The CTIA training package comes with 27 hands-on labs, but the exam itself is 50 multiple-choice questions. Knowing where the exam ends and the course begins is the first decision in your study plan.
TL;DR
- Exam format: 50 multiple-choice questions in 2 hours, with a 70% passing score per official documentation.
- Heaviest domain: Domain 4, Data Collection and Processing, at 24% of the blueprint. Domain 5, Data Analysis, is next at 16%.
- Eight domains: the CTIAv2 blueprint lists eight, and the two smallest (Threat Hunting and Detection, and Threat Intelligence in SOC Operations, Incident Response and Risk Management) are 6% each.
- Retakes: no waiting period before the second attempt, then at least 14 days between later attempts, and no more than five attempts in 12 months.
- Renewal: 120 ECE credits within three years, plus EC-Council's annual continuing education fee.
Exam at a Glance
| Item | Value |
|---|---|
| Exam code | 312-85 |
| Questions | 50 |
| Duration | 2 hours |
| Format | Multiple choice |
| Passing score | 70% |
| Current version | CTIAv2, with the exam blueprint published February 2024 |
| Domains | 8 |
| Validity | 3 years, renewed through ECE credits |
| Retake policy | No wait before the second attempt, 14 days between later attempts, maximum five attempts in 12 months |
With 120 minutes for 50 questions, you have 2 minutes 24 seconds per question on average. That is simple arithmetic from the published format, and it leaves room to read scenario wording twice.
One thing to watch: official documentation shows inconsistencies across sources. The exam code is 312-85 according to official documentation, while alternative official documentation lists a different code in its exam details box. Official documentation also states conflicting experience requirements, citing both "at least 2 years" and a minimum of three years of experience in different sections. Where a detail matters for your application, confirm it with EC-Council directly before you pay for anything.
What the CTIA Is Built Around
EC-Council describes the CTIA as a method-driven program that follows the threat intelligence life cycle from planning to reporting. The life cycle it teaches has four stages:
- Planning and Direction
- Collection
- Analysis and Production
- Dissemination and Integration
The program also teaches four types of threat intelligence: strategic, operational, tactical and technical. Those two lists are the spine of the course, and the eight exam domains hang off them.
EC-Council's training package includes an 800+ page student manual, a 350+ page lab manual, 27 hands-on labs, and 200+ threat intelligence tools. It says 40% of training time goes to labs, and that the program aligns with the NICE Cybersecurity Workforce Framework (NIST SP 800-181) and CREST's Certified Threat Intelligence Manager framework. Those are EC-Council's own statements about its curriculum, not independent assessments.
Here's the part that matters for planning: the exam is 50 multiple-choice questions, while the labs build skills across the full lifecycle. The labs build skills, but the exam format has no lab component. Treat the labs as the way to make the concepts stick, and the blueprint as the list of what you will be asked.
The Eight CTIAv2 Domains and Their Weights
The CTIAv2 exam blueprint assigns these weights. They sum to 100%.
| # | Domain | Weight |
|---|---|---|
| 1 | Introduction to Threat Intelligence | 12% |
| 2 | Cyber Threats and Attack Frameworks | 8% |
| 3 | Requirements, Planning, Direction, and Review | 14% |
| 4 | Data Collection and Processing | 24% |
| 5 | Data Analysis | 16% |
| 6 | Dissemination and Reporting of Intelligence | 14% |
| 7 | Threat Hunting and Detection | 6% |
| 8 | Threat Intelligence in SOC Operations, Incident Response, and Risk Management | 6% |
Domains 3, 4, 5 and 6 together make up 68% of the blueprint. If your time is limited, that is where it pays off.
Domain 1: Introduction to Threat Intelligence (12%)12%
The blueprint topics are intelligence in general, cyber threat intelligence concepts, the threat intelligence lifecycle and frameworks, threat intelligence platforms (TIPs), threat intelligence in the cloud environment, and future trends and continuous learning. EC-Council's course outline for the matching module also lists the difference between threat intelligence and threat data, the types of threat intelligence, the maturity model, and the strategy topics. This is the vocabulary domain, and everything later builds on it.
Domain 2: Cyber Threats and Attack Frameworks (8%)8%
Topics are cyber threats, advanced persistent threats (APTs), the Cyber Kill Chain, MITRE ATT&CK and the Diamond Model, and indicators of compromise (IoCs). The course outline for this module also names threat actors, the APT lifecycle, categories of IoCs, and the Pyramid of Pain. It is the smallest of the framework-heavy domains, but the frameworks reappear in later domains, especially in analysis.
Domain 3: Requirements, Planning, Direction, and Review (14%)14%
This domain covers the organization's current threat landscape, requirements analysis, planning a threat intelligence program, establishing management support, building a threat intelligence team, threat intelligence sharing, and reviewing the program. The course outline adds the MoSCoW method for prioritizing requirements, rules of engagement, project charter and policy preparation, and types of sharing partners. It reads more like program management than hands-on analysis, so expect questions about decisions and ordering rather than commands.
Domain 4: Data Collection and Processing (24%)24%
This is the largest slice. Blueprint topics are threat intelligence data collection, collection management, feeds and sources, data collection and acquisition, bulk data collection, data processing and exploitation, and threat data collection and enrichment in cloud environments.
EC-Council's course outline expands this with data collection methods, types of data, the collection plan, bulk data management, structuring and normalization of collected data, and data sampling. The course also teaches collection through open-source intelligence (OSINT), human intelligence (HUMINT), cyber counterintelligence, indicators of compromise, malware analysis and Python scripting. If you are going to spend extra hours anywhere, spend them here, because a quarter of the blueprint sits in this one domain.
Domain 5: Data Analysis (16%)16%
Blueprint topics are data analysis, data analysis techniques, threat analysis, the threat analysis process, fine-tuning threat analysis, threat intelligence evaluation, creating runbooks and a knowledge base, and threat intelligence tools. The course outline names statistical data analysis, the Analysis of Competing Hypotheses (ACH), the Structured Analysis of Competing Hypotheses (SACH), threat modeling methodologies, threat attribution, and using the Diamond Model inside the analysis process.
Domain 6: Dissemination and Reporting of Intelligence (14%)14%
Blueprint topics are dissemination, participating in sharing relationships, sharing threat intelligence, delivery mechanisms, threat intelligence sharing platforms, intelligence sharing acts and regulations, threat intelligence integration, and threat intelligence sharing and collaboration using Python scripting. The matching course module also covers the types of threat intelligence reports, report writing tools, the information sharing model, sharing intelligence with YARA rules, and standards and formats for sharing threat intelligence.
Domain 7: Threat Hunting and Detection (6%)6%
Two blueprint topics: threat hunting concepts, and threat hunting automation. The course outline lists types of threat hunting, the hunting process, the Threat Hunting Maturity Model, the hunter skillset, the hunting loop, TaHiTI (Targeted Hunting integrating Threat Intelligence), and automation with Python.
Domain 8: Threat Intelligence in SOC Operations, Incident Response, and Risk Management (6%)6%
Three blueprint topics: threat intelligence in SOC operations, in risk management, and in incident response. The course outline adds building SOC threat intelligence, the next-generation intelligent SOC, SOC threat intelligence platforms, integrating threat intelligence into the risk management process, and using it in incident recovery and resilience.
How to Study When the Blueprint Is Weighted This Unevenly
The blueprint tells you where the questions come from, so use it as a time budget rather than reading the course in page order.
- Weeks one and two: Domains 1 to 3. Learn the life cycle stages, the four intelligence types, and the frameworks (Kill Chain, ATT&CK, Diamond Model). These are the vocabulary the other domains assume.
- Weeks three and four: Domain 4. It is 24% of the blueprint, so give it the most time of any domain. For each collection method, be able to explain when you would choose it and what processing the data needs before it is useful.
- Weeks five and six: Domains 5 and 6. Learn how ACH and SACH differ, what threat modeling produces, which report suits which audience, and what the sharing platforms and regulations are for.
- Final week: Domains 7 and 8, then timed practice questions across everything. Together they are only 12%, so a short, focused review is enough.
That plan is a suggestion, not an official schedule. EC-Council does not publish a recommended number of study hours, so there is no verified figure to quote. Adjust the pacing to your own background and the time before your exam voucher expires.
A useful habit is to restate each blueprint topic as a question you could be asked. "Which collection method fits this scenario?" is better preparation than "memorize the definition of bulk data collection."
Prerequisites and How People Qualify
Official documentation describes the audience as mid-level to high-level cybersecurity professionals. EC-Council notes that holders of its CEH and CND certifications can enroll. Official documentation states candidates need an educational background and at least two years of working experience in cybersecurity, IT or a related field, while official documentation also cites a minimum of three years in a separate section. Treat this as guidance on who the program is aimed at, and confirm the actual requirement with EC-Council for your situation.
Official documentation details the CEH application process, including application fees and approval windows, but those details are written specifically for CEH. Do not assume the same numbers apply to the CTIA. EC-Council does not publish a CTIA-specific voucher price on all official pages, so confirm the current price with EC-Council or your training partner before you pay.
Training comes in three delivery modes: iWeek (live online, instructor-led), iLearn (self-study), and in-person with a training partner. The official CTIA documentation lists a three-day training format.
Retakes and Voucher Extensions
EC-Council's published retake policy is short and specific:
- If you do not pass, there is no waiting period before the second attempt.
- If you do not pass the second attempt, you must wait at least 14 days before the third.
- The same 14-day wait applies before the fourth and fifth attempts.
- You may not take a given exam more than five times in a year (12 months).
- If you pass, you cannot take that exam again.
If your voucher is about to expire, EC-Council's policy says you should contact them before it does, because only valid vouchers can be extended.
EC-Council also runs a Candidate Retesting Audit process for some certification cases, and a candidate who fails that audit must buy a retake voucher. The practical lesson from the policy is to treat the first attempt as the one that counts: nothing stops you from retaking quickly, but a failed attempt costs a voucher.
Official Practice and Where CertCompanion Fits
EC-Council's exam prep product offers two assessment modes: a progressive assessment that lets you work topic by topic, and a simulated mode that mimics full exam conditions. The product includes one-year access. EC-Council states its exam prep product does not guarantee a pass.
CertCompanion's CTIA practice questions are a separate, independent resource. Start with the free questions at /exams/ec-council-threat-intelligence-analyst to see which domains you answer least confidently before you commit study time. The bank's own distribution is shown below. It describes CertCompanion's question set, not the official exam weighting.
This shows how CertCompanion's own CTIA practice bank is distributed, not the official exam weighting. An "Other" bucket, when present, holds questions that could not be mapped cleanly to one domain. Use the official domain percentages to plan coverage and this bank to pressure-test it.
For other EC-Council certifications and how the CTIA fits among them, the EC-Council provider page lists the full set.
| CTIA question bank | |
|---|---|
| Questions | 740 |
| Single-answer | 739 |
| Select-all-that-apply | 1 (0%) |
| Median explanation length | 32 words |
How to Reason Through a CTIA Question
Scenario questions on this exam reward the same habit: identify which life cycle stage the scenario sits in, then ask what that stage is supposed to produce. A question about choosing a collection source belongs to Collection, a question about weighing competing explanations belongs to Analysis and Production, and a question about who receives a report belongs to Dissemination and Integration. Naming the stage first removes most of the wrong answers. The question below comes from CertCompanion's bank.
An analyst at Northwind Security is analyzing a suspected nation-state attack and notices the malware contains Russian language strings, targets organizations during Moscow business hours, and uses infrastructure previously attributed to Russian threat actors. However, intelligence reports suggest a different nation-state may be conducting false flag operations. What analytical challenge does this scenario illustrate?
- A. Mirror imaging where analysts project their own cultural assumptions onto adversaries
- B. False flag operations where attackers deliberately plant misleading attribution indicators
- C. Confirmation bias where analysts favor evidence supporting their initial hypothesis
- D. Anchoring bias where analysts over-rely on the first information they received
Show the answer and the reasoning
Correct answer: B. False flag operations where attackers deliberately plant misleading attribution indicators
False flag operations involve attacks deliberately designed to appear as if executed by a different actor. Attackers plant misleading indicators such as foreign language strings, timezone-aligned activity, and infrastructure overlaps to misdirect attribution. The Olympic Destroyer attack in 2018 is a notable example where multiple false flags complicated attribution. This scenario specifically describes deliberate deception through planted Russian indicators when intelligence suggests another actor. Mirror imaging involves projecting one's own values onto adversaries. Confirmation bias involves favoring evidence that confirms existing beliefs. Anchoring bias involves over-reliance on initial information. The key distinction is that false flags are intentional adversary deception, not analyst cognitive errors.
After you answer a question like this, read the explanation even when you got it right. The wrong options are usually correct statements about a different stage of the life cycle, and learning to spot that is most of the skill.
Keeping the CTIA Active
EC-Council states that all of its certifications are valid for three years and are renewed through its continuing education program. For certifications under the ECE scheme, members must earn 120 credits within the three-year period. Credits are earned per calendar year and must be registered by 1 February of the following year.
Separately, EC-Council charges an annual continuing education fee. Confirm the current fee and which exam codes it applies to directly with EC-Council before you budget for renewal, as pricing details are subject to change. Not paying the fee blocks you from adding ECE credits and from sharing your digital badge. EC-Council's policy also states that credits cannot be earned for activities that are part of your normal job role.
If a certification lapses, EC-Council's policy gives suspended members 12 months from the expiry of the three-year period to meet the 120-credit requirement and pay the fees; the reinstated period is then shortened by the length of the suspension. Verify the current policy before you rely on that, as EC-Council may change its certification policies without notice.
Frequently Asked Questions
How many questions are on the CTIA exam, and how long do I get?
The CTIA (exam code 312-85) has 50 multiple-choice questions and a 2-hour time limit.
What score do I need to pass?
Official documentation states 70%. This guide does not quote any other cut score, because EC-Council does not publish one.
Which domain is weighted most?
Domain 4, Data Collection and Processing, at 24%. Domain 5, Data Analysis, follows at 16%, then Domains 3 and 6 at 14% each.
Is there a hands-on component in the exam?
The exam details published by EC-Council describe a multiple-choice test. The 27 labs belong to the training package, not to the exam format.
What happens if I fail?
There is no waiting period before your second attempt. After a second failure you wait at least 14 days before each later attempt, and you may sit the exam no more than five times in 12 months.
How do I renew the CTIA?
Earn 120 ECE credits within three years and pay EC-Council's annual continuing education fee. Confirm the current fee amount directly with EC-Council, as pricing details are subject to change.
Does CertCompanion have CTIA practice questions?
Yes. The free questions are at /exams/ec-council-threat-intelligence-analyst, and the bank is built around the same eight domains.
The CTIA is a 50-question, 2-hour exam with a 70% passing score and a blueprint that puts almost a quarter of its weight on data collection and processing. Learn the life cycle and the four intelligence types first, spend the most time on Domains 4 and 5, and use the retake rules to plan your attempts rather than to rely on them. Confirm eligibility and voucher pricing with EC-Council before you pay, because official documentation shows some inconsistencies across sources.
Try CertCompanion's CTIA practice questions at /exams/ec-council-threat-intelligence-analyst to find your weakest domains before you open the official courseware.
Checked against official EC-Council CTIA exam documentation and current candidate reports. Last verified 2026-11-02.