312-85 Exam Questions and Answers

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

You are configuring a TAXII 2.1 server to share threat indicators with a government partner. You need to ensure the connection enforces the transport-level security requirements for sensitive data exchange. Which setting must you verify in the TAXII configuration?

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

In Palo Alto Networks Cortex XSOAR, you are building a playbook to automate the qualification of incoming phishing alerts. Which integration command is used to calculate a 'reputation score' based on data from a connected threat intelligence platform (TIP)?

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?

You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?