thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

EC-Council · Cybersecurity · Professional

EC-Council Certified Threat Intelligence Analyst (CTIA) exam guide

Exam 312-85

Certified Threat Intelligence Analyst (CTIA) covers the full threat intelligence lifecycle: planning requirements, collecting and processing data, analysis, reporting and using intelligence in SOC, incident response and risk management. It suits analysts moving from reactive monitoring to intelligence-led defence.

Questions50
Time limit120 minutes
Passing score70%
Exam feeSee official page
Valid for3 years
DeliveryEC-Council Exam Portal (remote proctored) or ECC test centers

Format: Multiple choice. Fee note: Price varies by training format; contact EC-Council.

Who it's for

SOC analysts, incident responders and security professionals with at least two years of experience who want to specialise in cyber threat intelligence.

What the exam covers

Introduction to Threat Intelligence—
Cyber Threats and Attack Frameworks—
Requirements, Planning, Direction, and Review—
Data Collection and Processing—
Data Analysis—
Intelligence Reporting and Dissemination—
Threat Hunting and Detection—
Threat Intelligence in SOC Operations, Incident Response, and Risk Management—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: EC-Council states at least two years of experience in cybersecurity, IT or a related field for candidates applying without official training.

Recommended: SOC or incident response background; CEH or CND knowledge helps.

Keeping it active

Valid three years under EC-Council's ECE policy: earn 120 ECE credits in the cycle and pay the $80 annual continuing education fee.

Skills & careers

Skills it validates

  • Defining intelligence requirements
  • Collecting OSINT and technical intelligence
  • Analysing threats with frameworks such as MITRE ATT&CK and the Diamond Model
  • Producing strategic, operational and tactical reports
  • Sharing intelligence via STIX/TAXII
  • Threat hunting with intelligence

Job roles

Threat Intelligence AnalystCyber Threat HunterSOC Analyst (Tier 2/3)Incident ResponderSecurity Researcher

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Threat intelligence concepts, types and lifecycle; MITRE ATT&CK and kill chain.
  2. Week 2: Requirements, collection sources (OSINT, feeds) and processing.
  3. Week 3: Analysis techniques (ACH, Diamond Model) and reporting.
  4. Week 4: Threat hunting and integrating intelligence into SOC/IR; practice tests and book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know the intelligence lifecycle phases in order; many questions test sequence.
  • Distinguish strategic, operational, tactical and technical intelligence.
  • Learn STIX/TAXII and common sharing formats.
  • With only 50 questions, each is worth 2%; read carefully.

Key terms for this exam

All 57 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

What is the CTIA exam code?

312-85 historically; EC-Council's current course page lists a different code, so confirm on your voucher before booking.

How many questions are on CTIA?

50 multiple-choice questions in 2 hours; 70% to pass.

Do I need experience?

Two years in cybersecurity or IT if you apply without official training.

Is CTIA worth it?

It is one of few vendor-neutral threat intel certs; GIAC GCTI is a pricier, more technical alternative.

Does CTIA expire?

Yes, three years under the ECE program.

Official page: www.eccouncil.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.