Reinforce 312-85 concepts with active-recall study cards covering all 8 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For 312-85 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the 312-85 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your 312-85 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real 312-85 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass 312-85.
Sample cards from the 312-85 flashcard bank. Read the question, think of the answer, then read the explanation below.
When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?
Calculate the Z-score of the timestamp distribution.
The Z-score measures how many standard deviations a data point is from the mean, making it the appropriate statistical measure to determine if outliers are significant relative to the normal distribution. A high absolute Z-score (typically >3) indicates a statistically significant outlier that may warrant changes to threat modeling.
You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?
Validate the JSON bundle against the STIX 2.1 schema
When one platform receives a STIX 2.1 bundle but fails to parse it, the most likely cause is a malformed or non-conformant JSON structure. Validating the bundle against the STIX 2.1 JSON schema (B) will reveal missing required properties, incorrect object types, or invalid pattern syntax, which are the typical reasons a parser rejects a bundle even though transport succeeded.
When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?
type
In STIX 2.1, every STIX Object, including the File SCO (Cyber Observable Object), must have a 'type' property that specifies the kind of object it is. For a File object, the value of 'type' is fixed as 'file'. This field is mandatory and serves as the discriminator that tells parsers and tools how to interpret the rest of the object's properties. Without it, the object cannot be validated or processed correctly.
You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?
The IP addresses of the Command and Control servers used
In the Diamond Model of Intrusion Analysis, the four core nodes are Adversary, Capability, Infrastructure, and Victim. The Infrastructure node represents the physical or logical resources the adversary uses to deliver capabilities and maintain control — most commonly C2 servers, IP addresses, domains, and staging points. Since the question asks what belongs in Infrastructure, the IP addresses of the Command and Control servers are the correct fit.
During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?
Weaponization
The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.
When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?
Access to lsass.exe
Mimikatz is a credential-dumping tool that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Its primary target is the Local Security Authority Subsystem Service (lsass.exe), which stores credential material in Windows. Therefore, the most common indicator of credential dumping is a process accessing lsass.exe memory, often via OpenProcess with PROCESS_VM_READ and ReadProcessMemory calls.
When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?
Planning and Direction
The Planning and Direction phase of the intelligence cycle is where the organization defines its intelligence requirements, including identifying which threat actors (e.g., specific APT groups) are likely to target it. This drives the collection and analysis that follow. Determining whether you are a target for a specific APT is a requirements-setting activity, which belongs here.
During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?
To define specific information needs that support organizational decision-making and risk reduction
Priority Intelligence Requirements (PIRs) are the specific, decision-relevant intelligence questions that drive collection and analysis. Defining them during Requirements Planning ensures the CTI program produces intelligence that supports organizational decision-making and risk reduction, rather than unfocused data gathering.
The 312-85 flashcard bank covers all 8 official blueprint domains published by EC-Council. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Data Analysis
Intelligence Reporting And Dissemination
Data Collection And Processing
Introduction TO Threat Intelligence
Cyber Threats And Attack Frameworks
Threat Hunting And Detection
Threat Intelligence IN SOC IR And Risk Management
Requirements Planning Direction And Review
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that 312-85 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.312-85 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective 312-85 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free 312-85 flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 350+ original 312-85 flashcards across all 8 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official EC-Council exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official 312-85 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included