CTIA Practice Test

CTIA practice test: what's covered

• TI lifecycle
• diamond
• kill chain
• MITRE
• OSINT
• sharing
• ATT&CK

Free CTIA sample questions

1. A SOC manager hands an analyst a list of 50,000 malicious IPs and calls it 'threat intelligence'. The analyst pushes back, explaining the feed is not yet intelligence. What transformation must occur first?

   • A. The raw indicators must be processed, correlated, and analyzed into evidence-based, actionable knowledge that informs a specific defensive decision
   • B. The indicators must be alphabetized and exported to a spreadsheet so leadership can read them more easily during reviews
   • C. The list must be encrypted and shared only over TAXII so that it qualifies as formal intelligence under the standard
   • D. The IPs must be enriched with geolocation country flags, which by definition converts any data feed into finished intelligence
   Show answer

   Correct: A. Per the data-information-intelligence pyramid, a raw indicator feed is only data. Intelligence is evidence-based, contextual, and actionable. The other choices are incorrect because formatting, encryption/transport, or geolocation enrichment alone add no analytic context and do not answer a decision-maker's question, so the feed remains data, not intelligence.

2. A CTI lead is preparing a quarterly briefing for the company's board of directors about ransomware risk to the sector. Which level of threat intelligence and audience framing should this product target?

   • A. Technical intelligence consisting of atomic IOCs such as file hashes for the board to load into the EDR themselves
   • B. Tactical intelligence describing specific MITRE ATT&CK techniques and detection logic for SOC analysts to deploy
   • C. Strategic intelligence focused on long-term trends, business impact, and risk in non-technical language for executives
   • D. Operational intelligence on a single named campaign's command-and-control infrastructure currently being tracked
   Show answer

   Correct: C. Board audiences need strategic intelligence: high-level trends and business-risk framing, not technical detail. Technical/atomic IOCs and tactical ATT&CK detection logic are incorrect because they target analysts and tools, not executives. Operational campaign C2 detail is also wrong because it serves TI/SOC managers tracking active campaigns, whereas the board needs decision-level risk context.

3. A new CTI team is standing up its program and mapping out the six-phase threat intelligence lifecycle. Which statements about the lifecycle phases are accurate? (Choose THREE)

   • A. Planning and Direction defines Priority Intelligence Requirements that scope what the program will collect and analyze
   • B. Processing converts raw collected data into a usable form through normalization, decryption, translation, and deduplication
   • C. Dissemination delivers finished intelligence to the right consumers, and Feedback refines requirements for the next cycle
   • D. Collection is the final phase and produces the executive summary report that closes out the intelligence engagement
   • E. Analysis is skipped entirely whenever a commercial vendor feed is purchased, because vendors deliver finished intelligence
   Show answer

   Correct: A and B and C. The lifecycle is Planning/Direction, Collection, Processing, Analysis, Dissemination, Feedback. Planning sets PIRs, Processing readies data, and Dissemination plus Feedback close the loop. The other two are incorrect: Collection is not the final phase and produces no report, and Analysis is never skipped because consumers must still validate, contextualize, and apply vendor feeds to their own environment.

4. Before launching collection, a threat intelligence manager meets with leadership to capture the questions the program must answer, such as 'Which actors target our industry and what is their likely delivery method?'. What is this output called?

   • A. Indicators of Compromise that the SOC will use to tune detections after the program is fully operational
   • B. Priority Intelligence Requirements that scope and direct all subsequent collection, analysis, and reporting
   • C. A Traffic Light Protocol marking that governs how the resulting intelligence may be shared externally
   • D. A Diamond Model event record documenting the adversary, capability, infrastructure, and victim involved
   Show answer

   Correct: B. Priority Intelligence Requirements are the leadership-driven questions captured during Planning and Direction that focus the entire program. IOCs are wrong because they are collection outputs, not planning inputs. TLP is a sharing-handling marking, not a requirement, and a Diamond Model event documents an intrusion rather than scoping the program, so neither directs collection.

5. An analyst investigating an intrusion identifies a command-and-control IP, then uses it to discover other malware samples beaconing to the same address and additional victims. Which Diamond Model practice is the analyst applying?

   • A. Pivoting across the adversary, capability, infrastructure, and victim vertices to enrich and expand the intrusion picture
   • B. Breaking the Cyber Kill Chain at the weaponization phase before the payload can be delivered to any target
   • C. Climbing the Pyramid of Pain from TTPs down to atomic indicators to make detection cheaper for the adversary
   • D. Applying the Traffic Light Protocol to decide which named recipients may receive the C2 indicator for blocking
   Show answer

   Correct: A. The Diamond Model's four vertices are adversary, capability, infrastructure, and victim, and analysts pivot between them to enrich events. The Cyber Kill Chain answer is incorrect because it describes phase interdiction, not pivoting. The Pyramid of Pain reference inverts its purpose, and TLP governs sharing, not analytic enrichment, so neither describes the pivoting technique used here.

Last updated: 2026-10-19

CTIA practice test FAQ