Question bank
Registered Threat Intelligence Analyst
42 Registered Threat Intelligence Analyst questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Analysis and Processing
10 questions in this domain
- Question 1Single Choice
What is the primary purpose of the Analysis of Competing Hypotheses (ACH) technique in threat intelligence?
- ATo evaluate multiple hypotheses against available evidenceCorrect answer
- BTo challenge a single prevailing hypothesis without evidence
- CTo brainstorm as many ideas as possible in a short time
- DTo map intrusion events into a visual framework
Why this is the answer
ACH is a structured analytic technique that lists all plausible hypotheses and systematically evaluates evidence for and against each, with the goal of refuting hypotheses rather than confirming them. It is designed to reduce cognitive biases.
- Question 2Multiple Select
Which of the following are the four core vertices of the Diamond Model of Intrusion Analysis? (Select all that apply)
- AAdversaryCorrect answer
- BCapabilityCorrect answer
- CInfrastructureCorrect answer
- DVictimCorrect answer
Why this is the answer
The Diamond Model has exactly four vertices: Adversary, Capability, Infrastructure, and Victim. Meta-features like social-political-economic context are additional, not vertices.
- Question 3Interactive
In the Diamond Model, to which vertex does the IP address in the code block most likely belong?
- AAdversary
- BCapability
- CInfrastructureCorrect answer
- DVictim
Why this is the answer
Infrastructure includes network resources such as IP addresses, domains, and servers that the adversary uses to conduct operations. The IP is a network indicator, thus Infrastructure.
- Question 4Single Choice
Which structured analytic technique involves an individual deliberately arguing against a prevailing hypothesis to test its robustness?
- ADevil's AdvocacyCorrect answer
- BRed Teaming
- CBrainstorming
- DPremortem
Why this is the answer
Devil's Advocacy is a structured technique where an individual (within the team) argues against the prevailing hypothesis. Red Teaming involves an external group simulating an adversary.
- Question 5Multiple Select
Which of the following are examples of structured analytic techniques used in threat intelligence? (Select all that apply)
- AAnalysis of Competing Hypotheses (ACH)Correct answer
- BChecklist AnalysisCorrect answer
- CBrainstormingCorrect answer
- DIntuitive Judgment
Why this is the answer
SATs include ACH, Devil's Advocacy, Brainstorming, and Checklist Analysis. Intuitive judgment is unstructured and prone to bias.
- Question 6Interactive
According to the Diamond Model, what is the role of the 'Capability' vertex as shown in the code block?
- AThe tool or technique used by the adversaryCorrect answer
- BThe network infrastructure used for C2
- CThe entity being attacked
- DThe individual behind the attack
Why this is the answer
Capability refers to the tools, malware, or techniques (TTPs) that the adversary employs. A malware hash is a specific indicator of a capability.
- Question 7Single Choice
What is the primary benefit of using structured analytic techniques over unstructured intuition?
- AThey mitigate cognitive biases and improve accuracyCorrect answer
- BThey allow faster decision making with less data
- CThey eliminate the need for evidence collection
- DThey guarantee correct attribution every time
Why this is the answer
Structured analytic techniques (SATs) are designed to mitigate cognitive biases such as confirmation bias and anchoring, leading to more reliable and defensible judgments.
- Question 8Multiple Select
Which of the following are common cognitive biases that structured analytic techniques aim to overcome? (Select all that apply)
- AConfirmation biasCorrect answer
- BAnchoring biasCorrect answer
- CAvailability biasCorrect answer
- DOptimism bias
Why this is the answer
Confirmation, anchoring, and availability biases are well-known cognitive biases that SATs help mitigate. Optimism bias is not typically addressed by structured techniques.
- Question 9Interactive
Using the Diamond Model, to which vertex would a domain name used for command and control belong?
- AAdversary
- BCapability
- CInfrastructureCorrect answer
- DVictim
Why this is the answer
Domain names, IP addresses, and servers used for C2 are classified as Infrastructure in the Diamond Model.
- Question 10Single Choice
In the context of IOC correlation, what is the meaning of 'pivot analysis'?
- AUsing a known indicator to discover related indicators or adversariesCorrect answer
- BComparing two unrelated attacks to find differences
- CCreating a new hypothesis without evidence
- DRemoving duplicate indicators from a dataset
Why this is the answer
Pivot analysis leverages a known IOC (e.g., an IP) to find additional related IOCs or adversary infrastructure by querying internal and external sources.
Dissemination and Reporting
8 questions in this domain
- Question 11Single Choice
What is the primary purpose of an executive summary in a threat intelligence report?
- ATo provide raw technical indicators for analysts
- BTo deliver a concise overview of key threats and business impactCorrect answer
- CTo list all sources used in the analysis
- DTo describe the methodology in detail
Why this is the answer
The executive summary is a brief, jargon-free section that highlights critical threats and business consequences for non-technical leaders.
- Question 12Multiple Select
Which two elements are essential for a non-technical audience in a threat briefing?
- AList of specific IP addresses
- BBusiness risk and financial impactCorrect answer
- CStrategic recommendationsCorrect answer
- DYARA rules for detection
Why this is the answer
Executives need risk context and action items, not technical details like IPs or YARA rules.
- Question 13Interactive
Based on the code block below, what does the TLP label indicate?
- AOnly named recipients can view it
- BCan be shared within the organization on need-to-knowCorrect answer
- CMay be shared publicly
- DMust be destroyed after 24 hours
Why this is the answer
TLP:AMBER restricts sharing to the organization's internal team with a legitimate need.
- Question 14Single Choice
What is the correct TLP marking for intelligence that can be shared with industry partners but not the public?
- ATLP:RED
- BTLP:AMBER
- CTLP:GREENCorrect answer
- DTLP:CLEAR
Why this is the answer
TLP:GREEN allows sharing within the community (e.g., ISAC members) but not public distribution.
- Question 15Multiple Select
Which two items should be included in a technical intelligence report for SOC analysts?
- AMITRE ATT&CK technique IDsCorrect answer
- BYARA rules and hashesCorrect answer
- CEstimated financial loss
- DExecutive summary only
Why this is the answer
Technical audiences need actionable indicators like TTPs and detection rules, not business impact numbers.
- Question 16Interactive
What is the meaning of the code word 'NOFORN' in the classification label?
- ANot to be shared with foreign nationalsCorrect answer
- BNo foreign travel allowed
- CNot for public release
- DNo further distribution
Why this is the answer
NOFORN indicates the intelligence cannot be shared with non-citizens or foreign entities.
- Question 17Single Choice
What does an ISAC primarily facilitate?
- AAutomated incident response
- BSector-specific threat intelligence sharingCorrect answer
- CPublic vulnerability disclosure
- DPenetration testing services
Why this is the answer
ISACs are industry-specific communities for sharing threat data among members.
- Question 18Multiple Select
Which two actions are required before sharing intelligence with an ISAC?
- ASanitize PII and victim detailsCorrect answer
- BApply appropriate TLP markingCorrect answer
- CTranslate report into multiple languages
- DRemove all technical indicators
Why this is the answer
Analysts must clean sensitive data and mark the intelligence with the correct TLP level.
Intelligence Collection and Sources
12 questions in this domain
- Question 19Single Choice
What does the acronym OSINT stand for in threat intelligence?
- AOpen Source IntelligenceCorrect answer
- BOperational Security Intelligence
- COnline System Intelligence
- DOpen System Intelligence
Why this is the answer
OSINT stands for Open Source Intelligence, which is intelligence derived from publicly available information. The other options are incorrect and do not represent the accepted definition.
- Question 20Multiple Select
Which of the following are considered OSINT sources? (Select all that apply)
- APublic social media postsCorrect answer
- BCompany internal HR databases
- CGovernment tax records (publicly accessible)Correct answer
- DClassified military reports
Why this is the answer
OSINT includes publicly available information. Social media and public government records are OSINT. Internal databases and classified material are not publicly available.
- Question 21Interactive
Analyze the following search operator and determine its purpose in OSINT collection.
- AIt restricts results to a specific domainCorrect answer
- BIt searches for files of a specific type
- CIt shows only exact phrase matches
- DIt excludes certain keywords from results
Why this is the answer
The operator 'site:' restricts search results to a particular domain (e.g., site:example.com). This is a fundamental OSINT technique to narrow down public information from a specific website.
- Question 22Single Choice
In the TRAAP framework for evaluating OSINT sources, what does the 'R' stand for?
- ARelevanceCorrect answer
- BReliability
- CRecency
- DRigour
Why this is the answer
TRAAP stands for Timeliness, Relevance, Authority, Accuracy, and Purpose. The 'R' is Relevance – whether the information directly addresses the intelligence requirement.
- Question 23Multiple Select
Which of the following are correct descriptions of the Admiralty Code for source reliability? (Select all that apply)
- AAn A-rated source is considered highly reliableCorrect answer
- BAn F-rated source is completely unreliableCorrect answer
- CThe code applies only to technical intelligence sources
- DThe code has six letters (A-F) for source reliabilityCorrect answer
Why this is the answer
The Admiralty Code rates source reliability from A (most reliable) to F (least reliable). It applies to all intelligence sources, not just technical. Options 1,2,4 are correct.
- Question 24Interactive
Review the following Python code snippet used for passive OSINT collection. What is its primary function?
- AIt downloads files from a remote server
- BIt queries a website's robots.txt fileCorrect answer
- CIt performs a port scan on a target
- DIt extracts email addresses from a webpage
Why this is the answer
The code uses the requests library to retrieve the robots.txt file from a given domain. This is a passive OSINT technique to understand what parts of a site are disallowed for crawling.
- Question 25Single Choice
Which of the following is a passive OSINT technique?
- APerforming an active port scan on a target IP
- BQuerying passive DNS databases for historical recordsCorrect answer
- CSending a phishing email to gather credentials
- DDeploying a honeypot to capture attacker activity
Why this is the answer
Passive OSINT involves no direct interaction with the target. Querying historical DNS records is passive, whereas port scanning and honeypots are active techniques that may alert the adversary.
- Question 26Multiple Select
Which of the following are common pitfalls when evaluating OSINT sources? (Select all that apply)
- AAssuming popularity equals credibilityCorrect answer
- BCross-checking data with independent sources
- COver-relying on automated tools without manual reviewCorrect answer
- DTreating all dark web content as authenticCorrect answer
Why this is the answer
Common traps include confusing popularity with credibility, over-reliance on automation, and assuming dark web data is genuine. Cross-checking is good practice, not a pitfall.
- Question 27Interactive
Examine the SQL query below. What intelligence discipline does this technique belong to?
- AHuman Intelligence (HUMINT)
- BTechnical Intelligence (TECHINT)Correct answer
- COpen-Source Intelligence (OSINT)
- DSignals Intelligence (SIGINT)
Why this is the answer
Querying a database using SQL is a technical data collection method. TECHINT encompasses passive and active technical means such as database queries, network scans, and malware analysis.
- Question 28Single Choice
What is the primary ethical limitation when collecting HUMINT?
- AYou must never pay for information
- BYou must avoid any form of deception
- CYou must not violate local laws regarding privacy and consentCorrect answer
- DYou must always reveal your identity as an intelligence collector
Why this is the answer
HUMINT collection must comply with privacy laws (e.g., GDPR, RIPA) and organisational consent. While deception and payments may be permissible in limited contexts with legal advice, the overarching constraint is legality.
- Question 29Multiple Select
Select the techniques that are part of Human Intelligence (HUMINT) gathering. (Select all that apply)
- ADebriefing a former employee about company security incidentsCorrect answer
- BEliciting information at a conference through casual conversationCorrect answer
- CAnalyzing network packet captures from an firewall
- DReviewing a whistleblower's leaked documents
Why this is the answer
HUMINT involves direct interaction with human sources. Debriefing and elicitation are HUMINT, while packet analysis is TECHINT and leaked documents are OSINT (if publicly available).
- Question 30Interactive
The following shell command is used for technical intelligence collection. What does it do?
- AIt performs a passive DNS lookup
- BIt initiates an active port scan against a targetCorrect answer
- CIt downloads a file from a remote FTP server
- DIt queries a WHOIS database
Why this is the answer
The command 'nmap -sS 10.0.0.1' runs a SYN scan (stealth scan) against a single IP. This is an active TECHINT technique that sends packets to the target.
Operational Intelligence and Incident Response
5 questions in this domain
- Question 31Single Choice
What does the integration of threat intelligence into incident response primarily transform?
- ARaw indicators into actionable triggersCorrect answer
- BAlerts into manual ticketing
- CSOCs into standalone teams
- DIntelligence into static reports
Why this is the answer
Integration transforms raw contextualised intelligence into actionable triggers, enrichments, and feedback loops for detection and response.
- Question 32Multiple Select
Which two components are essential for integrating intelligence into SOC operations?
- ASeamless interoperability between TIPs and SIEMsCorrect answer
- BManual analyst review for every alert
- CAutomated indicator enrichment via APIsCorrect answer
- DIsolated intelligence consumption without feedback
Why this is the answer
Integration demands seamless interoperability between TIPs, SIEMs, SOARs, and automated enrichment via APIs to transform intelligence into actions.
- Question 33Interactive
Based on the code block, which protocol is used to transport structured threat intelligence?
- ASTIX
- BTAXIICorrect answer
- COAuth
- DMISP
Why this is the answer
TAXII is the Trusted Automated Exchange of Intelligence Information protocol used to transport STIX data over HTTPS.
- Question 34Single Choice
What is the primary purpose of the intelligence feedback loop in incident response?
- ATo enable incident findings to enrich the intelligence baseCorrect answer
- BTo replace human analysts with automation
- CTo block all external connectivity during incidents
- DTo generate compliance reports for regulators
Why this is the answer
The feedback loop allows IR teams to feed new IOCs back into the TIP, closing the cycle and improving future detection.
- Question 35Multiple Select
Which two models are integrated into IR workflows for mapping incident phases?
- AKill ChainCorrect answer
- BDiamond ModelCorrect answer
- CPyramid of Pain
- DMITRE ATT&CK
Why this is the answer
The Kill Chain and Diamond Model are integrated to map each incident to a phase or vertex, directing response actions.
Threat Intelligence Concepts and Principles
7 questions in this domain
- Question 36Single Choice
Which level of threat intelligence is primarily consumed by executive leadership such as the CISO or board of directors and focuses on long-term risk management?
- ATactical Intelligence
- BOperational Intelligence
- CStrategic IntelligenceCorrect answer
- DTechnical Intelligence
Why this is the answer
Strategic intelligence is designed for executive leadership (CISO, board) and informs long-term risk management, resource allocation, and business strategy. It focuses on trends, geopolitical forces, and industry-level threats.
- Question 37Multiple Select
Which two of the following are characteristics of tactical intelligence? (Select two.)
- AIt consists of specific indicators of compromise such as IP addresses and file hashes.Correct answer
- BIt is consumed by frontline SOC analysts for immediate detection and blocking.Correct answer
- CIt informs long-term investment strategies and geopolitical risks.
- DIt covers campaign-level TTPs and adversary behaviour patterns.
Why this is the answer
Tactical intelligence provides immediate, technical IoCs (IPs, hashes) used by frontline analysts for real-time detection and blocking. It has a short shelf life and supports immediate defensive actions.
- Question 38Interactive
The intelligence analyst has been tasked with producing a threat report. At what step in the intelligence cycle should the analyst first define the Priority Intelligence Requirements (PIRs)?
- ACollection
- BDirectionCorrect answer
- CAnalysis
- DDissemination
Why this is the answer
Direction is the first phase of the intelligence cycle where PIRs are defined based on consumer needs. This sets the scope for all subsequent collection and analysis activities.
- Question 39Single Choice
What is the key difference between information and intelligence in the context of threat intelligence?
- AInformation is collected automatically, while intelligence is always produced by humans.
- BIntelligence is the product of analysis that answers 'so what?' and is tailored to a consumer's decision.Correct answer
- CInformation contains more context than intelligence.
- DIntelligence is raw data that has been collated without interpretation.
Why this is the answer
Intelligence results from rigorous analysis that provides context, evaluation, and actionable recommendations. It answers 'so what?' and is specifically tailored to a consumer's decision-making needs. Information is structured data that answers 'what happened?' but lacks analytical depth.
- Question 40Multiple Select
Which three of the following are valid phases of the intelligence cycle? (Select three.)
- ADirectionCorrect answer
- BCollectionCorrect answer
- CExploitation
- DDisseminationCorrect answer
Why this is the answer
The intelligence cycle consists of Direction, Collection, Processing, Analysis, Dissemination, and Feedback. Exploitation is not a standard phase of the intelligence cycle; it belongs to other domains like vulnerability management.
- Question 41Interactive
A raw server log entry shows: 'Source IP 10.0.0.5 accessed URL /shell.aspx at 02:00 UTC'. According to the data-information-intelligence hierarchy, what best describes this entry?
- ADataCorrect answer
- BInformation
- CIntelligence
- DKnowledge
Why this is the answer
A raw log entry is unprocessed data. It lacks context, correlation, or analysis; it cannot answer any meaningful question on its own. Only after enrichment and analysis does it become information or intelligence.
- Question 42Single Choice
Which consumer type typically receives intelligence products in the form of real-time indicator feeds and YARA rules?
- AChief Information Security Officer (CISO)
- BSOC Manager
- CFrontline SOC AnalystCorrect answer
- DExternal Auditor
Why this is the answer
Tactical intelligence is consumed by frontline analysts (Tier 1 SOC, detection engineers) who need immediate, actionable indicators to block threats, tune detection rules, and respond in real time.
Frequently asked questions
Everything about the Registered Threat Intelligence Analyst question bank and how to use it.