EC-Council · Free Practice Questions · Last reviewed May 2026
48 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?
Apply the Mode of the frequency dataset.
Calculate the Z-score of the timestamp distribution.
The Z-score expresses how many standard deviations each timestamp lies from the distribution mean, giving a normalised threshold for judging whether an observation is statistically unusual. Applying it to the timestamp distribution identifies which outliers are significant enough to justify revising threat modelling.
Perform a simple Median split.
Use the Range calculation.
In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?
To reduce the storage space required for logs.
To increase the ingestion speed of the SIEM.
To ensure data compatibility for correlation and cross-source analysis.
Normalising disparate SIEM log data converts differing field names, formats and timestamps into a common schema, enabling events from multiple sources to be correlated and analysed together. This satisfies the requirement for cross-source compatibility in CTI analysis.
To encrypt the logs for regulatory compliance.
While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?
Elevation of Privilege
Information Disclosure
Logging tokens in plain text exposes credentials to anyone with log access, directly breaching confidentiality. STRIDE's Information Disclosure category covers exactly this unauthorised exposure of data, so it is the specific threat satisfied by the plain-text token logging in the API gateway.
Tampering
Repudiation
In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?
The hypothesis is the most likely scenario.
The hypothesis is heavily supported by available data.
The hypothesis is the least likely to be correct given the current evidence set.
In an ACH matrix, each hypothesis is scored against diagnostic evidence; the lowest total indicates that the evidence weighs most heavily against it. A low score therefore means the hypothesis is least consistent with the observed indicators, making it the least likely explanation given the current evidence set.
The hypothesis lacks enough evidence to be evaluated.
When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?
Determine the Tactic and map the specific Technique ID.
DLL side-loading is a specific ATT&CK technique, so analysis must first determine the tactic it serves, then map to the precise Technique ID. This satisfies the stem's requirement for the analytical technique that correctly places the observation within the ATT&CK matrix.
Perform a Root Cause Analysis on the operating system.
Use the CVSS score of the DLL to prioritize the threat.
Calculate the frequency of the DLL calls to determine the actor intent.
Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?
It enables the visualization of relationships between the four core components of an intrusion.
The Diamond Model plots adversary, capability, infrastructure and victim as four vertices, with edges representing their relationships, so analysts can visualise how the components of a single intrusion interrelate. This satisfies the stem's intrusion-analysis reporting scenario.
It provides a vulnerability score for every asset.
It calculates the financial loss expectancy of a breach.
It replaces the need for SIEM log collection.
Want more Data Analysis practice?
Practice this domainYou are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?
Restart the TAXII server service
Validate the JSON bundle against the STIX 2.1 schema
Schema validation confirms the JSON conforms to STIX 2.1 structure before parsing logic runs, isolating whether the failure stems from malformed content rather than TAXII transport. This directly tests the receiving platform's parse error against the specification.
Check the TLS certificate expiration date
Check the firewall rules for port 443
An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?
Indicator
Sighting
Relationship
A Relationship SRO connects two SDOs via a relationship_type such as 'uses', linking the Threat-Actor identity to the Infrastructure object without merging them. It satisfies the stem's requirement to associate a specific actor with the infrastructure they recently utilised.
Observed-Data
You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?
TLP:GREEN
TLP:RED
TLP:RED restricts disclosure to the named recipients only, which satisfies the stem's constraint that a leak could cause irreparable damage. Unlike TLP:AMBER, which permits sharing within the recipient's organisation, RED forbids onward dissemination entirely, making it the sole marking appropriate for an unpatched zero-day of this severity.
TLP:AMBER
TLP:CLEAR
When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?
To verify the integrity of the STIX bundle
To define the retention period for the objects
To uniquely identify a specific set of intelligence within an API Root
In TAXII 2.1, a Collection ID uniquely identifies one collection within an API Root, letting clients poll or subscribe to that specific intelligence set. This satisfies the scenario's need to address a distinct feed endpoint unambiguously.
To encrypt the data payload during transit
You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?
To verify the identity of the threat actor
To map the threat actor's TTPs
To provide actionable remediation steps to defend against a threat
Course of Action objects describe recommended responses to a threat, such as blocking indicators or applying patches, so automation platforms can translate them into remediation workflows. This satisfies the scenario's need for actionable defensive steps rather than pure indicator sharing.
To store forensic artifacts
A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?
Full TAXII object dump
Raw STIX JSON feed
Executive Summary PDF
An executive summary PDF delivers a concise, non-technical strategic overview suited to a CISO's quarterly threat landscape reporting. It satisfies the strategic-outlook constraint by prioritising trends and risk posture over raw indicators or tactical detail.
CSV list of IOCs
Want more Intelligence Reporting And Dissemination practice?
Practice this domainWhen normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?
name
type
The type property is mandatory on every STIX 2.1 object and declares the object's kind — for a file observable this is "file". Populating it satisfies the stem's requirement to define the observable's type, enabling correct parsing and normalisation.
spec_version
hashes
You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?
Update the SSL certificates on the collector.
Increase the connector memory allocation.
Check if the source IP is whitelisted on the threat intelligence provider side.
A 403 during an HTTPS pull means the provider received the request but refused it, so authentication and connectivity are working. Verifying that the connector's source IP is whitelisted on the provider side addresses the authorisation constraint causing the rejection.
Restart the OpenCTI RabbitMQ service.
When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?
Lack of data encryption.
STIX version mismatch.
Data normalization failure.
Source IP blacklisting.
Automated scraping without rate-limit awareness floods a target with rapid requests, which defenders detect as abusive traffic and block at the network edge. The immediate consequence is the scraping host's source IP being blacklisted, halting collection until the address is rotated.
You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?
In the TAXII client configuration settings.
Filtering by confidence occurs in the TAXII client, since TAXII 2.1 servers expose collections without a standard confidence query parameter. The client inspects each STIX object's confidence property and discards low-confidence indicators before ingestion, satisfying the requirement to retrieve only high-confidence indicators from the feed.
At the firewall level.
By disabling the feed authentication.
By modifying the STIX schema.
You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?
Map to 'ip-src'.
'ip-src' is MISP's attribute type for a source IP address, so mapping the CSV 'src_ip' column to it preserves the indicator's meaning and lets correlation engines match it against inbound traffic sources. Mapping to a generic type would lose that directionality.
Map to 'text' attribute type.
Map to 'domain'.
Map to 'comment'.
Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?
SNMP
Syslog
ICMP
TAXII
TAXII defines a RESTful transport and collection model built specifically to carry STIX objects between producers and consumers, satisfying the stem's requirement for automated machine-readable exchange. Unlike generic transfer protocols, it standardises discovery, subscription and polling of intelligence collections, making it the default binding for STIX sharing.
Want more Data Collection And Processing practice?
Practice this domainYou are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?
The time of day the attack occurred
The IP addresses of the Command and Control servers used
Command and Control server IP addresses are the physical and logical assets an adversary uses to deliver capabilities and maintain access. Populating Infrastructure with these C2 IPs satisfies the Diamond Model's requirement for the mechanism connecting adversary to victim.
The specific malware hash used in the attack
The adversary's primary motivation
In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?
Change the file extension to .misp
Manually edit each indicator after the import is complete
Use the MISP API to overwrite the database schema
Create a custom CSV mapping template in the 'Import' module
A custom CSV mapping template in the Import module lets you bind each source column to its MISP attribute type and category, so the Category field is parsed from your file rather than falling back to the default Network activity. Saving the template makes this mapping persist for all future imports, satisfying the efficiency constraint.
You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?
AWS CloudTrail
AWS CloudTrail records API activity as management and data events, capturing the identity, timestamp, source IP and request parameters behind every AWS API call. This audit trail directly exposes unauthorised API key usage, satisfying the requirement to identify relevant indicators in a cloud-native environment.
AWS GuardDuty
AWS WAF
AWS Inspector
AWS Config
During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?
Ignore the request until more data is available
Purchase all available supply chain threat reports
Automate the collection of all supply chain news
Define specific PIRs regarding third-party software vendors and update frequency
Refining supply chain threats into specific Priority Intelligence Requirements scopes collection to named third-party software vendors and defines update frequency, converting a broad stakeholder theme into actionable, measurable intelligence tasks with clear cadence and focus.
Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?
Collection
Processing
Processing converts collected raw data into a structured, analysable format, satisfying the stem's requirement for the lifecycle phase that prepares data for analysis. It sits between collection and analysis, normalising, decrypting, and translating feeds so analysts can consume them.
Dissemination
Analysis
Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?
Command and Control
Command and Control is the Cyber Kill Chain phase where the adversary establishes persistent communication with an external host, typically via beaconing to a C2 server. This matches the stem's description of established persistent external communication, distinguishing it from Actions on Objectives.
Exploitation
Installation
Actions on Objectives
Want more Introduction TO Threat Intelligence practice?
Practice this domainDuring an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?
Weaponization
Weaponization couples an exploit with a deliverable payload, producing the tailored malware itself. Custom-compiling a Trojan to evade EDR is precisely this pairing step, occurring before delivery, so it sits in the Weaponization phase rather than Exploitation or Command and Control.
Exploitation
Delivery
Installation
You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?
Registry key modification
Registry key modification is a host-based artefact, recorded in the Windows registry on an infected endpoint. It satisfies the stem's requirement for a Host-based IOC, unlike network-based indicators such as IP addresses or domain names. Registry persistence keys, for example Run entries, commonly reveal APT footholds during forensic triage.
User-Agent string in HTTP header
Domain name for C2 beaconing
Source IP address in firewall logs
What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?
Reconnaissance of the target
Data Exfiltration
Exfiltration is the culminating activity of Actions on Objectives, where attackers extract the data they have gathered. This phase satisfies the goal of achieving the intrusion's purpose, since stealing information directly fulfils the adversary's mission after prior stages established access and persistence.
Establishing a backdoor
Sending phishing emails
A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?
Capability
Infrastructure
Within the Diamond Model, the C2 server IP address is a physical or logical resource the adversary uses to communicate with and control victims, which is the Infrastructure vertex. Capability covers tools and malware, while Adversary and Victim are the other two vertices.
Adversary
Victim
You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?
Scan for known malware signatures
Update firewall rules for all known ports
Monitor for anomalous process execution patterns
Monitoring anomalous process execution patterns detects living-off-the-land abuse, where attackers wield native tools such as PowerShell, WMI or certutil instead of malware. This satisfies the stem's constraint by focusing on behavioural anomalies in legitimate binaries, mapping to ATT&CK's Execution and Defense Evasion tactics, rather than relying on signature-based indicators that such techniques deliberately avoid.
Focus on file hash blacklisting
When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?
Lateral Movement
Credential Access
Persistence
Defense Evasion
Process hollowing unmaps a legitimate process's memory and injects malicious code into that suspended host, so execution appears to originate from a trusted binary. This masquerading defeats host defences and analysts, placing the technique under Defense Evasion rather than Execution or Persistence.
Want more Cyber Threats And Attack Frameworks practice?
Practice this domainWhen hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?
Access to csrss.exe
Access to svchost.exe
Access to lsass.exe
Mimikatz extracts credentials by reading LSASS process memory, where Windows stores plaintext passwords, hashes and Kerberos tickets. Endpoint telemetry showing unusual processes opening lsass.exe with read access is therefore the strongest credential-dumping indicator during threat hunting.
Access to explorer.exe
A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?
Low volume of DNS failures
High volume of A record queries
Frequent SRV record updates
High volume of TXT record queries
DNS tunnelling exfiltrates data by encoding it in DNS queries, commonly abusing TXT records because they carry larger payloads. A high volume of TXT queries to unusual domains therefore signals tunnelling far more strongly than ordinary A or PTR lookups.
You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?
The connection is encrypted with an expired certificate
The client has been compromised
It indicates a specific C2 listener implementation
A JA3S fingerprint is the server-side TLS hello hash. A value unique to your environment and recurring across multiple hosts indicates one distinct server implementation, consistent with a specific C2 listener such as Cobalt Strike, rather than legitimate shared infrastructure.
It is a standard browser connection
An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?
root\default
root\security
root\cimv2
root\subscription
WMI persistence relies on `__EventFilter`, `__EventConsumer` and `__FilterToConsumerBinding` instances, all of which reside in the `root\subscription` namespace. Hunting there surfaces suspicious permanent event subscriptions, whereas default namespaces such as `root\cimv2` do not host these consumer classes.
During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?
System Event ID 7040
Microsoft-Windows-PowerShell/Operational ID 4104
Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log records script block logging, capturing the de-obfuscated script text after PowerShell decodes the Base64 -EncodedCommand payload. The engine log (400/800) only shows the encoded string, so 4104 is the provider that reveals actual content.
Application Event ID 1000
Security Event ID 4688
While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?
Standard deviation on interval deltas
Standard deviation on interval deltas exposes beaconing because consistent command-and-control check-ins produce uniformly small deltas, yielding a low deviation, whereas irregular human traffic scatters widely. This aggregation directly satisfies the stem's requirement to reveal periodicity in connection intervals within ELK Stack, surfacing the regularity that other functions obscure.
Sum aggregation on connection counts
Min/Max aggregation on bytes
Cardinality count on source IPs
Want more Threat Hunting And Detection practice?
Practice this domainWhen assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?
Planning and Direction
Planning and Direction sets the intelligence requirements and scope, defining which threat actors, such as specific APT groups, are relevant to the organisation. This stage directs subsequent collection and analysis, so identifying targeting APTs occurs here rather than during collection or dissemination.
Dissemination
Processing
Collection
You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?
STRIDE
MITRE ATT&CK
MITRE ATT&CK catalogues adversary tactics and techniques observed in real incidents, letting you map ransomware behaviour to specific internal controls and expose coverage gaps. Most modern threat-intelligence platforms natively support ATT&CK, satisfying the stem's requirement for a widely supported framework for technique-to-control mapping during impact analysis.
OSINT
CVSS
In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?
merge
lookup
join
The join operator correlates the indicator-of-compromise table with device telemetry on a shared key such as IP address or file hash, satisfying the requirement to fuse threat intelligence with log data for Living off the Land detection.
union
Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?
Technical
Operational
Tactical
Strategic
Strategic threat intelligence delivers high-level, long-term analysis of the threat landscape, risks and adversary trends. It is written for executives and management to guide budget allocation and risk decisions, unlike tactical or operational reports focused on indicators and TTPs.
You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?
Indicators of Compromise
Indicators of Compromise list concrete artefacts such as file hashes, domains, IP addresses and registry keys. Incident responders use these to search local systems and logs, determining whether the malware variant is actually present, which is the report section that enables local detection.
Threat Actor Attribution
Mitigation Strategy
Executive Summary
Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?
Commercial threat feed
A commercial threat feed is a push source: the vendor proactively delivers curated indicators and reports to the subscriber without the SOC requesting them. This contrasts with pull sources such as internal log queries or open-source lookups, satisfying the requirement for externally initiated intelligence delivery.
Internal log analysis
Packet capture
Manual web research
Want more Threat Intelligence IN SOC IR And Risk Management practice?
Practice this domainDuring the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?
To schedule routine penetration testing intervals across the enterprise network
To outline the budget allocation for commercial threat feed subscriptions
To establish automated firewall blocklists for known malicious IP addresses
To define specific information needs that support organizational decision-making and risk reduction
PIRs translate broad organisational priorities into specific, answerable intelligence questions that guide collection and analysis. Defining them during Requirements Planning ensures subsequent effort addresses decision-making and risk reduction rather than producing unfocused intelligence of no operational value.
A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?
Infrastructure
Capability
Capability is the Diamond Model vertex describing the adversary's tools, malware, and techniques — precisely the axis the analyst must scope. Infrastructure covers physical and logical assets such as C2 servers, while Victim and Adversary identify the parties, not the tradecraft employed.
Adversary
Victim
An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?
Immediately publish the raw telemetry to the corporate intranet without validation
Archive the RFI immediately as operational queries fall outside the scope of CTI
Triage, validate, and prioritize the RFI against established intelligence priorities
Triaging, validating and prioritising the RFI against established intelligence priorities is the required first action once a request enters the RFI management lifecycle, ensuring collection effort aligns with the direction phase's defined requirements before any tasking occurs. This satisfies the stem's constraint that the request concerns a newly observed malware strain requiring assessment against current priorities.
Initiate an immediate red-team attack campaign against the external supplier
An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?
Strategic Threat Intelligence Analyst
The Strategic Threat Intelligence Analyst interprets long-term threat trends and adversary intent, converting them into business risk language and prioritisation for executives and board members. This translation of high-level intelligence into strategic risk satisfies the stem's requirement for board-level reporting.
Vulnerability Assessor
Malware Reverse Engineer
Incident Responder
When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?
Elimination of the need for external commercial threat feeds
Standardization of intelligence processes and a unified view of organizational risk
A centralised team applies one set of collection, analysis and dissemination standards across all business units, producing a single consolidated risk picture rather than fragmented, inconsistent reporting. This coherence is the structural advantage over distributed analysts embedded in individual units.
Complete elimination of communication silos with local IT helpdesks
Faster deployment of endpoint agents on localized operational technology networks
An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?
Social media marketing agencies
Commercial real estate brokers
Consumer product retail vendors
Industry-specific ISACs and regulatory compliance bodies
Industry-specific ISACs and regulatory compliance bodies supply sector-tailored threat intelligence, attack patterns and reporting obligations that generic sources omit. Consulting them directly satisfies the stem's requirement for accurate sector-specific threat requirements, since these bodies coordinate real incidents and mandates within the organisation's own sector rather than broad, cross-industry data.
Want more Requirements Planning Direction And Review practice?
Practice this domainThe 312-85 exam has 50 questions and must be completed in 120 minutes. The passing score is 70%. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 8 domains: Data Analysis, Intelligence Reporting And Dissemination, Data Collection And Processing, Introduction TO Threat Intelligence, Cyber Threats And Attack Frameworks, Threat Hunting And Detection, Threat Intelligence IN SOC IR And Risk Management, Requirements Planning Direction And Review. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official EC-Council 312-85 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.