Question bank
Certified Threat Intelligence Manager
42 Certified Threat Intelligence Manager questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Intelligence Analysis and Production
10 questions in this domain
- Question 1Single Choice
What is the primary purpose of structured analytic techniques (SATs) in threat intelligence?
- ATo replace subject-matter expertise
- BTo mitigate cognitive biases and enhance rigorCorrect answer
- CTo automate data collection
- DTo increase report length
Why this is the answer
SATs are designed to reduce cognitive biases and strengthen analytical rigor, not to replace expertise or automate tasks.
- Question 2Multiple Select
Which of the following are common structured analytic techniques used in threat intelligence? (Select all that apply.)
- AAnalysis of Competing Hypotheses (ACH)Correct answer
- BDevil's AdvocacyCorrect answer
- CRandom Sampling
- DKey Assumptions Check (KAC)Correct answer
Why this is the answer
ACH, Devil's Advocacy, and KAC are SATs; random sampling is a statistical method, not an analytic technique.
- Question 3Interactive
Review the code block representing an Analysis of Competing Hypotheses (ACH) matrix. Which hypothesis is best supported by the evidence?
- AHypothesis A: Insider threat
- BHypothesis B: External cybercriminalCorrect answer
- CHypothesis C: State-sponsored actor
- DHypothesis D: Accidental exposure
Why this is the answer
In the matrix, Hypothesis B (External cybercriminal) has the most consistent evidence (6 points) compared to others.
- Question 4Single Choice
Which structured analytic technique is specifically designed to counter confirmation bias?
- ADevil's Advocacy
- BAnalysis of Competing Hypotheses (ACH)Correct answer
- CPre-Mortem
- DStructured Brainstorming
Why this is the answer
ACH forces analysts to evaluate evidence for and against all hypotheses, directly countering confirmation bias.
- Question 5Multiple Select
Which of the following are characteristics of the Key Assumptions Check (KAC) technique? (Select all that apply.)
- AIt lists underlying assumptions behind a judgmentCorrect answer
- BIt requires building a simulation of the adversary
- CIt tests each assumption for validityCorrect answer
- DIt is typically used at the start of analysisCorrect answer
Why this is the answer
KAC involves listing and testing assumptions; it does not involve simulations—that is red teaming.
- Question 6Interactive
Examine the pre-mortem code block. What is the primary objective of this technique as shown?
- ATo identify what could cause a future failureCorrect answer
- BTo assign blame after a failure
- CTo celebrate a successful mission
- DTo collect more data
Why this is the answer
Pre-mortem is a forward-looking technique that imagines a future failure and works backward to find potential causes.
- Question 7Single Choice
What is the anchoring bias in intelligence analysis?
- ATrusting automated tools uncritically
- BRelying too heavily on the first piece of informationCorrect answer
- CSeeking evidence that confirms pre-existing beliefs
- DOverestimating the likelihood of vivid events
Why this is the answer
Anchoring bias occurs when initial information unduly influences subsequent judgments, such as a first threat report setting a baseline.
- Question 8Multiple Select
Which of the following cognitive biases can be mitigated by using Devil's Advocacy? (Select all that apply.)
- AGroupthinkCorrect answer
- BConfirmation bias
- CAvailability heuristic
- DOverconfidenceCorrect answer
Why this is the answer
Devil's Advocacy challenges consensus (groupthink) and complacency, and can expose overconfident judgments.
- Question 9Interactive
The code block contains a scenario illustrating a cognitive bias. Identify the bias being demonstrated.
- AAnchoring bias
- BConfirmation biasCorrect answer
- CAvailability heuristic
- DMirror-imaging
Why this is the answer
The analyst selectively uses evidence that supports their initial belief (state-sponsored) and ignores contradictory data, which is confirmation bias.
- Question 10Single Choice
What is the best definition of critical thinking in intelligence analysis?
- AAccepting the first plausible explanation
- BA disciplined process of evaluating information from multiple sourcesCorrect answer
- CRelying on intuition and experience
- DFollowing automated tool outputs without question
Why this is the answer
Critical thinking involves systematic analysis, synthesis, and evaluation of information, not shortcuts or blind trust in tools.
Intelligence Management and Governance
11 questions in this domain
- Question 11Single Choice
Within the CCTIM framework, what is the primary responsibility of the Intelligence Manager?
- AConducting deep malware reverse engineering during incidents
- BOverseeing team operations, budget, stakeholder engagement, and quality controlCorrect answer
- CPerforming all tactical analysis and indicator extraction
- DManaging the technical deployment of intelligence platforms
Why this is the answer
The Intelligence Manager is primarily responsible for management, not hands-on technical analysis.
- Question 12Multiple Select
Which of the following are recognized functional roles in an intelligence team within the CCTIM framework? (Select all that apply.)
- AIntelligence ManagerCorrect answer
- BCollectorCorrect answer
- CNetwork Engineer
- DDisseminatorCorrect answer
Why this is the answer
The framework includes Manager, Analysts (strategic/operational/tactical), Collectors, and Disseminators.
- Question 13Interactive
Review the following code snippet representing a role responsibility mapping. Which role is incorrectly assigned?
- AStrategic Analyst – produces executive-level reports
- BTactical Analyst – dissects indicators of compromise
- CIntelligence Manager – conducts malware reverse engineeringCorrect answer
- DCollector – sources raw data via OSINT and threat feeds
Why this is the answer
The Manager oversees operations; malware analysis is a tactical analyst function.
- Question 14Single Choice
What is the primary benefit of a centralized intelligence team model as described in CCTIM?
- AFaster tactical response to incidents
- BConsistent analytic methodology and reduced duplicationCorrect answer
- CBetter context for specific business unit needs
- DEasier to embed analysts in multiple departments
Why this is the answer
Centralized teams ensure uniform methodology and avoid duplication; distributed models offer business context.
- Question 15Multiple Select
Which of the following are correct statements about the tasking and coordination cycle in intelligence management? (Select all that apply.)
- ATasking is a one-time initial step that does not require feedback
- BThe cycle includes Requirements Definition, Collection Plan, Analysis, Production, Dissemination, and FeedbackCorrect answer
- CProper coordination avoids duplication and blind spotsCorrect answer
- DFeedback loops are optional and only used after major incidents
Why this is the answer
The cycle is continuous with feedback; tasking is ongoing, not one-time.
- Question 16Interactive
The code snippet shows a list of team structures. Which one is the hybrid model?
- AModel A: Single central unit, no regional presence
- BModel B: Analysts distributed in each line of business, no central pool
- CModel C: Centralized core team plus embedded analysts in business unitsCorrect answer
- DModel D: Completely decentralized ad-hoc analysts across departments
Why this is the answer
Hybrid pools core capabilities while placing liaisons to maintain context.
- Question 17Single Choice
What is a Priority Intelligence Requirement (PIR) as defined in the CCTIM framework?
- AA list of all available threat feeds and collection sources
- BA mission-critical intelligence need that is prioritized over other requirementsCorrect answer
- CA performance metric used to measure analyst output
- DA standard operating procedure for intelligence sharing
Why this is the answer
PIRs are the most important intelligence needs, prioritized based on mission criticality.
- Question 18Multiple Select
Which of the following are essential steps in stakeholder engagement according to CCTIM? (Select all that apply.)
- AConducting a one-time mapping of stakeholders at the program start
- BUsing feedback loops to refine intelligence requirementsCorrect answer
- CEstablishing formal service-level agreements for reportingCorrect answer
- DAutomatically accepting all stakeholder requests without prioritization
Why this is the answer
Engagement is continuous with feedback loops and SLAs; prioritization and mapping are ongoing.
- Question 19Interactive
The code shows an excerpt from a stakeholder mapping matrix. Which stakeholder is incorrectly paired with their intelligence need?
- ACISO: strategic threat brief for board reporting
- BSOC Manager: daily tactical IOCs and TTPs
- CBoard: raw IP addresses and file hashesCorrect answer
- DLegal & Compliance: intelligence on regulatory changes
Why this is the answer
The board needs strategic summaries, not raw technical indicators. Tactical data is for SOC.
- Question 20Single Choice
According to CCTIM, what is the correct classification for sharing intelligence that can be distributed only within the organization and its clients on a need-to-know basis?
- ATLP:RED
- BTLP:AMBERCorrect answer
- CTLP:GREEN
- DTLP:WHITE
Why this is the answer
TLP:AMBER is for organization and clients on a need-to-know basis; RED is only for direct recipients.
- Question 21Multiple Select
Which of the following are characteristics of Information Sharing and Analysis Centers (ISACs)? (Select all that apply.)
- AISACs are sector-specific hubs for trusted intelligence sharingCorrect answer
- BMembership automatically grants access to all shared data without reciprocity
- CISACs often provide anonymized threat data and best practicesCorrect answer
- DISACs are only available for government entities
Why this is the answer
ISACs are sector-specific; they require reciprocity and are open to private sector as well.
Operational Intelligence and Incident Response
8 questions in this domain
- Question 22Single Choice
What is the primary purpose of an intelligence-driven incident response workflow?
- ATo increase the number of indicators collected during an incident
- BTo reduce dwell time and prioritize alerts based on threat actor behaviorCorrect answer
- CTo replace human analysts with automated playbooks
- DTo ensure all incidents are reported to law enforcement immediately
Why this is the answer
An intelligence-driven workflow reduces dwell time and prioritizes alerts using threat actor behavior, making response proactive.
- Question 23Multiple Select
Which of the following are key concepts in an intelligence-driven incident response workflow? (Select two)
- AIntelligence Requirements (IRQs)Correct answer
- BFeedback loop between CTI and IRCorrect answer
- CCollecting as many IOCs as possible before acting
- DIgnoring strategic intelligence during containment
Why this is the answer
IRQs and the feedback loop are key; they ensure intelligence is relevant and continuously improved.
- Question 24Interactive
Analyze the following code snippet from a playbook. What is the most likely purpose of this automation step?
- AEnriching an IP address with threat intelligence
- BBlocking a domain on a firewall
- CQuarantining a host based on an IOC matchCorrect answer
- DGenerating a report for the CISO
Why this is the answer
The code isolates a host using the endpoint agent, which is containment through quarantine.
- Question 25Single Choice
What does TIP stand for in the context of threat intelligence?
- AThreat Integration Protocol
- BThreat Intelligence PlatformCorrect answer
- CTechnical Indicator Processor
- DTactical Intelligence Pipeline
Why this is the answer
TIP stands for Threat Intelligence Platform, the system centralizing and operationalizing threat data.
- Question 26Multiple Select
Which two functions are performed by a Threat Intelligence Platform (TIP)? (Select two)
- AAggregation of threat data from multiple sourcesCorrect answer
- BNormalization of indicators into a standard schemaCorrect answer
- CExecution of ransomware code to analyze behavior
- DDirect correlation of firewall logs in real time
Why this is the answer
TIPs aggregate data and normalize it (e.g., STIX). They do not execute malware or directly correlate logs.
- Question 27Interactive
The JSON snippet below shows a part of a TIP configuration. What is this configuration defining?
- AAn API endpoint for SIEM integration
- BA TAXII server for intelligence sharingCorrect answer
- CA firewall rule to block malicious IPs
- DA logging level for debugging
Why this is the answer
The JSON defines a TAXII server with collection and polling settings for sharing intelligence.
- Question 28Single Choice
What is the difference between an IOC and an IOA?
- AIOAs are forensic artifacts while IOCs are behavioral patterns
- BIOAs focus on behavioral patterns, IOCs on forensic artifactsCorrect answer
- CIOCs are more predictive than IOAs
- DThere is no difference; the terms are interchangeable
Why this is the answer
IOAs indicate attack behavior in progress; IOCs are forensic evidence. IOAs are more predictive.
- Question 29Multiple Select
Which two statements about automated enrichment are correct? (Select two)
- AIt replaces human judgment completely
- BIt adds contextual data to raw indicatorsCorrect answer
- CIt reduces mean time to respond (MTTR)Correct answer
- DIt always eliminates false positives
Why this is the answer
Enrichment adds context and reduces MTTR, but still requires human validation and cannot eliminate all false positives.
Strategic Intelligence and Future Trends
4 questions in this domain
- Question 30Single Choice
Which of the following is an example of a macro-economic indicator that could influence cybercrime trends?
- ADiplomatic sanctions
- BCurrency devaluationCorrect answer
- CZero-day exploit
- DElection interference
Why this is the answer
Currency devaluation affects economic stability and can drive individuals to cybercrime as an alternative income source.
- Question 31Multiple Select
Which of the following are emerging technology threats discussed in the context of threat intelligence? (Select two)
- AAdversarial AI poisoningCorrect answer
- BIoT botnetsCorrect answer
- CTraditional firewall exploits
- DSupply chain attacks on SaaS vendors
Why this is the answer
Adversarial AI and IoT botnets are explicitly cited as emerging technology threats in the playbook.
- Question 32Interactive
Review the code snippet below. What does the scenario planning function return when the critical_uncertainty is 'High state-sponsored hacktivism' and driving_force is 'Slow regulatory enforcement'?
- AChaos and Opportunism
- BState-Led Cyber ConflictCorrect answer
- CRegulated Stability
- DCorporate Resilience
Why this is the answer
The function maps high hacktivism and slow regulation to 'State-Led Cyber Conflict' as per the 2x2 matrix logic.
- Question 33Single Choice
In the finance sector, which of the following is a primary adversary motivation?
- AGeopolitical disruption
- BFinancial gainCorrect answer
- CEspionage
- DSabotage
Why this is the answer
Finance sector adversaries are primarily profit-driven, such as cybercriminal groups and organized crime.
Threat Actor Analysis and Profiling
9 questions in this domain
- Question 34Single Choice
What are the four core components of the Diamond Model of Intrusion Analysis?
- AAdversary, Capability, Infrastructure, VictimCorrect answer
- BAdversary, Tool, Network, Target
- CAttacker, Exploit, Server, Organization
- DThreat Actor, Malware, Domain, Company
Why this is the answer
The Diamond Model defines four vertices: Adversary (threat actor), Capability (tools and malware), Infrastructure (IPs, domains, servers), and Victim (target organization). All other combinations are incorrect because they either rename or omit one of the core components.
- Question 35Multiple Select
Which of the following are phases of the Cyber Kill Chain as defined by Lockheed Martin? (Select all that apply.)
- AReconnaissanceCorrect answer
- BWeaponizationCorrect answer
- CDeliveryCorrect answer
- DAttribution
Why this is the answer
The Cyber Kill Chain includes seven phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives. 'Attribution' is not a phase; it is an outcome of analysis using frameworks like the Diamond Model.
- Question 36Interactive
Review the following Python code snippet that maps an observed indicator to a Diamond Model vertex. Which vertex does the function return for a C2 domain?
- AAdversary
- BCapability
- CInfrastructureCorrect answer
- DVictim
Why this is the answer
In the Diamond Model, Infrastructure includes IP addresses, domains, and servers. A C2 domain falls under Infrastructure because it is the channel used for communication, not the tool itself (Capability) or the entity behind the attack (Adversary).
- Question 37Single Choice
In the context of the Diamond Model, what does the 'social-political axis' represent?
- AAdversary and VictimCorrect answer
- BCapability and Infrastructure
- CAdversary and Infrastructure
- DCapability and Victim
Why this is the answer
The Diamond Model divides its edges into a social-political axis (Adversary-Victim) and a technical axis (Capability-Infrastructure). The social-political axis captures the intent and motivation behind the attack, such as geopolitical conflicts or financial gain.
- Question 38Multiple Select
Which of the following statements about Advanced Persistent Threat (APT) groups are correct? (Select all that apply.)
- AThey typically pursue long-term intelligence gathering or strategic disruption.Correct answer
- BThey are defined by opportunistic, short-term financial gain targets.
- CThey often use sophisticated techniques and maintain persistence in networks.Correct answer
- DThey only target critical infrastructure and never large enterprises.
Why this is the answer
APTs are characterized by sophistication, persistence, and targeting of specific entities for strategic objectives (intelligence, IP theft, disruption). Opportunistic financial gain describes cybercriminals, not APTs. While APTs often target critical infrastructure, they also target large enterprises and governments.
- Question 39Interactive
The following JavaScript snippet simulates a confidence scoring function for attribution. If the inputs are 'same_capability' and 'same_victim_sector', what confidence level is returned?
- ALow
- BMediumCorrect answer
- CHigh
- DVery High
Why this is the answer
The function returns 'Medium' when two axes overlap (both technical and social-political). Low would be only one axis, High would require three or more overlaps. Having matching capability (technical) and victim sector (social-political) gives medium confidence.
- Question 40Single Choice
What is the primary difference between Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs)?
- AIoCs are tactical and short-lived, while TTPs are behavioral patterns that persist longer.Correct answer
- BIoCs are behavioral patterns, while TTPs are specific file hashes and IP addresses.
- CIoCs provide strategic intelligence, while TTPs are used for immediate blocking.
- DBoth IoCs and TTPs have the same lifespan and are used for the same purpose.
Why this is the answer
IoCs are atomic artifacts (hashes, IPs, domains) that change quickly, while TTPs describe how an adversary operates and remain relatively stable across campaigns. The Pyramid of Pain illustrates that TTPs are at the apex because they are hardest for adversaries to change.
- Question 41Multiple Select
Which of the following are examples of Indicators of Compromise (IoCs)? (Select all that apply.)
- AMD5 hash of a malware sampleCorrect answer
- BA known command-and-control IP addressCorrect answer
- CThe use of spear-phishing as an initial access technique
- DA specific domain name used for exfiltrationCorrect answer
Why this is the answer
IoCs are atomic or computed indicators such as hashes, IPs, and domains. 'Use of spear-phishing' is a TTP (technique), not an IoC. Spear-phishing is a behavioral pattern, not a specific artifact that can be blocked at the network or endpoint level.
- Question 42Interactive
The following YARA rule is intended to detect a specific malware family. Which MITRE ATT&CK technique sub-ID (if any) does this rule primarily target? (Assume the rule triggers on a process accessing SAM registry hive.)
- AT1003.001 (LSASS Memory)
- BT1003.002 (Security Account Manager)Correct answer
- CT1059.001 (PowerShell)
- DT1204.002 (Malicious File)
Why this is the answer
Accessing the SAM registry hive is a common technique for credential dumping, specifically T1003.002 (Security Account Manager). LSASS memory access (T1003.001) is different. PowerShell (T1059.001) and Malicious File (T1204.002) are unrelated to SAM access.
Frequently asked questions
Everything about the Certified Threat Intelligence Manager question bank and how to use it.