Question bank
Practitioner Threat Intelligence Analyst
40 Practitioner Threat Intelligence Analyst questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Operationalizing Threat Intelligence
6 questions in this domain
- Question 1Single Choice
What is the primary goal of proactive defense in threat intelligence?
- ATo respond to incidents after they occur
- BTo anticipate and prevent attacks before they happenCorrect answer
- CTo comply with regulatory requirements
- DTo reduce the cost of security tools
Why this is the answer
Proactive defense shifts from reactive incident response to anticipatory security operations, aiming to detect and prevent attacks early.
- Question 2Multiple Select
Which of the following are core pillars of proactive defense? (Select all that apply)
- AHuntingCorrect answer
- BHardeningCorrect answer
- CDeceptionCorrect answer
- DVulnerability scanning
Why this is the answer
Proactive defense includes hunting, hardening, and deception as core pillars to detect and prevent threats.
- Question 3Interactive
Analyze the following scenario: An analyst searches logs for hosts that executed an Office document and then made outbound HTTPS connections to newly registered domains. What proactive defense activity is being performed?
- AHuntingCorrect answer
- BHardening
- CDeception
- DIncident response
Why this is the answer
Hunting involves hypothesis-driven searches for undetected threats based on threat intelligence.
- Question 4Single Choice
What type of intelligence is most suitable for proactive defense rather than reactive detection?
- AIndicators of Compromise (IOCs)
- BTactics, Techniques, and Procedures (TTPs)Correct answer
- CIP address blocklists
- DFile hashes
Why this is the answer
Proactive defense requires behavioral patterns (TTPs) to hunt for unknown variants, not just known bad indicators.
- Question 5Multiple Select
Which of the following are key concepts in using intelligence to prioritize vulnerability management? (Select all that apply)
- AExploit maturity and weaponization statusCorrect answer
- BAsset criticality and business contextCorrect answer
- CCVSS score alone
- DThreat actor targeting and sector alignmentCorrect answer
Why this is the answer
Intelligence provides exploit maturity, asset context, and threat actor targeting to prioritize vulnerabilities beyond CVSS.
- Question 6Interactive
A vulnerability with CVSS 7.5 is being actively exploited in ransomware attacks targeting your industry, while a CVSS 9.0 vulnerability has no known exploits. Which should be patched first?
- AThe CVSS 9.0 vulnerability
- BThe actively exploited CVSS 7.5 vulnerabilityCorrect answer
- CBoth equally
- DNeither – wait for vendor patch
Why this is the answer
Intelligence-driven prioritization favors actively exploited vulnerabilities over higher CVSS scores with no real-world threat.
Threat Intelligence Analysis and Production
12 questions in this domain
- Question 7Single Choice
What is the primary purpose of Analysis of Competing Hypotheses (ACH) in threat intelligence?
- ATo confirm a single hypothesis as true
- BTo identify which hypotheses are least supportedCorrect answer
- CTo generate as many hypotheses as possible
- DTo rank hypotheses by their impact on the organization
Why this is the answer
ACH systematically evaluates each hypothesis against evidence, focusing on the least supported to avoid confirmation bias.
- Question 8Multiple Select
Which of the following are key concepts in structured analysis as per the CPTIA syllabus? (Choose two)
- AMECE principleCorrect answer
- BPre-mortem analysisCorrect answer
- CBayesian inference
- DRoot cause analysis
Why this is the answer
MECE and Pre-mortem are listed; Bayesian and Root cause are not part of the defined key concepts.
- Question 9Interactive
Given a scenario where an analyst has three hypotheses for a malware campaign, which technique should be used to systematically evaluate them?
- ABrainstorming
- BAnalysis of Competing HypothesesCorrect answer
- CSWOT analysis
- DRoot cause analysis
Why this is the answer
ACH is specifically designed to evaluate and compare multiple hypotheses using evidence, reducing bias.
- Question 10Single Choice
What is the first step in static malware analysis?
- ADynamic execution in a sandbox
- BFile hashing (e.g., MD5, SHA1, SHA256)Correct answer
- CNetwork traffic capture
- DDisassembly of the binary
Why this is the answer
Static analysis begins with file hashing to generate unique identifiers for identification and lookup.
- Question 11Multiple Select
Which of the following are Indicators of Compromise (IOCs) that can be extracted from dynamic malware analysis? (Choose two)
- AAPI calls such as CreateRemoteThreadCorrect answer
- BEmbedded strings from the binary
- CRegistry modifications for persistenceCorrect answer
- DPE header imports and exports
Why this is the answer
Dynamic analysis observes runtime behavior: API calls and registry changes are behavioral IOCs; strings and PE headers are static.
- Question 12Interactive
During network traffic analysis, which tool is commonly used to capture and inspect packet captures for extracting IOCs?
- AWireshark
- BZeekCorrect answer
- CNmap
- DMetasploit
Why this is the answer
Zeek is specifically designed for network traffic analysis, producing logs for security monitoring.
- Question 13Single Choice
What is the purpose of pivot analysis in threat intelligence?
- ATo confirm a single IOC as malicious
- BTo use one indicator to find related or new indicatorsCorrect answer
- CTo remove false positives from a feed
- DTo assign a severity score to an IOC
Why this is the answer
Pivot analysis leverages one known IOC to discover other associated IOCs, expanding the threat picture.
- Question 14Multiple Select
Which two factors should analysts consider when validating an Indicator of Compromise?
- AFreshness (age of the indicator)Correct answer
- BThe color of the hacker group logo
- CFidelity (likelihood of true positive)Correct answer
- DThe number of syllables in the domain name
Why this is the answer
Validation depends on how recent and reliable the IOC is; freshness and fidelity are critical.
- Question 15Interactive
In log analysis, which Windows Event ID is associated with process creation?
- A4624
- B4688Correct answer
- C4634
- D5140
Why this is the answer
Event ID 4688 records process creation, a key indicator for monitoring execution.
- Question 16Single Choice
What does the MECE principle stand for?
- AMutually Exclusive, Collectively ExhaustiveCorrect answer
- BMaintaining Evidence, Credibility and Ethics
- CMultiple Events, Correlated Evidence
- DMeasurement, Evaluation, Collection, Execution
Why this is the answer
MECE ensures categories do not overlap and cover all possibilities, reducing analytical ambiguity.
- Question 17Multiple Select
Which of the following are examples of temporal correlation in threat intelligence? (Choose two)
- AA phishing email sent at the same time a user downloads a fileCorrect answer
- BTwo malware samples sharing the same encryption algorithm
- COutbound traffic spikes coinciding with a known campaign scheduleCorrect answer
- DBoth indicators originated from the same ASN
Why this is the answer
Temporal correlation relies on timing; email and download coincidence and traffic spikes are time-based.
- Question 18Interactive
Which MITRE ATT&CK technique is commonly used to map observed behaviors during campaign correlation?
- ACyber Kill Chain
- BMITRE ATT&CKCorrect answer
- CDiamond Model
- DISO 27001
Why this is the answer
MITRE ATT&CK provides a detailed taxonomy of adversary tactics and techniques used globally.
Threat Intelligence Collection
8 questions in this domain
- Question 19Single Choice
Which of the following is a key characteristic of Open Source Intelligence (OSINT)?
- ARequires subscription fees
- BOften requires cross-referencing for validationCorrect answer
- CAlways provides high-confidence IOCs
- DOnly available from government sources
Why this is the answer
OSINT is free and abundant but requires constant cross-referencing to ensure reliability.
- Question 20Multiple Select
Which two methods are considered passive collection techniques for domains?
- AWHOIS lookupCorrect answer
- BLive DNS query
- CPassive DNSCorrect answer
- DURL scanning service
Why this is the answer
WHOIS and passive DNS query registry or historical records without contacting the domain's authoritative servers.
- Question 21Interactive
The following MISP API call uploads an indicator. What type of indicator is being uploaded?
- AIP addressCorrect answer
- BDomain name
- CFile hash
- DURL
Why this is the answer
The 'value' field contains an IP address, which is the indicator type being uploaded.
- Question 22Single Choice
What is the primary function of Shodan in automated collection?
- AStore and share structured IOCs
- BCoordinate incident response
- CDiscover internet-facing services and assetsCorrect answer
- DPerform malware analysis
Why this is the answer
Shodan indexes banners from internet-connected devices for passive reconnaissance.
- Question 23Multiple Select
Which two steps are essential before deduplication in a data processing pipeline?
- ANormalizationCorrect answer
- BEncryption
- CSchema mappingCorrect answer
- DSource validation
Why this is the answer
Normalization ensures consistent format; schema mapping aligns data to a common model before duplicates can be identified.
- Question 24Interactive
The analyst writes: 'We have no information on the adversary's current C2 infrastructure.' This represents which type of intelligence gap?
- AKnowledge gapCorrect answer
- BSource gap
- CTemporal gap
- DResolution gap
Why this is the answer
The gap is a lack of information (knowledge), not due to source unavailability or timeframe.
- Question 25Single Choice
In the context of HUMINT, what does 'elicitation' refer to?
- AAutomated scraping of social media
- BSkilled questioning to gather information without revealing intentCorrect answer
- CForcing a source to disclose data under duress
- DExchanging money for intelligence
Why this is the answer
Elicitation uses conversational techniques to obtain information while the source is unaware of the intelligence requirement.
- Question 26Multiple Select
Which two factors are critical when evaluating the reliability of a threat intelligence source?
- ATimeliness and freshness
- BTrack record of accuracyCorrect answer
- CCost of subscription
- DHistorical precisionCorrect answer
Why this is the answer
Reliability is assessed by the source's historical accuracy and precision in providing correct indicators.
Threat Intelligence Concepts and Principles
8 questions in this domain
- Question 27Single Choice
What is the foundation of threat intelligence, according to the CREST CPTIA framework?
- AA collection of raw Indicators of Compromise (IoCs)
- BEvidence-based knowledge including context, mechanisms, indicators, implications, and actionable adviceCorrect answer
- CA list of threat actor names and their motivations
- DReal-time data feeds from commercial vendors
Why this is the answer
Threat intelligence is defined as evidence-based knowledge, including context, mechanisms, indicators, implications, and actionable advice about an existing or emerging menace or hazard to assets. Raw IoCs alone are data, not intelligence.
- Question 28Multiple Select
Which of the following are phases in the intelligence lifecycle as described in the CREST CPTIA framework? (Select all that apply.)
- ADirectionCorrect answer
- BCollectionCorrect answer
- CProcessingCorrect answer
- DAutomation
Why this is the answer
The intelligence lifecycle consists of Direction, Collection, Processing, Analysis, Dissemination, and Feedback. Automation is a tool, not a lifecycle phase.
- Question 29Interactive
Review the following intelligence report snippet. What type of intelligence does it represent?
- AStrategic Intelligence
- BOperational Intelligence
- CTactical Intelligence
- DTechnical IntelligenceCorrect answer
Why this is the answer
The report shows a list of specific IP addresses and file hashes (IoCs). This is technical intelligence, which is the most granular level focused on indicators of compromise.
- Question 30Single Choice
Which phase of the intelligence lifecycle involves defining Priority Intelligence Requirements (PIRs)?
- ACollection
- BDirectionCorrect answer
- CAnalysis
- DDissemination
Why this is the answer
The Direction phase is where requirements are gathered and priority intelligence requirements (PIRs) are defined. This sets the 'why' for the entire intelligence cycle.
- Question 31Multiple Select
Which of the following are characteristics of strategic intelligence? (Select all that apply.)
- AFocused on long-term threats and geopolitical trendsCorrect answer
- BContains detailed Indicators of Compromise (IoCs)
- CIntended for senior decision-makers such as the CISO or boardCorrect answer
- DProvides information about specific adversary TTPs
Why this is the answer
Strategic intelligence is high-level, long-term, and consumed by executives. It does not include detailed IoCs or TTPs; those are tactical/technical.
- Question 32Interactive
Look at the following process description. Which phase of the intelligence lifecycle is being executed?
- ACollection
- BProcessingCorrect answer
- CAnalysis
- DDissemination
Why this is the answer
Normalizing, deduplicating, and converting data into a structured format (e.g., CSV to STIX) is the Processing phase of the intelligence lifecycle.
- Question 33Single Choice
Which type of intelligence is most useful for creating automated firewall block rules in real time?
- AStrategic Intelligence
- BOperational Intelligence
- CTactical Intelligence
- DTechnical IntelligenceCorrect answer
Why this is the answer
Technical intelligence consists of granular indicators (IPs, hashes, domains) that can be directly used in automated blocking rules. It has a short shelf life.
- Question 34Multiple Select
Which of the following are key considerations when collecting threat intelligence? (Select all that apply.)
- ASource reliability (e.g., Admiralty System)Correct answer
- BAlignment with defined intelligence requirementsCorrect answer
- CAutomated collection without human oversight
- DLegal and ethical boundariesCorrect answer
Why this is the answer
Collection must be guided by requirements, use validated sources, and comply with legal/ethical standards. Automated collection alone (without direction) is insufficient and can lead to wasted resources or legal issues.
Threat Intelligence Dissemination and Integration
6 questions in this domain
- Question 35Single Choice
Which audience requires a report focused on business impact and financial risk?
- AExecutivesCorrect answer
- BSOC analysts
- CTechnical teams
- DThreat hunters
Why this is the answer
Executives need strategic, business-focused intelligence to make budget and risk decisions.
- Question 36Multiple Select
Which two elements are typically included in a technical team report but not in an executive summary?
- AMITRE ATT&CK techniquesCorrect answer
- BBusiness impact analysis
- CRaw indicators of compromiseCorrect answer
- DBudget recommendations
Why this is the answer
Technical teams need detailed TTPs and IOCs; executives need high-level impact and resource recommendations.
- Question 37Interactive
Refer to the code block. What does this TLP marking indicate?
- ALimited to named recipientsCorrect answer
- BOrganization-wide circulation
- CCommunity-wide sharing
- DPublic disclosure allowed
Why this is the answer
TLP:RED means intelligence is disclosed only to specific named individuals and cannot be shared further.
- Question 38Single Choice
Which STIX domain object would you use to represent a known malicious IP address?
- AIndicatorCorrect answer
- BCampaign
- CThreat Actor
- DMalware
Why this is the answer
An Indicator SDO is used for observable patterns like IPs, hashes, or domains that suggest malicious activity.
- Question 39Multiple Select
Which two protocols or platforms are primarily used to transport and share threat intelligence?
- ATAXIICorrect answer
- BMISPCorrect answer
- CSTIX
- DISO 27001
Why this is the answer
TAXII is a transport protocol; MISP is a collaborative platform with sharing capabilities. STIX is a data model, not transport.
- Question 40Interactive
Refer to the code block. What is the value of the 'type' property in this STIX object?
- AindicatorCorrect answer
- Bcampaign
- Cintrusion-set
- Dmalware
Why this is the answer
The STIX object shown has 'type': 'indicator', which is used to represent observable patterns like IPs or hashes.
Frequently asked questions
Everything about the Practitioner Threat Intelligence Analyst question bank and how to use it.