Study plan
How to Pass the Registered Threat Intelligence Analyst Exam
A study plan for the Registered Threat Intelligence Analyst certification exam, built from the official domain weights instead of a generic template. Start by mastering the intelligence lifecycle and each domain's weighting. Focus on practical hands-on labs that simulate real-world intelligence collection and analysis using OSINT tools, TIPs, and reporting frameworks. Use the CREST syllabus as a checklist to ensure domain coverage. Practice writing intelligence reports (both tactical and strategic) under timed conditions. Join threat intelligence communities and review published TTPs from common threat actors (e.g., APT groups, ransomware gangs). Supplement study with structured analytic technique exercises (e.g., analysis of competing hypotheses) and case studies from published breach reports. Expect scenario-based questions that test your ability to prioritize intelligence requirements and communicate findings to executives.
- 5 domains
- 120 questions
- 180 min
- 70% to pass
certilumStudy in weight order, not topic order
The plan below follows the official blueprint weights, so the order of study is the order that returns the most points.
- 1
Analysis and Processing
25%- Apply analytical techniques (e.g., structured analytic techniques, diamond model)
- Correlate indicators of compromise (IOCs) with threat actor groups
- Perform malware analysis basics and reverse engineering concepts
- Use threat intelligence platforms (TIPs) for data aggregation
- +1 more topics in the blueprint
37 practice questions tagged to this domain.
- 2
Intelligence Collection and Sources
25%- Identify and evaluate open-source intelligence (OSINT) sources
- Leverage human intelligence (HUMINT) and technical intelligence (TECHINT)
- Utilize dark web monitoring and deep web data sources
- Analyze threat actor motivations, capabilities, and TTPs
- +1 more topics in the blueprint
43 practice questions tagged to this domain.
- 3
Dissemination and Reporting
20%- Write actionable intelligence reports for technical and non-technical audiences
- Create threat briefings and executive summaries
- Apply marking, handling, and classification procedures
- Share intelligence via trusted communities (e.g., ISACs, ISAOs)
- +1 more topics in the blueprint
30 practice questions tagged to this domain.
- 4
Threat Intelligence Concepts and Principles
15%- Define threat intelligence and its strategic, operational, and tactical levels
- Explain the intelligence cycle (direction, collection, processing, analysis, dissemination)
- Understand the difference between data, information, and intelligence
- Identify intelligence consumers and their requirements
- +1 more topics in the blueprint
24 practice questions tagged to this domain.
- 5
Operational Intelligence and Incident Response
15%- Integrate threat intelligence into incident response and SOC operations
- Support proactive threat hunting using intelligence-driven approaches
- Monitor and track threat actor campaigns and infrastructure
- Apply intelligence to improve detection signatures and security controls
- +1 more topics in the blueprint
16 practice questions tagged to this domain.
Three phases, in order
Most failures are process failures, not knowledge failures.
Phase 1 — Learn the high-weight domains
Start where the points are. The first domains on this plan carry the most weight, so a gap there costs the most. Cover the objectives, then close each topic with practice questions you actually get wrong.
Phase 2 — Close the mid-weight domains
The middle of the blueprint is where most candidates plateau. These domains are worth less per topic than the first phase, but they add up fast, and they are the usual difference between a near miss and a clear pass.
Phase 3 — Timed full mocks
Stop reading new material at this point. Run full-length exams under the real time limit and the real format, and use the per-domain breakdown to find which domain is still costing you the pass.
Where we put the emphasis
Certilum’s Registered Threat Intelligence Analyst prep emphasizes practical tradecraft via OSINT quizzes, structured analytical technique exercises, and simulated report writing. Practice exams focus on bridging theory and operational application – built by active threat intelligence professionals.
The order matters less than the loop. Every domain you finish should end with questions you got wrong, because the mistake is the only thing you actually needed to study. On the Registered Threat Intelligence Analyst that loop is worth 25% of the exam in the first block alone.
More about the Registered Threat Intelligence Analyst exam
Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.
Related certifications
Explore other certifications in the same category and see how they stack up.
Frequently asked questions
Everything you need to know about the Registered Threat Intelligence Analyst exam.