10 free, exam-style Certified Threat Intelligence Analyst (CTIA) practice questions with answers and explanations. No signup required. Work through them below, then take the full free CTIA practice test to study every exam domain.
The CTIA exam has 50 questions and runs 2 hours.
These 10 free CTIA questions are organized by exam domain, so you can see how each part of the Certified Threat Intelligence Analyst blueprint is tested. Reveal the answer and explanation under each question.
Nadia receives threat intelligence about trending malware families being used against organizations in the energy sector. She prepares a presentation for the board of directors about the potential business impact. Nadia is consuming intelligence at which level?
Correct answer: D - Strategic
An attacker sets up a watering hole attack by compromising a website frequently visited by employees of the target organization. Visiting the compromised site triggers a drive-by download. Which TWO Cyber Kill Chain phases are represented?
Correct answer: B - Delivery and Exploitation
An organization develops detection rules that identify specific adversary behaviors (such as living-off-the-land techniques and lateral movement patterns) rather than relying solely on hash and IP blocking. According to the Pyramid of Pain, this approach:
Correct answer: B - Targets the highest level, inflicting maximum pain
An analyst needs to visually map relationships between an adversary's domains, IP addresses, email addresses, and social media accounts. Which tool is MOST suitable?
Correct answer: B - Maltego
An analyst identifies suspicious API imports like 'CreateRemoteThread' and 'VirtualAllocEx' during static analysis. These imports suggest the malware may:
Correct answer: B - Perform process injection
A web application does not log user actions, allowing a malicious user to deny making a fraudulent transaction. In STRIDE, this is:
Correct answer: B - Repudiation
A CTI team is investigating a breach and has three competing theories about the responsible threat actor. To systematically evaluate each theory against the available evidence, the team should use:
Correct answer: B - The Analysis of Competing Hypotheses (ACH)
An analyst receives intelligence marked TLP:AMBER about a critical vulnerability being actively exploited. The analyst's MOST appropriate action is:
Correct answer: B - Share it within the organization on a need-to-know basis to relevant teams
A threat hunt reveals that several workstations are making periodic HTTPS connections to a previously unknown external domain at exact 60-second intervals. This pattern is consistent with:
Correct answer: B - C2 beaconing activity
During an active incident, how can threat intelligence MOST effectively accelerate containment?
Correct answer: B - By revealing known TTPs and C2 infrastructure to target
The CTIA exam also covers these domains. Drill them in the full free practice test:
Practice hundreds more CTIA questions with instant scoring, weak-area drills, and full exam simulations.