EC-Council Intermediate

312-85

CTIA - Certified Threat Intelligence Analyst

The Certified Threat Intelligence Analyst (CTIA) validates expertise in cyber threat intelligence, empowering professionals to identify, analyze, and mitigate advanced persistent threats. This certification covers the entire threat intelligence lifecycle from planning and collection through analysis, production, and dissemination. CTIA prepares professionals to transform raw data into actionable intelligence that enables proactive defense.

The exam covers five domains: Introduction to Threat Intelligence (threat intelligence types, strategic/tactical/operational intelligence, intelligence requirements), Cyber Threats and Attack Frameworks (cyber kill chain, MITRE ATT&CK, Diamond Model, threat actor profiling), Data Collection and Processing (OSINT, dark web intelligence, IOC collection, threat feeds), Data Analysis and Dissemination (analysis methodologies, intelligence reports, visualization techniques), and Threat Intelligence in Practice (threat hunting, defensive countermeasures, TTP mapping, intelligence sharing).

This certification is ideal for threat intelligence analysts, security analysts, SOC analysts, incident responders, cyber threat researchers, and cybersecurity professionals seeking to enhance their threat intelligence capabilities. CTIA provides practical skills in leveraging threat intelligence platforms, analyzing adversary behavior, and producing actionable intelligence reports that inform security strategy and operations.

Updated Apr 2023 Cybersecurity

Questions

Practice Tests

70%

Pass Score

Views

Total Attempts

Avg. Score

Pass Rate

Discussions

Practice Tests Flash Cards Exam Topics Cheat Sheet

€5.00

CTIA Practice Exam 1

Comprehensive 50-question practice exam covering introduction to threat intelligence, cyber threats and attack frameworks, data collection and processing, data analysis and dissemination, and threat intelligence in practice for the EC-Council Certified Threat Intelligence Analyst certification.

50 Q 90 minutes 70%

Test Drive

€5.00

CTIA Practice Exam 2

Comprehensive 50-question practice exam covering threat intelligence fundamentals, cyber threats and attack frameworks, data collection and processing, data analysis and dissemination, and threat intelligence in practice for the EC-Council Certified Threat Intelligence Analyst certification.

50 Q 90 minutes 70%

Test Drive

€5.00

CTIA Practice Exam 3

50 Q 90 minutes 70%

Test Drive

€5.00

CTIA Practice Exam 4

50 Q 90 minutes 70%

Test Drive

€5.00

CTIA Practice Exam 5

50 Q 90 minutes 70%

Test Drive

€5.00

CTIA Practice Exam 6

50 Q 90 minutes 70%

Test Drive

Unlock All Content for 312-85

6 Practice Test(s) + Flash Cards — 3 months access

€39.99 €26.99 Save 30%

or included with Monthly subscription / Content Bundle

312-85 Cheat Sheet

Quick reference guide - 6 sections

Free Access

CTIA 312-85 Exam Details

Detail	Value
Exam Code	312-85 CTIA
Full Name	Certified Threat Intelligence Analyst
Duration	120 minutes (2 hours)
Number of Questions	50 multiple-choice questions
Passing Score	70%
Exam Vendor	EC-Council
Delivery	ECC Exam Portal / VUE

Domain Weight Breakdown

Domain	Weight
1. Introduction to Threat Intelligence	14%
2. Cyber Threats and Kill Chain Methodology	14%
3. Requirements, Planning, Direction, and Review	13%
4. Data Collection and Processing	24%
5. Data Analysis	19%
6. Intelligence Reporting and Dissemination	16%

About the CTIA Certification

The Certified Threat Intelligence Analyst (CTIA) certification from EC-Council validates a candidate's ability to collect, analyze, and disseminate cyber threat intelligence. It is designed for SOC analysts, threat intelligence analysts, security consultants, incident responders, and security operations professionals who need structured threat intelligence skills. The CTIA covers the complete threat intelligence lifecycle from planning and data collection through analysis, reporting, and dissemination. It emphasizes the use of structured analytical techniques, industry frameworks (MITRE ATT&CK, Cyber Kill Chain, Diamond Model), and standardized sharing protocols (STIX/TAXII). No specific prerequisite is required, but EC-Council recommends 2+ years of experience in information security.

Tip: The exam heavily focuses on the intelligence lifecycle, data collection techniques, and structured analysis methods. Make sure you understand the differences between strategic, tactical, operational, and technical intelligence.

Intelligence Lifecycle

The threat intelligence lifecycle is a continuous process of transforming raw data into actionable intelligence. Each phase feeds into the next, and feedback loops drive continuous improvement.

Phase	Description	Key Activities
1. Planning & Direction	Define intelligence requirements and priorities	Identify stakeholders, define PIRs (Priority Intelligence Requirements), set scope and objectives
2. Collection	Gather raw data from diverse sources	OSINT, HUMINT, SIGINT, technical feeds, dark web monitoring, honeypots
3. Processing	Convert raw data into usable format	Normalization, deduplication, correlation, enrichment, translation, decryption
4. Analysis	Evaluate processed data to produce intelligence	Structured analysis, hypothesis testing, pattern identification, attribution assessment
5. Dissemination	Distribute intelligence to stakeholders	Reports, advisories, automated feeds (STIX/TAXII), briefings, dashboards
6. Feedback	Evaluate effectiveness and refine process	Stakeholder reviews, gap analysis, requirement updates, process improvement

Types of Threat Intelligence

Type	Audience	Focus	Examples
Strategic	C-suite, board, executives	High-level trends, risk posture, geopolitical context	Threat landscape reports, industry risk assessments, geopolitical analysis
Tactical	SOC analysts, defenders	TTPs (Tactics, Techniques, Procedures) of threat actors	MITRE ATT&CK mappings, attack patterns, malware behavior profiles
Operational	Incident responders, threat hunters	Specific impending attacks, campaigns, threat actor intent	Campaign tracking, actor profiles, attack planning intelligence
Technical	SOC engineers, SIEM operators	Machine-readable indicators for detection	IP addresses, domains, file hashes, YARA rules, Snort signatures

Tip: Strategic intelligence is non-technical and consumed by decision-makers. Technical intelligence is the most perishable (IoCs change rapidly). Tactical intelligence about TTPs has the longest shelf life because adversary behaviors evolve slowly.

Threat Actor Categories

Actor Type	Motivation	Sophistication	Examples
Nation-State / APT	Espionage, sabotage, geopolitical advantage	Very High	APT28 (Fancy Bear), APT29 (Cozy Bear), Lazarus Group, APT41
Cybercriminals	Financial gain	Medium to High	Ransomware gangs (LockBit, ALPHV), banking trojans, carding groups
Hacktivists	Ideological, political, social causes	Low to Medium	Anonymous, LulzSec, hacktivist DDoS campaigns
Insider Threats	Revenge, financial, accidental	Variable	Disgruntled employees, negligent users, compromised credentials
Script Kiddies	Curiosity, bragging rights	Low	Use pre-built tools and exploits without deep understanding
State-Sponsored Proxies	Deniable operations for nation-states	High	Contracted hacker groups, front companies for state operations

MITRE ATT&CK Framework

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a common language for describing adversary behavior.

Tactic (Enterprise)	ID	Goal
Reconnaissance	TA0043	Gather information to plan future operations
Resource Development	TA0042	Establish resources to support operations (infrastructure, accounts, tools)
Initial Access	TA0001	Gain initial foothold in the target network
Execution	TA0002	Run adversary-controlled code on target systems
Persistence	TA0003	Maintain foothold across restarts and credential changes
Privilege Escalation	TA0004	Gain higher-level permissions
Defense Evasion	TA0005	Avoid detection by security controls
Credential Access	TA0006	Steal account credentials
Discovery	TA0007	Map the target environment
Lateral Movement	TA0008	Move through the network to reach objectives
Collection	TA0009	Gather data of interest to the adversary
Command & Control	TA0011	Communicate with compromised systems
Exfiltration	TA0010	Steal data from the target environment
Impact	TA0040	Disrupt availability or compromise integrity

Tip: ATT&CK organizes adversary behavior into Tactics (the "why"), Techniques (the "how"), and Sub-techniques (specific implementation). Each technique has detection and mitigation guidance. Matrices exist for Enterprise, Mobile, and ICS.

Lockheed Martin Cyber Kill Chain

The Cyber Kill Chain is a linear model describing the stages of a cyber intrusion. Defenders can break the chain at any stage to prevent a successful attack.

Phase	Description	Defender Actions
1. Reconnaissance	Research and identify targets (email harvesting, OSINT, network scanning)	Detect scanning, limit public exposure, monitor social media
2. Weaponization	Create exploit payload (malware + exploit coupled into deliverable)	Malware analysis, YARA rules, threat intelligence sharing
3. Delivery	Transmit weapon to target (phishing email, USB, watering hole)	Email filtering, web proxy, user awareness training
4. Exploitation	Trigger exploit code on victim system	Patching, DEP, ASLR, endpoint protection, application whitelisting
5. Installation	Install malware/backdoor for persistence	EDR, HIPS, file integrity monitoring, process monitoring
6. Command & Control (C2)	Establish communication channel back to attacker	Network segmentation, DNS sinkholing, firewall egress rules, proxy inspection
7. Actions on Objectives	Execute intended goal (exfiltration, destruction, lateral movement)	DLP, data encryption, network monitoring, incident response

Diamond Model of Intrusion Analysis

The Diamond Model describes an intrusion event as a relationship between four core vertices. Every intrusion event involves an adversary deploying a capability over infrastructure against a victim.

Vertex	Description	Examples
Adversary	The threat actor or group conducting the intrusion	APT28, Lazarus Group, FIN7, unknown actor
Capability	The tools, techniques, and exploits used by the adversary	Cobalt Strike, zero-day exploit, phishing kit, custom RAT
Infrastructure	The physical or logical communication pathways used	C2 servers, domains, IP addresses, email accounts, compromised sites
Victim	The target of the intrusion (person, organization, asset)	Target organization, specific host, email account, network segment

Meta-features: The Diamond Model also includes meta-features such as timestamp, phase, result, direction, methodology, and resources. Events can be threaded into activity threads and grouped into activity groups for campaign tracking.

Tip: The Diamond Model is used to pivot analysis. If you know the infrastructure (C2 IP), you can pivot to identify the adversary, their other capabilities, and additional victims connected to the same infrastructure.

Intelligence Collection Disciplines

Discipline	Full Name	Description	Cyber Examples
OSINT	Open Source Intelligence	Publicly available information from open sources	Shodan, VirusTotal, social media, news, paste sites, WHOIS, DNS records
HUMINT	Human Intelligence	Information gathered from human sources	Informants in underground forums, social engineering, insider sources
SIGINT	Signals Intelligence	Intercepted electronic signals and communications	Network traffic analysis, intercepted communications, packet captures
TECHINT	Technical Intelligence	Analysis of technical equipment and capabilities	Malware samples, exploit code analysis, reverse engineering
GEOINT	Geospatial Intelligence	Imagery and geospatial data analysis	Geolocating threat actors, mapping physical infrastructure
CYBINT	Cyber Intelligence	Intelligence derived from cyberspace operations	Honeypot data, IDS/IPS logs, SIEM alerts, dark web scraping

Threat Feeds & Data Sources

Commercial Threat Feeds: Recorded Future, Mandiant, CrowdStrike, Flashpoint, Intel 471 - curated, enriched indicators with context
Open-Source Feeds: AlienVault OTX, Abuse.ch, PhishTank, URLhaus, MalwareBazaar - free community-driven indicator sharing
Government / CERT Feeds: US-CERT, CISA alerts, ENISA, national CERTs - official advisories and bulletins
Dark Web Monitoring: Tor forums, underground marketplaces, paste sites, encrypted chat channels - early warning of breaches, leaked credentials, sale of exploits
Internal Telemetry: SIEM logs, IDS/IPS alerts, EDR data, firewall logs, email gateway logs - organization-specific indicators
Social Media / OSINT: Twitter/X, Telegram, Reddit, security researcher blogs, GitHub repositories - real-time threat discussions
Vulnerability Databases: NVD (National Vulnerability Database), CVE, Exploit-DB - vulnerability and exploit tracking

Indicator Types: IoC vs IoA

Aspect	IoC (Indicator of Compromise)	IoA (Indicator of Attack)
Definition	Evidence that a compromise has occurred	Evidence that an attack is in progress or being attempted
Timing	Reactive (after the fact)	Proactive (during the attack)
Examples	Malicious IP, file hash, domain, registry key, mutex	Unusual login patterns, lateral movement, privilege escalation attempts
Shelf Life	Short (attackers change infrastructure quickly)	Longer (behavioral patterns persist across campaigns)
Focus	Artifacts and atomic indicators	Adversary behaviors and techniques (TTPs)

Tip: IoCs are like forensic evidence at a crime scene. IoAs are like watching suspicious behavior in real-time. Mature threat intelligence programs use both, but IoA-based detection aligned with MITRE ATT&CK is more resilient to evasion.

STIX & TAXII Standards

STIX (Structured Threat Information eXpression) is a standardized language and serialization format for representing cyber threat intelligence. TAXII (Trusted Automated eXchange of Indicator Information) defines how CTI is shared over HTTPS.

STIX Domain Object (SDO)	Description
Attack Pattern	A type of TTP describing methods adversaries use (maps to ATT&CK techniques)
Campaign	A grouping of adversarial activity over a period of time against targets
Course of Action	A recommended action to mitigate or respond to a threat
Identity	Individuals, organizations, or groups (victims or adversaries)
Indicator	A pattern used to detect suspicious or malicious activity (IoC patterns)
Intrusion Set	A grouped set of adversarial behaviors and resources (threat actor campaigns)
Malware	A type of TTP representing malicious software
Observed Data	Raw observed information (network traffic, file artifacts)
Report	Collections of threat intelligence focused on a topic
Threat Actor	Individuals or groups operating with malicious intent
Tool	Legitimate software that may be used by adversaries (e.g., PsExec, Mimikatz)
Vulnerability	A weakness that can be exploited (linked to CVE)

TAXII Feature	Description
Channel	Producer pushes data to consumers (publish-subscribe model)
Collection	Consumer requests data from server (request-response model)
API Root	Entry point URL for TAXII services hosted by a provider
Transport	HTTPS with JSON content type (STIX 2.x uses JSON serialization)

Data Collection Tools

Tool	Purpose	Category
Maltego	OSINT link analysis and visualization (entities, relationships)	OSINT
Shodan	Internet-connected device search engine	OSINT
MISP	Open-source threat intelligence platform for sharing, storing, and correlating IoCs	TIP
OpenCTI	Open-source CTI platform with STIX2 native support	TIP
TheHive	Incident response platform integrated with MISP and Cortex	IR Platform
SpiderFoot	Automated OSINT reconnaissance framework	OSINT
VirusTotal	Multi-engine file/URL scanning and threat intelligence	Analysis
Censys	Internet-wide scanning and device/certificate discovery	OSINT

Structured Analytic Techniques (SATs)

Structured Analytic Techniques reduce cognitive biases and improve the rigor of intelligence analysis. They are systematic methods that externalize and organize thinking.

Technique	Description	When to Use
Analysis of Competing Hypotheses (ACH)	List all possible hypotheses, identify evidence for/against each, systematically eliminate least consistent hypotheses	Attribution, assessing multiple possible explanations
SWOT Analysis	Evaluate Strengths, Weaknesses, Opportunities, Threats	Strategic threat assessments, organizational risk posture
Red Team Analysis	Think like the adversary to anticipate tactics and targets	Predicting adversary next moves, testing defenses
Devil's Advocacy	Deliberately challenge the prevailing assessment	Preventing groupthink, testing assumptions
Key Assumptions Check	Identify and evaluate underlying assumptions in analysis	Before major assessments, when new evidence emerges
Brainstorming	Generate ideas without judgment to explore possibilities	Early-stage analysis, identifying collection requirements

Tip: ACH is the most commonly tested structured analytic technique on the CTIA exam. Remember the process: list hypotheses, list evidence, create a matrix, assess consistency, and refine. The hypothesis with the least inconsistent evidence is most likely correct.

Threat Modeling Frameworks

Framework	Focus	Key Elements
STRIDE	Threat categorization by type	Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
PASTA	Risk-centric, 7-stage process	Define objectives, Define technical scope, App decomposition, Threat analysis, Vulnerability analysis, Attack modeling, Risk & impact analysis
DREAD	Threat scoring / risk rating	Damage potential, Reproducibility, Exploitability, Affected users, Discoverability (each scored 1-10)
VAST	Visual, Agile, Simple Threat modeling	Application threat models + operational threat models, scalable for agile/DevOps
OCTAVE	Organizational risk assessment	Asset-based threat profiles, identify infrastructure vulnerabilities, develop security strategy

Malware Analysis Types

Analysis Type	Method	Tools	Output
Static Analysis (Basic)	Examine without executing: file hashes, strings, PE headers, imports	strings, PEiD, PEstudio, YARA, ssdeep	File type, packer detection, suspicious strings, initial IoCs
Dynamic Analysis (Basic)	Execute in sandbox and observe behavior	Cuckoo Sandbox, Any.run, Joe Sandbox, Process Monitor	Network connections, file system changes, registry modifications, API calls
Static Analysis (Advanced)	Reverse engineering: disassembly and decompilation of code	IDA Pro, Ghidra, Binary Ninja, Radare2	Code logic, encryption algorithms, C2 protocols, evasion techniques
Dynamic Analysis (Advanced)	Interactive debugging: step through execution	x64dbg, OllyDbg, WinDbg, GDB	Unpacking, decryption routines, runtime behavior analysis

Threat Attribution

Attribution is the process of identifying the responsible threat actor behind a cyber operation. It ranges in confidence and uses multiple evidence types.

Technical Indicators: Malware code overlap, shared infrastructure (C2 servers, domains), tool reuse, coding style, compilation timestamps, language artifacts
Operational Patterns: Working hours (timezone analysis), target selection, campaign cadence, TTP consistency with known actors
Strategic Context: Geopolitical motivation alignment, target sector relevance, timing correlation with political events
False Flags: Adversaries deliberately plant misleading attribution evidence (language strings, tool signatures, infrastructure mimicry). Always consider the possibility of deception.

Tip: Attribution confidence should be expressed using a standardized scale (e.g., almost certainly, highly likely, likely, possible, unlikely). Single indicators are rarely sufficient for high-confidence attribution; multiple independent evidence types are required.

Threat Scoring & Prioritization

Factor	Description	Scoring Consideration
Intent	The adversary's goal and motivation	Higher score if targeting your sector directly
Capability	Technical sophistication and resources	APTs score highest; script kiddies lowest
Opportunity	Attack surface and exposure of the target	Unpatched systems, exposed services increase score
Relevance	How applicable the threat is to your organization	Industry-specific threats score higher than generic
Confidence	Reliability and validity of the intelligence	Multiple corroborating sources increase confidence

Traffic Light Protocol (TLP)

TLP is a set of designations used to ensure that sensitive information is shared with the appropriate audience. It was created by FIRST (Forum of Incident Response and Security Teams).

TLP Color	Sharing Scope	Usage
TLP:RED	Named recipients only, no further sharing	Highly sensitive intelligence that could cause harm if disclosed. Eyes-only for specific individuals in a meeting or conversation.
TLP:AMBER	Recipient's organization + need-to-know	Share within your organization with those who need it to act. Can be shared with clients/customers on need-to-know basis.
TLP:AMBER+STRICT	Recipient's organization only	Same as AMBER but restricted to the recipient organization only; no sharing with clients or partner organizations.
TLP:GREEN	Community-wide sharing	Share with peers and partner organizations within your community/sector, but not publicly (e.g., ISAC members).
TLP:CLEAR	No restrictions, public disclosure	Information can be shared freely and publicly. Minimal or no foreseeable risk from disclosure.

Tip: TLP 2.0 replaced the old TLP:WHITE with TLP:CLEAR and added TLP:AMBER+STRICT. Always label intelligence reports with the appropriate TLP designation. When in doubt, use a more restrictive classification.

Intelligence Report Types

Report Type	Audience	Content	Frequency
Strategic Report	Executives, board, CISO	Threat landscape overview, risk trends, business impact, recommendations	Quarterly / Annual
Tactical Report	SOC, security engineers	TTPs, detection rules, MITRE ATT&CK mappings, mitigation steps	As needed / Campaign-based
Operational Report	IR team, threat hunters	Active campaign details, threat actor profiles, impending attack intelligence	Ongoing / Event-driven
Technical Bulletin	SOC analysts, SIEM operators	IoCs, YARA rules, Snort/Suricata signatures, IP/domain blocklists	Daily / Real-time feeds
Threat Advisory	All security staff	Urgent alerts about active exploitation, critical vulnerabilities, zero-days	Immediate / As discovered
RFI Response	Requesting stakeholder	Targeted answers to specific intelligence questions (Request for Information)	On demand

Sharing Platforms & ISACs

Platform / Organization	Description
ISACs (Information Sharing and Analysis Centers)	Sector-specific organizations that share threat intelligence among member organizations (FS-ISAC for finance, H-ISAC for healthcare, IT-ISAC for technology, etc.)
ISAOs (Information Sharing and Analysis Organizations)	Broader sharing communities not limited to specific sectors; more flexible membership
MISP	Open-source platform for sharing, storing, and correlating IoCs and threat intelligence between organizations
CISA AIS (Automated Indicator Sharing)	US government program enabling bidirectional machine-to-machine sharing of indicators via STIX/TAXII
CERTs / CSIRTs	National and organizational Computer Emergency Response Teams that coordinate incident response and share advisories

Automation: SOAR & TIP Integration

Automation is critical for scaling threat intelligence operations and reducing analyst fatigue.

Technology	Purpose	Examples
SOAR	Security Orchestration, Automation, and Response: automate playbooks, orchestrate tools, streamline incident response	Splunk SOAR (Phantom), Palo Alto XSOAR, IBM Resilient, Swimlane
TIP	Threat Intelligence Platform: aggregate, correlate, enrich, and operationalize threat intelligence from multiple sources	MISP, OpenCTI, Anomali ThreatStream, Recorded Future, ThreatConnect
SIEM Integration	Ingest threat feeds into SIEM for real-time correlation with internal logs and alerts	Splunk, QRadar, Microsoft Sentinel, Elastic SIEM

Automated Enrichment: Incoming IoCs automatically checked against VirusTotal, WHOIS, GeoIP, reputation databases
Automated Blocking: High-confidence malicious IoCs pushed to firewalls, proxies, and EDR for automatic blocking
Playbook-Driven Response: SOAR playbooks trigger predefined response actions (isolate host, block IP, create ticket) when specific threat conditions are met
Feed Deduplication: Automated removal of duplicate indicators from multiple overlapping feeds

Tip: The exam emphasizes that intelligence dissemination must be timely, relevant, and audience-appropriate. Always match report detail level to the consumer: executives get strategic summaries, SOC analysts get technical IoCs and detection rules.

Framework Comparison: Kill Chain vs ATT&CK vs Diamond Model

Aspect	Cyber Kill Chain	MITRE ATT&CK	Diamond Model
Creator	Lockheed Martin	MITRE Corporation	Sergio Caltagirone, Andrew Pendergast, Christopher Betz
Structure	7 linear phases	14 tactics, 200+ techniques, sub-techniques	4 vertices (Adversary, Capability, Infrastructure, Victim)
Approach	Attack progression (sequential)	Adversary behavior catalog (matrix)	Intrusion event analysis (relational)
Best For	Understanding attack flow, defense-in-depth planning	Detection engineering, threat hunting, gap analysis	Attribution, campaign tracking, pivoting analysis
Granularity	High-level (7 phases)	Very detailed (techniques + sub-techniques)	Event-level (per intrusion event)
Limitation	Linear model; does not capture post-compromise complexity well	Large and complex; requires expertise to operationalize	Requires significant data to populate all vertices

STIX 2.x Object Relationships

STIX uses Relationship Objects (SROs) to connect domain objects. Understanding how STIX objects relate to each other is essential for building threat intelligence graphs.

Source SDO	Relationship	Target SDO	Example
Threat Actor	uses	Malware	APT28 uses X-Agent malware
Threat Actor	attributed-to	Identity	Lazarus Group attributed-to North Korea
Campaign	uses	Attack Pattern	SolarWinds campaign uses supply chain compromise
Indicator	indicates	Malware	Hash abc123 indicates Emotet malware
Malware	targets	Vulnerability	WannaCry targets CVE-2017-0144 (EternalBlue)
Course of Action	mitigates	Attack Pattern	MFA mitigates credential stuffing

Intelligence Confidence & Source Reliability

Admiralty Code (Source)	Rating	Admiralty Code (Info)	Rating
A	Completely Reliable	1	Confirmed by other sources
B	Usually Reliable	2	Probably True
C	Fairly Reliable	3	Possibly True
D	Not Usually Reliable	4	Doubtful
E	Unreliable	5	Improbable
F	Cannot Be Judged	6	Truth cannot be judged

The Admiralty System (also called the NATO System) provides a standardized way to rate both the reliability of the source and the credibility of the information independently. For example, a rating of B2 means the source is "Usually Reliable" and the information is "Probably True."

Pyramid of Pain

David Bianco's Pyramid of Pain ranks indicator types by how much pain they cause adversaries when detected and blocked. Higher levels are harder for adversaries to change.

Level (Bottom to Top)	Indicator Type	Pain to Adversary	Example
1 (Bottom)	Hash Values	Trivial - easily changed with 1-bit modification	MD5, SHA-1, SHA-256 of malware files
2	IP Addresses	Easy - can switch to new infrastructure quickly	C2 server IPs, scanning source IPs
3	Domain Names	Simple - register new domains, use DGA	C2 domains, phishing domains
4	Network/Host Artifacts	Annoying - requires retooling	URI patterns, User-Agent strings, registry keys, mutex names
5	Tools	Challenging - must find or develop new tools	Cobalt Strike, Mimikatz, custom RATs
6 (Top)	TTPs (Tactics, Techniques, Procedures)	Tough! - requires fundamental operational change	Spear phishing with macro-enabled docs, pass-the-hash, DLL side-loading

Tip: Focusing detection on TTPs (the top of the pyramid) provides the most durable defense because adversaries must fundamentally change their methodology. This aligns with MITRE ATT&CK-based detection strategies.

Key Acronyms & Definitions Quick Reference

Acronym	Full Form	Relevance to CTIA
CTI	Cyber Threat Intelligence	Core discipline tested by this certification
TTP	Tactics, Techniques, and Procedures	Describes adversary behavior patterns
PIR	Priority Intelligence Requirements	Drives the collection plan in the intelligence lifecycle
RFI	Request for Information	Stakeholder request for specific intelligence
APT	Advanced Persistent Threat	Sophisticated, state-sponsored threat actors
IOC / IOA	Indicator of Compromise / Indicator of Attack	Evidence of malicious activity (past vs ongoing)
STIX	Structured Threat Information eXpression	Standard language for representing CTI
TAXII	Trusted Automated eXchange of Indicator Information	Transport protocol for sharing STIX data
TLP	Traffic Light Protocol	Sharing classification system (RED/AMBER/GREEN/CLEAR)
ACH	Analysis of Competing Hypotheses	Key structured analytic technique
ISAC	Information Sharing and Analysis Center	Sector-specific threat intelligence sharing organizations
SOAR	Security Orchestration, Automation, and Response	Automates intelligence operationalization and incident response

CTIA Exam Success Tips

Intelligence Lifecycle: Know all 6 phases cold - many questions test understanding of which activities belong to which phase
Intelligence Types: Be able to classify any scenario as strategic, tactical, operational, or technical intelligence
STIX/TAXII: Know the 12 STIX Domain Objects and how TAXII channels vs collections work
TLP Protocol: Memorize all 5 TLP levels (including AMBER+STRICT) and their sharing boundaries
Frameworks: Understand when to use Kill Chain vs ATT&CK vs Diamond Model and their strengths/limitations
ACH Method: Practice the step-by-step process of Analysis of Competing Hypotheses
Collection Disciplines: Differentiate OSINT, HUMINT, SIGINT, TECHINT, CYBINT sources and their applications
Audience Matching: Always match intelligence products to the appropriate consumer (executives = strategic, SOC = technical)

Tip: The CTIA exam is scenario-heavy. Practice applying frameworks to real-world situations rather than memorizing definitions alone. Focus on Domain 4 (Data Collection and Processing) as it carries the highest weight at 24%.

312-85

CTIA - Certified Threat Intelligence Analyst

CTIA Practice Exam 1

CTIA Practice Exam 2

CTIA Practice Exam 3

CTIA Practice Exam 4

CTIA Practice Exam 5

CTIA Practice Exam 6

Unlock All Content for 312-85

Preview (10 / 120)

Flash Cards

Available Languages

Exam Topics

312-85 Cheat Sheet

CTIA 312-85 Exam Details

Domain Weight Breakdown

About the CTIA Certification

Intelligence Lifecycle

Types of Threat Intelligence

Threat Actor Categories

MITRE ATT&CK Framework

Lockheed Martin Cyber Kill Chain

Diamond Model of Intrusion Analysis

Intelligence Collection Disciplines

Threat Feeds & Data Sources

Indicator Types: IoC vs IoA

STIX & TAXII Standards

Data Collection Tools

Structured Analytic Techniques (SATs)

Threat Modeling Frameworks

Malware Analysis Types

Threat Attribution

Threat Scoring & Prioritization

Traffic Light Protocol (TLP)

Intelligence Report Types

Sharing Platforms & ISACs

Automation: SOAR & TIP Integration

Framework Comparison: Kill Chain vs ATT&CK vs Diamond Model

STIX 2.x Object Relationships

Intelligence Confidence & Source Reliability

Pyramid of Pain

Key Acronyms & Definitions Quick Reference

CTIA Exam Success Tips