312-85 Practice Test — Free Certified Threat Intelligence Analyst (312-85) Questions with Explanations

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

When hunting for malicious DLL side-loading, which file property is most critical to verify?

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?