312-85 Practice Test 1 — 10 Questions

Question 1

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence (D) is the ATT&CK tactic explicitly defined as techniques adversaries use to keep access to systems across restarts, changed credentials, or other interruptions, making it the core answer for maintaining a presence. Privilege Escalation (E) is commonly involved because adversaries need higher-level permissions (e.g., SYSTEM or root) to install durable persistence mechanisms such as services, scheduled tasks, or registry Run keys that survive reboots. Defense Evasion (C) is also involved because maintaining a foothold requires hiding artifacts and activity from security tools, for example by disabling logging, obfuscating scripts, or masquerading as legitimate processes. Exfiltration (A) is about stealing data out of the environment and does not itself maintain access, and Reconnaissance (B) is information gathering before compromise, so neither belongs to the persistence-focused tactics.

Answer

Exfiltration

Answer

Reconnaissance

Question 2

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

Accepted Answer

Map the adversary's behavior to specific techniques and sub-techniques, such as Spearphishing Attachment or Exploit Public-Facing Application.. The MITRE ATT&CK framework is most useful when adversary behavior is mapped to specific techniques and sub-techniques, which describe concrete actions like Exploit Public-Facing Application or Spearphishing Attachment. This level of detail enables defenders to identify relevant detection strategies and mitigations, whereas higher-level tactics or atomic indicators provide less actionable context.

Answer

Map the adversary to a known threat group profile, such as APT29, based on the use of a novel exploit.

Answer

Map the adversary's actions to the highest-level tactics, such as initial access and execution, without detailing techniques.

Answer

Map the specific malware hashes and exploit file names directly to ATT&CK technique IDs.

Question 3

You are a CTI analyst tasked with creating a threat intelligence report for your organization's security operations center (SOC). The SOC team needs to quickly detect and respond to a newly identified adversary campaign. Which two elements are most critical to include in this report? (Choose two.)

Accepted Answer

MITRE ATT&CK techniques and tactics used by the adversary.. IOCs and MITRE ATT&CK techniques are critical for SOC detection and response. IOCs provide specific artifacts to hunt for, while ATT&CK mappings describe adversary behaviors, enabling comprehensive defense. Other elements like geopolitical context or policy recommendations are valuable for different audiences but do not directly support the SOC's operational needs.

Answer

Recommendations for strategic policy changes to the board.

Answer

A detailed narrative of the adversary's geopolitical motivations.

Answer

A comprehensive list of all threat actors known to use similar TTPs.

Question 4

A hunter is reviewing Zeek conn.log and notices long-lived, low-volume TLS sessions from several internal workstations to the same external IP on port 443 where the server certificate is self-signed, the JA3S value is identical across all sessions, and the byte counts are almost symmetric over hours. The workstations show no matching DNS queries for that IP and no proxy logs because the traffic bypasses the proxy. Which hypothesis best fits this evidence?

Accepted Answer

The pattern is consistent with beaconing to hard-coded C2 infrastructure using a custom TLS profile, and the hunter should pivot on the JA3S value and destination IP.. Direct-to-IP TLS with a self-signed certificate, a uniform JA3S fingerprint, and steady low-volume symmetric sessions indicates a beacon using a custom TLS profile. Pivoting on the server fingerprint and destination IP lets the hunter find other affected hosts and confirm the campaign before remediation.

Answer

The traffic represents normal HTTPS browsing because port 443 is used and the sessions are encrypted end to end.

Answer

A sanctioned software update service is being reached over a direct TLS channel that bypasses the proxy by design.

Answer

The sessions indicate a misconfigured internal service because self-signed certificates are only used inside an organization's own address space.

Question 5

A hunter is investigating anomalous DNS activity on an internal resolver. Several endpoints are issuing high volumes of queries for long, random-looking subdomains under a single registered domain, with responses that are mostly NXDOMAIN but occasionally resolve. Which TWO detection approaches would most effectively confirm whether this is DNS tunneling or domain generation algorithm activity? (Choose two.)

Accepted Answer

Correlate the timing and volume of queries with the process that initiated them using endpoint DNS client event telemetry.. Confirming DNS tunneling or DGA activity requires both statistical characterization of the query names and attribution to the originating process. Measuring query length and entropy against a per-endpoint baseline exposes algorithmically generated or encoded names, while endpoint DNS client telemetry ties those queries to the specific binary responsible. Together these methods produce defensible evidence rather than relying on blocklists.

Answer

Review the resolver's cache hit ratio and increase the TTL on all cached records to reduce query volume.

Answer

Search the SIEM for the registered domain across historical proxy logs and add it to a watchlist if it appears in any HTTP request.

Answer

Block all outbound DNS at the perimeter and force every endpoint to use DNS over HTTPS to a public resolver.

Question 6

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

Accepted Answer

root\subscription. The root\subscription namespace is the correct focus because it is the dedicated WMI repository location where permanent event subscriptions are stored. Attackers use this namespace to create __EventFilter, __EventConsumer, and __FilterToConsumerBinding instances that persist across reboots, enabling fileless persistence and code execution. Unlike transient subscriptions that exist only in memory, these permanent subscriptions reside in root\subscription and are automatically reinstated by the WMI service at startup, making them a prime hunting ground for suspicious event consumers.

Answer

root\default

Answer

root\security

Answer

root\cimv2

Question 7

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Accepted Answer

Information on exploit frameworks, payload construction tools, and customized delivery mechanisms used by target threat groups. Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.

Answer

Phishing email headers received by internal mail servers from external domains

Answer

File hashes and indicators associated with credential dumping tools like Mimikatz

Answer

Network traffic logs showing data exfiltration over encrypted channels

Question 8

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

Accepted Answer

The object ID (UUID).. In STIX, every object has a globally unique id in the form -- (e.g., malware--a1b2c3d4-...). When comparing two 'malware' objects, the object ID (UUID) is the canonical unique identifier — if the IDs match, they are the same object; if they differ, they are distinct objects (even if names or hashes overlap). This is the most reliable deduplication key.

Answer

The file size.

Answer

The source name.

Answer

The timestamp of ingestion.

Question 9

A security operations center (SOC) receives an alert about a workstation exhibiting unusual outbound traffic to a known malicious IP address. The analyst suspects the workstation is compromised and communicating with a command-and-control (C2) server. According to the Cyber Kill Chain, which phase does this activity represent?

Accepted Answer

Command and Control. In the Cyber Kill Chain, Command and Control is the phase where the adversary establishes a communication channel with compromised systems. The outbound traffic to a known malicious IP is a beacon, indicating the workstation is checking in with a C2 server. This activity is distinct from earlier phases like Weaponization or Exploitation, and precedes Actions on Objectives.

Answer

Actions on Objectives

Answer

Weaponization

Answer

Exploitation

Question 10

An analyst is reviewing a threat intelligence report that includes a list of IP addresses, domain names, and file hashes associated with a recent campaign. The report states that these indicators were observed on multiple victim networks over the past month. What is the most appropriate first step before using these indicators in detection rules?

Accepted Answer

Validate the indicators against internal telemetry and external reputation sources, and assess their relevance.. Before operationalizing indicators, an analyst should validate them against internal telemetry and external reputation sources. This confirms whether the indicators are present in the environment, whether they remain active, and whether they are relevant to the organization's threat profile. Validation also helps distinguish true positives from false positives and provides context for tuning detection rules, reducing disruption and improving the effectiveness of subsequent controls.

Answer

Add the indicators to a watchlist and take no further action until an alert fires.

Answer

Publish the indicators to an open-source threat feed to help the community.

Answer

Immediately block all listed IP addresses and domains at the perimeter firewall.