How should I use these Data Analysis practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Data Analysis questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Data Analysis domain.

312-85 · topic practice

Data Analysis practice questions

Practise Certified Threat Intelligence Analyst (312-85) Data Analysis practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Data Analysis

Practice 10 questions Browse domain →

What the exam tests

What to know about Data Analysis

Data Analysis questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Data Analysis exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Data Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Data Analysis explanation →

You are tasked with evaluating the validity of a threat intelligence report provided by an external vendor. You choose to use ACH. What is the very first step you must take before populating the matrix?

Trap 1: Identify the primary adversary.

This is part of the process, but not the starting point.

Trap 2: Gather all relevant evidence logs.

Evidence gathering occurs after defining the scope and hypotheses.

Trap 3: Clearly define the problem or research question to be answered.

Without a clear objective, the ACH process lacks focus.

Data Analysis practice questions

What to know about Data Analysis

Common Data Analysis exam traps

Data Analysis questions

You are tasked with evaluating the validity of a threat intelligence report provided by an external vendor. You choose to use ACH. What is the very first step you must take before populating the matrix?

You are using the 'Kill Chain' model to analyze an incident. The logs show the adversary successfully gained credentials via phishing. Which phase does this correlate to?

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Track your progress over time

Start a Data Analysis only practice session

Related 312-85 topic practice pages

Data Analysis practice questions

Intelligence Reporting And Dissemination practice questions

Data Collection And Processing practice questions

Cyber Threats And Attack Frameworks practice questions

Introduction TO Threat Intelligence practice questions

Threat Hunting And Detection practice questions

Threat Intelligence IN SOC IR And Risk Management practice questions

Requirements Planning Direction And Review practice questions

312-85 fundamentals practice questions

312-85 scenario practice questions

312-85 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid