CTI

The exam is multiple choice. The certifying body publishes the current number of questions, time limit, and delivery options on its official site; check there before scheduling, because these details can change between exam versions.

It is moderately difficult. Questions often test judgment rather than recall: choosing a collection source, prioritizing intelligence requirements, or selecting the right analytic technique for a scenario. Candidates with hands-on threat intel experience tend to find it more manageable than those who only read summaries.

Most candidates need several weeks of focused study. A practical plan is to spend the first half learning frameworks and lifecycle concepts, then the second half applying them through exercises such as writing requirements, mapping actor behavior to ATT&CK, and drafting short intelligence reports.

Start with the intelligence lifecycle and requirements, because later topics depend on them. Then cover sources and collection, frameworks and standards, analysis and production, dissemination, threat hunting, and finally program management. Practice each domain with a small scenario before moving on.

Candidates often memorize definitions without learning when to apply them, ignore the intelligence lifecycle in scenario questions, confuse collection with analysis, or overlook dissemination and feedback. Another common mistake is neglecting operational security and program management, which carry real weight on the exam.

No formal experience prerequisite is published, but the exam assumes familiarity with security operations. Practical experience with SIEM queries, indicator management, or report writing makes scenario questions easier. If you lack it, build small labs and write practice intelligence products.

Retake policies, waiting periods, and fees are set by the certifying body and can change. The official website publishes the current retake policy and any associated costs; confirm there rather than relying on third-party summaries.

It signals that you understand the intelligence cycle and can produce actionable analysis, which is valuable for SOC, CTI, and incident response roles. Employers still weigh hands-on experience heavily, so pair the credential with a portfolio of written intelligence assessments or detection work.

The exam is closed-book, so you cannot bring reference materials. You should know ATT&CK tactics and techniques well enough to map behavior from memory. Practice mapping common adversary actions to technique IDs until it becomes routine.