312-85 ECCouncil Certified Threat Intelligence Analyst (CTIA) Free Practice Exam Questions (2025 Updated)

The method described involves analyzing activities, timeframes, dependencies, and milestones to understand project flow and relationships. This is known as Critical Path Analysis (CPA).

Critical Path Analysis helps identify the sequence of crucial tasks that determine the overall project duration. In the context of threat intelligence, it assists analysts in mapping adversary activities or operational timelines to determine key steps and dependencies in attack campaigns.

Why the Other Options Are Incorrect:

B. Timeline analysis: Focuses on chronological sequencing of events, not dependency or duration analysis.

C. Cone of plausibility: Used for scenario modeling and forecasting possible outcomes.

D. Analogy analysis: Compares new situations to historical cases, not time-dependent task mapping.

Conclusion:

Steve applied Critical Path Analysis to determine activity dependencies and durations.

Final Answer: A. Critical path analysis

Explanation Reference (Based on CTIA Study Concepts):

CTIA defines CPA as a structured approach for mapping and analyzing sequences of dependent activities or events.

In the Threat Hunting Maturity Model (HMM), Level 2: Procedural represents an organization that has developed a structured but partially manual threat-hunting capability.

At this stage, organizations:

Use threat intelligence from open and closed sources to guide hunts.

Search for anomalies or suspicious activity across their network.

Employ open-source tools and basic scripts for analysis.

Depend on analysts following documented procedures rather than automated systems.

Why the Other Options Are Incorrect:

Level 1: Minimal: Organization relies solely on reactive security measures and lacks dedicated hunting capabilities.

Level 3: Innovative: Introduces automation and advanced analytics to support hunts.

Level 4: Leading: Represents full maturity with proactive, automated, intelligence-driven hunting integrated across all defenses.

Conclusion:

The organization described is operating at Level 2: Procedural in the Threat Hunting Maturity Model.

Final Answer: A. Level 2: Procedural

Explanation Reference (Based on CTIA Study Concepts):

According to CTIA’s framework on “Threat Hunting Maturity Levels,” Level 2 involves intelligence-driven, manual hunting using open-source tools and structured procedures.

In the scenario described, where attackers have penetrated the network and are staging data for exfiltration, Jim should focus on monitoring network traffic for signs of malicious file transfers, implement file integrity monitoring, and scrutinize event logs. This approach is crucial for detecting unusual activity that could indicate data staging, such as large volumes of data being moved to uncommon locations, sudden changes in file integrity, or suspicious entries in event logs. Early detection of these indicators can help in identifying the staging activity before the data is exfiltrated from the network.

In the Threat Intelligence Sharing Model, the Public Tier is used when information is of low sensitivity and can be shared widely across communities, industry groups, or the public domain.

This tier is ideal for sharing generalized threat data, advisories, or non-sensitive indicators that do not pose risks to the organization if disclosed.

Why the Other Options Are Incorrect:

Private tier: Used for highly sensitive intelligence shared only within a small internal group or trusted partners.

Targeted tier: Shared with specific, predefined organizations or partners with a need-to-know basis.

Multitier: Involves multiple sharing levels but is not a standard individual tier type.

Conclusion:

Henry should use the Public Tier, suitable for broader sharing of low-sensitivity information.

Final Answer: B. Public tier

Explanation Reference (Based on CTIA Study Concepts):

As per CTIA’s “Threat Intelligence Sharing Framework,” the public tier enables dissemination of low-sensitivity threat intelligence to trusted communities for collaborative defense.

Comprehensive and Detailed Explanation (Based on CTIA Official Concepts)

According to the EC-Council Certified Threat Intelligence Analyst (CTIA) study materials, the incident response process generally consists of four phases—Preplanning, Event, Incident, and Breach. Each phase corresponds to specific activities and the application of different types of threat intelligence.

This question focuses on the point in the process where operational and tactical threat intelligence are actively used to provide context to alerts generated by security mechanisms. The correct phase for this activity is the Incident phase.

Phase 1: Preplanning

In this phase, an organization prepares and designs its incident response framework. The main tasks include defining roles, establishing policies, and creating communication channels and procedures.

Strategic threat intelligence is primarily used here to understand high-level threat trends, organizational risks, and to develop incident response playbooks and policies.

Operational and tactical threat intelligence are not yet applied at this stage because no alerts or incidents have occurred. Therefore, Phase 1 is not the correct answer.

Phase 2: Event

In the event phase, security systems such as firewalls, IDS, IPS, and SIEM generate alerts that indicate potential malicious activity. Security analysts begin initial triage, trying to determine if an alert is a false positive or represents real suspicious behavior.

At this point, analysts may reference technical indicators such as IP addresses, domains, or file hashes, but detailed operational or tactical intelligence is not yet used in depth. The main goal here is identification and classification, not full analysis and contextualization. Thus, this is not the correct phase.

Phase 3: Incident

When a suspicious event is confirmed as a legitimate security incident, the organization moves into the incident phase. In this stage, incident response teams investigate, analyze, and respond to the threat.

This is the phase where operational and tactical threat intelligence are actively applied.

Operational Threat Intelligence provides information about the attacker’s motives, campaign objectives, and current attack methods. It helps the organization understand who is attacking, why, and with what resources.

Tactical Threat Intelligence focuses on the adversaries’ tactics, techniques, and procedures (TTPs), such as exploit methods, malware behavior, and persistence mechanisms.

By using operational and tactical threat intelligence during the incident phase, the organization can:

Correlate alerts with known threat actor campaigns.

Add context to security events to understand their significance.

Prioritize incidents based on real-world threat activity.

Guide containment, eradication, and recovery actions more effectively.

In CTIA documentation, this process is described as “leveraging threat intelligence to enrich alerts with contextual data to accelerate incident detection and response.” Therefore, Phase 3: Incident is the correct answer.

Phase 4: Breach

This phase occurs after an incident has escalated into an actual compromise or data loss event. The focus here is on containment, eradication, recovery, and post-breach reporting or legal coordination.

Strategic intelligence may be used for lessons learned and long-term improvement, but operational and tactical intelligence are no longer central to this phase. Therefore, this is not the correct answer.

Summary Table

Phase

Type of Threat Intelligence

Purpose

Phase 1: Preplanning

Strategic

Planning and policy development

Phase 2: Event

Technical

Alert generation and detection

Phase 3: Incident

Operational and Tactical

Contextualize alerts, guide investigation and response

Phase 4: Breach

Strategic

Recovery, compliance, and lessons learned

Final Answer: C. Phase 3: Incident

Explanation Reference:

Derived from EC-Council Certified Threat Intelligence Analyst (CTIA) Official Study Guide, topics: “Integration of Threat Intelligence in Incident Response” and “Application of Operational and Tactical Threat Intelligence in SOC and IR Operations.”

When prioritizing intelligence requirements, it is crucial to understand the frequency and impact of various threats. This approach helps in allocating resources effectively, focusing on threats that are both likely to occur and that would have significant consequences if they did. By assessing threats based on these criteria, Henry can ensure that the threat intelligence program addresses the most pressing and potentially damaging threats first, thereby enhancing the organization's security posture. This prioritization is essential for effective threat management and for ensuring that the most critical threats are addressed promptly.

The stage described involves analyzing gathered information and understanding known threats. This aligns with the Known Knowns stage.

Known Knowns represent threats that have already been identified, understood, and documented. Analysts in this stage work with existing data to refine and interpret known indicators or threat actor behaviors.

Why the Other Options Are Incorrect:

Unknown unknowns: Threats that are entirely unknown and undetectable with current knowledge.

Known unknowns: Threats suspected to exist but not yet clearly identified.

Unknown knowns: Information that exists but has not been analyzed or recognized as relevant.

Conclusion:

Michael is analyzing existing and understood threat data, placing him in the Known Knowns stage of cyber-threat intelligence.

Final Answer: D. Known knowns

Explanation Reference (Based on CTIA Study Concepts):

In the CTIA framework, known knowns refer to threats that are fully understood and documented, forming the basis for structured analysis.

The goal is to find internal URLs and information about the company’s departments and business units. Since Sean could not find this data directly from public searches, he should turn to online reconnaissance services that provide details about a website’s subdomains, internal URLs, hosting structure, and related information.

Netcraft.com is a well-known online reconnaissance and intelligence-gathering service used by security analysts to gather information such as:

Website structure and internal subdomains

Server details and operating systems

Hosting provider and IP ranges

Technology stack and SSL certificate data

Historical hosting changes and DNS information

Using Netcraft, Sean can discover internal URLs and subdomains that may reveal internal departments or services linked to the main organization’s domain. This type of open-source intelligence (OSINT) is valuable for both threat hunting and vulnerability assessment.

Why the Other Options Are Incorrect:

A. WayBackMachine (Archive.org):Useful for viewing historical versions of web pages, but it typically shows public pages, not internal or hidden URLs.

B. Email tracking tools (EmailTrackerPro):These are designed to trace email origins and headers, not to discover website URLs or internal structures.

C. Website mirroring tools (HTTrack):These tools copy the visible contents of a website but do not reveal hidden internal URLs unless they are publicly linked.

Conclusion:

The correct method for Sean to identify internal URLs and subdomains of the target company is by using online services such as Netcraft.com.

Final Answer: D. Sean should use online services such as netcraft.com to find the company's internal URLs

Explanation Reference (Based on CTIA Study Concepts):

According to CTIA study material on Footprinting and Reconnaissance, Netcraft is an effective OSINT-based platform used for discovering detailed website information, including subdomains, server data, and hosting infrastructure.

Risk Prioritization is the process of evaluating and ranking identified risks based on their likelihood, potential impact, and urgency. It helps organizations allocate resources to the most significant threats first.

This step follows risk assessment and ensures that mitigation efforts are aligned with business priorities and risk appetite.

Why the Other Options Are Incorrect:

A. Risk identification: The initial process of recognizing potential threats or vulnerabilities.

C. Risk assessment: Involves analyzing the probability and impact of identified risks but does not rank them.

D. Risk mitigation: Focuses on implementing measures to reduce or eliminate risks after prioritization.

Conclusion:

The activity described—ranking risks by importance to determine response focus—is Risk Prioritization.

Final Answer: B. Risk prioritization

Explanation Reference (Based on CTIA Study Concepts):

CTIA identifies risk prioritization as the step that enables organizations to concentrate on the most severe risks after assessment, ensuring efficient allocation of defensive resources.

Red Teams are tasked with emulating potential adversaries to test and improve the security posture of an organization. They require intelligence on the latest vulnerabilities, threat actors, and their TTPs to simulate realistic attack scenarios and identify potential weaknesses in the organization's defenses. This information helps Red Teams in crafting their attack strategies to be as realistic and relevant as possible, thereby providing valuable insights into how actual attackers might exploit the organization's systems. This need contrasts with the requirements of other teams or roles within an organization, such as strategic decision-makers, who might be more interested in intelligence related to strategic risks or Blue Teams, which focus on defending against and responding to attacks.

Passive DNS monitoring involves collecting data about DNS queries and responses without actively querying DNS servers, thereby not altering or interfering with DNS traffic. This technique allows analysts to track changes in DNS records and observe patterns that may indicate malicious activity. In the scenario described, Enrique is employing passive DNS monitoring by using a recursive DNS server to log the responses received from name servers, storing these logs in a central database for analysis. This approach is effective for identifying malicious domains, mapping malware campaigns, and understanding threat actors' infrastructure without alerting them to the fact that they are being monitored. This method is distinct from active techniques such as DNS interrogation or zone transfers, which involve sending queries to DNS servers, and dynamic DNS, which refers to the automatic updating of DNS records.

For Alice to perform qualitative data analysis, techniques such as brainstorming, interviewing, SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis, and the Delphi technique are suitable. Unlike quantitative analysis, which involves numerical calculations and statistical modeling, qualitative analysis focuses on understanding patterns, themes, and narratives within the data. These techniques enable the analyst to explore the data's deeper meanings and insights, which are essential for strategic decision-making and developing a nuanced understanding of cybersecurity threats and vulnerabilities.

Strategic Threat Intelligence provides high-level insights into the overall threat landscape, long-term trends, and the potential impact of emerging cyber threats on business operations and strategy. It is primarily designed for executives, policymakers, and senior management to make informed decisions that align with organizational goals and risk tolerance.

This intelligence type translates complex technical data into business-relevant language, helping leadership understand:

The motives and objectives of threat actors.

The geopolitical or industry trends affecting cybersecurity risk.

The overall security posture and areas requiring investment.

How to allocate resources for long-term resilience and compliance.

Why the Other Options Are Incorrect:

A. Operational Threat Intelligence:Focuses on ongoing campaigns and immediate threats relevant to security operations and incident response teams.

B. Tactical Threat Intelligence:Deals with adversary Tactics, Techniques, and Procedures (TTPs) and is used by SOC and defense analysts for short-term defensive actions.

D. Technical Threat Intelligence:Focuses on technical indicators such as IP addresses, hashes, and URLs, used for detection and blocking within security tools.

Conclusion:

For a CEO focusing on long-term strategic decisions and organizational resilience, the most valuable form of threat intelligence is Strategic Threat Intelligence.

Final Answer: C. Strategic Threat Intelligence

Explanation Reference (Based on CTIA Study Concepts):

As outlined in CTIA’s section on Types of Threat Intelligence, strategic threat intelligence provides executive-level insights for planning and governance, supporting risk management and long-term decision-making.

Normalization in the context of data analysis refers to the process of organizing data to reduce redundancy and improve efficiency in storing and sharing. By filtering, tagging, and queuing, Miley is effectively normalizing the data—converting it from various unstructured formats into a structured, more accessible format. This makes the data easier to analyze, store, and share. Normalization is crucial in cybersecurity and threat intelligence to manage the vast amounts of data collected and ensure that only relevant data is retained and analyzed. This technique contrasts with sandboxing, which is used for isolating and analyzing suspicious code; data visualization, which involves representing data graphically; and convenience sampling, which is a method of sampling where samples are taken from a group that is conveniently accessible.

The phase where threat intelligence analysts convert raw data into useful information by applying various techniques, such as machine learning or statistical methods, is known as 'Processing and Exploitation'. During this phase, collected data is processed, standardized, and analyzed to extract relevant information. This is a critical step in the threat intelligence lifecycle, transforming raw data into a format that can be further analyzed and turned into actionable intelligence in the subsequent 'Analysis and Production' phase.

The correct sequence for scheduling a threat intelligence program involves starting with the foundational steps of defining the project scope and objectives, followed by detailed planning and scheduling of tasks. The sequence starts with reviewing the project charter (1) to understand the project's scope, objectives, and constraints. Next, building a Work Breakdown Structure (WBS) (9) helps in organizing the team's work into manageable sections. Identifying all deliverables (2) clarifies the project's outcomes. Defining all activities (8) involves listing the tasks required to produce the deliverables. Identifying the sequence of activities (3) and estimating resources (7) and task dependencies (4) sets the groundwork for scheduling. Estimating the duration of each activity (6) is critical before developing the final schedule (5), which combines all these elements into a comprehensive plan. This approach ensures a structured and methodical progression from project initiation to execution.

The scenario describes a situation where Philip gathers intelligence through direct personal relationships or covert human contact with the target individual. This aligns with the intelligence source known as CHIS (Covert Human Intelligence Source).

CHIS refers to intelligence collected from a human source who provides information about individuals, groups, or organizations, often through personal relationships or covert interaction. This type of intelligence is gathered directly from people rather than technical or electronic means.

In the context of threat intelligence and security analysis, CHIS is part of Human Intelligence (HUMINT), which involves acquiring information through human interaction. Such sources can include insiders, informants, or individuals with access to sensitive details about the target organization.

Attackers or intelligence professionals use this method to gather sensitive or non-public information that cannot be obtained from open or technical sources. Philip’s method of maintaining a personal relationship with the target person to collect information fits perfectly into this category.

Why the Other Options Are Incorrect:

B. MASINT (Measurement and Signature Intelligence):This intelligence source collects and analyzes data obtained from sensors, measuring electromagnetic, acoustic, or nuclear signatures. It is a technical intelligence method and does not involve human relationships.

C. SOCMINT (Social Media Intelligence):SOCMINT involves collecting intelligence from social media platforms such as Facebook, LinkedIn, Twitter, or Instagram. It uses publicly available data rather than personal interaction.

D. FISINT (Foreign Instrumentation Signals Intelligence):This refers to intelligence derived from intercepted foreign instrument signals, such as telemetry or weapon system emissions. It is related to technical and signals intelligence, not human sources.

Conclusion:

Philip used a Covert Human Intelligence Source (CHIS) approach, which involves collecting intelligence through human interaction or relationships to gain insider knowledge about the target organization.

Final Answer: A. CHIS

Explanation Reference (Based on CTIA Study Concepts):

Based on the CTIA study guide section on “Sources of Threat Intelligence,” CHIS is recognized as a human intelligence source derived from interpersonal contact, covert sources, or informants that provide insider-level information about an organization or target individual.

Analysis of Competing Hypotheses (ACH) is an analytic process designed to help an analyst or a team of analysts evaluate multiple competing hypotheses on an issue fairly and objectively. ACH assists in identifying and analyzing the evidence for and against each hypothesis, ultimately aiding in determining the most likely explanation. In the scenario where a team of threat intelligence analysts has various theories on a particular malware, ACH would be the most appropriate method to assess these competing theories systematically. ACH involves listing all possible hypotheses, collecting data and evidence, and assessing the evidence's consistency with each hypothesis. This process helps in minimizing cognitive biases and making a more informed decision on the most consistent theory.

For H&P, Inc., a small-scale organization looking to outsource network security monitoring and incorporate threat intelligence into their network defenses cost-effectively, recruiting a Managed Security Service Provider (MSSP) would be the most suitable option. MSSPs offer a range of services including network security monitoring, threat intelligence, incident response, and compliance management, often at a lower cost than maintaining an in-house security team. This allows organizations to benefit from expert services and advanced security technologies without the need for significant resource investment.