scenario where a team of threat intelligence analysts has various theories on a particular malware, ACH would be the most appropriate method to assess these competing theories systematically. ACH involves listing all possible hypotheses, collecting data and evidence, and assessing the evidence's consistency with each hypothesis. This process helps in minimizing cognitive biases and making a more informed decision on the most consistent theory. Reference:
Richards J. Heuer Jr., 'Psychology of Intelligence Analysis,' Central Intelligence Agency
'A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis,' Central Intelligence Agency
Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular log in patterns from locations where the organization does not have business relations. This resembles that somebody is trying to steal confidential information.
Which of the following key indicators of compromise does this scenario present?
The scenario described by Steve's observations, where multiple logins are occurring from different locations in a short time span, especially from locations where the organization has no business relations, points to 'Geographical anomalies' as a key indicator of compromise (IoC). Geographical anomalies in logins suggest unauthorized access attempts potentially made by attackers using compromised credentials. This is particularly suspicious when the locations of these logins do not align with the normal geographical footprint of the organization's operations or employee locations. Monitoring for such anomalies can help in the early detection of unauthorized access and potential data breaches. Reference:
SANS Institute Reading Room, 'Indicators of Compromise: Reality's Version of the Minority Report'
'Identifying Indicators of Compromise' by CERT-UK
Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?
Passive DNS monitoring involves collecting data about DNS queries and responses without actively querying DNS servers, thereby not altering or interfering with DNS traffic. This technique allows analysts to track changes in DNS records and observe patterns that may indicate malicious activity. In the scenario described, Enrique is employing passive DNS monitoring by using a recursive DNS server to log the responses received from name servers, storing these logs in a central database for analysis. This approach is effective for identifying malicious domains, mapping malware campaigns, and understanding threat actors' infrastructure without alerting them to the fact that they are being monitored. This method is distinct from active techniques such as DNS interrogation or zone transfers, which involve sending queries to DNS servers, and dynamic DNS, which refers to the automatic updating of DNS records. Reference:
SANS Institute InfoSec Reading Room, 'Using Passive DNS to Enhance Cyber Threat Intelligence'
'Passive DNS Replication,' by Florian Weimer, FIRST Conference Presentation
Miley, an analyst, wants to reduce the amount of collected data and make the storing and sharing process easy. She uses filtering, tagging, and queuing technique to sort out the relevant and structured data from the large amounts of unstructured data.
Which of the following techniques was employed by Miley?
Normalization in the context of data analysis refers to the process of organizing data to reduce redundancy and improve efficiency in storing and sharing. By filtering, tagging, and queuing, Miley is effectively normalizing the data---converting it from various unstructured formats into a structured, more accessible format. This makes the data easier to analyze, store, and share. Normalization is crucial in cybersecurity and threat intelligence to manage the vast amounts of data collected and ensure that only relevant data is retained and analyzed. This technique contrasts with sandboxing, which is used for isolating and analyzing suspicious code; data visualization, which involves representing data graphically; and convenience sampling, which is a method of sampling where samples are taken from a group that is conveniently accessible. Reference:
'The Application of Data Normalization to Database Security,' International Journal of Computer Science Issues
SANS Institute Reading Room, 'Data Normalization Considerations in Cyber Threat Intelligence'
An analyst wants to disseminate the information effectively so that the consumers can acquire and benefit out of the intelligence.
Which of the following criteria must an analyst consider in order to make the intelligence concise, to the point, accurate, and easily understandable and must consist of a right balance between tables, narrative, numbers,
graphics, and multimedia?
For intelligence to be effectively disseminated and utilized by consumers, it must be presented in a manner that is concise, accurate, easily understandable, and engaging. This involves a careful balance of narrative, numerical data, tables, graphics, and potentially multimedia elements to convey the information clearly and compellingly. The right presentation takes into account the preferences and needs of the intelligence consumers, as well as the context and urgency of the information. By focusing on how the intelligence is presented, the analyst ensures that the content is not only consumed but also actionable, facilitating informed decision-making.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Lisa Morgan
11 days agoCarol Flores
23 days agoJames Lopez
1 month agoMark Allen
2 months agoRebecca Carter
2 months agoSharon Flores
3 months agoHarold Clark
3 months agoTiffany Evans
4 months agoChristopher Sanchez
4 months agoCynthia Nelson
5 months agoRebecca Baker
5 months agoRachel Adams
5 months agoNathan Edwards
5 months agoJames Hill
5 months agoRichard Miller
5 months agoDorothy Walker
5 months agoEun
6 months agoLyda
6 months agoQueenie
6 months agoMayra
7 months agoKaty
7 months agoShaunna
7 months agoXuan
7 months agoTheola
8 months agoAdell
8 months agoMarti
8 months agoLatonia
8 months agoCallie
9 months agoFelicia
9 months agoEsteban
9 months agoPansy
9 months agoGalen
10 months agoEthan
10 months agoDenae
10 months agoCory
10 months agoNina
11 months agoTeresita
11 months agoIsaac
11 months agoVal
11 months agoKeith
12 months agoOwen
12 months agoDaron
1 year agoJennie
1 year agoLura
1 year agoAlline
1 year agoMeghan
1 year agoLilli
1 year agoNoe
1 year agoJoanna
1 year agoDeeanna
1 year agoKerry
1 year agoCortney
1 year agoLai
1 year agoChantay
1 year agoCassi
1 year agoFrederick
1 year agoLai
1 year agoSalena
2 years agoChau
2 years agoAlise
2 years agoLourdes
2 years agoJerry
2 years agoLelia
2 years agoTiera
2 years agoMirta
2 years agoLourdes
2 years agoKenneth
2 years agoGretchen
2 years agoDerrick
2 years agoElvera
2 years agoVince
2 years agoAshley
2 years agoBrock
2 years agoJill
2 years agoRodrigo
2 years agoMerilyn
2 years agoWillow
2 years agoLucy
2 years agoChau
2 years agoBrandon
2 years agoJames
2 years agoMarylou
2 years agoCatrice
2 years agoClorinda
2 years agoLong
2 years agoJettie
2 years agoLatanya
2 years agoMattie
2 years agoJina
2 years ago