C|TIA Exam Study Tips: Domain-by-Domain Prep Strategies

Threat Intelligence Fundamentals & Landscape (25%)

• Learn the four types of threat intelligence (strategic, tactical, operational, technical) and which audience consumes each — this distinction underlies questions across multiple domains.
• Review threat actor categories and motivations (APTs, hacktivists, insider threats, script kiddies) and practice matching a described scenario to the right actor type.
• Understand indicators of compromise (IOCs) versus indicators of attack (IOAs) — IOCs are static artifacts, while IOAs focus on behavior and often provide earlier warning.
• Know the difference between data, information, and intelligence as a conceptual hierarchy — this basic distinction comes up repeatedly in different phrasings.

Intelligence Lifecycle: Planning, Collection & Processing (30%)

• Memorize all six lifecycle phases in order and be able to describe what happens in each — this is the single most valuable framework for the entire exam.
• Learn collection source acronyms precisely — OSINT, HUMINT, SIGINT, TECHINT, CYBINT, GEOINT — and practice matching scenarios to the correct collection type.
• Understand source reliability versus information credibility as two separate evaluation dimensions, often assessed using an admiralty-code-style rating system.
• Review data processing concepts — normalization, enrichment, deduplication — and understand why raw collected data needs this processing before analysis.

Data Analysis & Threat Modeling (25%)

• Master the Cyber Kill Chain's seven stages in order, and practice identifying which stage a described attack activity represents.
• Learn the MITRE ATT&CK framework's tactic/technique distinction — tactics are the "why," techniques are the "how."
• Understand the Diamond Model's four core features (adversary, capability, infrastructure, victim) and how they relate to a single intrusion event.
• Study the Pyramid of Pain conceptually, understanding why TTPs are more valuable to defenders long-term than easily-changed indicators like hash values.
• Review common analytic biases (confirmation bias, mirror imaging) since structured analytic techniques exist specifically to counter them.

Intelligence Reporting, Dissemination & Sharing (20%)

• Learn STIX and TAXII's relationship precisely — STIX defines the structured data format, TAXII defines how it's transported.
• Memorize the Traffic Light Protocol (TLP) designations (RED, AMBER, GREEN, CLEAR) and what each permits in terms of information sharing.
• Understand how report type should match audience — strategic reports for executives, tactical/technical reports for hands-on defenders.
• Review the concept of analytic confidence levels and why analysts state them explicitly in finished intelligence products.

Put These Tips Into Practice

Our CTIA exam page has free practice quizzes broken out by domain, plus a full mock exam, to help you target your remaining study time.