312-85 Practice Test 10 — 10 Questions

Question 1

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

Accepted Answer

How changes in input variables affect the model's output.. Sensitivity analysis determines how changes in individual input variables (like threat probability or asset value) impact the overall final output or risk calculation.

Answer

Whether the threat actor has successfully exfiltrated data.

Answer

The total number of threat actors targeting the organization.

Answer

The cryptographic strength of the data being protected.

Question 2

Which TWO of the following are primary goals of conducting a threat modeling exercise on a new software application?

Accepted Answer

To define security requirements based on the risk profile.. Goals include identifying risks early and defining security requirements to mitigate those risks.

Answer

To provide a complete marketing brochure for the software.

Answer

To ensure the software meets the latest UI standards.

Answer

To replace the need for automated unit testing.

Question 3

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

Accepted Answer

In the TAXII client configuration settings.. Filtering by confidence levels is typically performed within the TAXII client configuration or via an API parameter defined by the threat feed provider.

Answer

At the firewall level.

Answer

By disabling the feed authentication.

Answer

By modifying the STIX schema.

Question 4

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. ALE = SLE x ARO. Since ALE = Probability x Impact, original ALE = 0.2 x $500,000 = $100,000. New probability is 0.1. 0.1 x $500,000 = $50,000.

Answer

$75,000

Answer

$100,000

Answer

$25,000

Question 5

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

Accepted Answer

It helps filter out random 'noise' to highlight consistent temporal patterns.. Rolling averages help identify underlying trends in noisy data, making periodic beaconing patterns more visible.

Answer

It increases the absolute volume of the data collected.

Answer

It eliminates the need for further traffic inspection.

Answer

It encrypts the log data for safer analysis.

Question 6

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

Accepted Answer

Damage. DREAD stands for Damage, Reproducibility, Exploitability, Affected users, and Discoverability.

Answer

Deployment

Answer

Detection

Answer

Data loss

Question 7

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Accepted Answer

Systematically testing evidence against every hypothesis.. Mitigating bias involves systematically analyzing evidence for all hypotheses and consciously searching for disconfirming information.

Answer

Assigning weights based on personal intuition.

Answer

Focusing only on the evidence that supports your primary theory.

Answer

Limiting the number of hypotheses to one.

Question 8

Which TWO methods are effective for visualizing threat actor TTPs within a CTI report?

Accepted Answer

Flow diagrams illustrating the attack execution sequence.. Mapping to frameworks (MITRE) and flow diagrams are the most effective ways to visualize TTPs.

Answer

A bibliography of all external sources.

Answer

A photograph of the threat actor.

Answer

A raw list of every log entry captured.

Question 9

When analyzing network traffic for C2 communication, which THREE anomalies are common indicators of malicious activity?

Accepted Answer

Unexpected use of common protocols like DNS or HTTP/S for data exfiltration.. Beaconing patterns, unusual protocol usage, and irregular traffic volume are classic indicators.

Answer

Standard web browsing traffic during working hours.

Answer

High volume of legitimate internal server traffic.

Question 10

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

Accepted Answer

Source IP blacklisting.. Automated scraping without respect for rate limits often leads to IP blacklisting by the source provider.

Answer

Lack of data encryption.

Answer

STIX version mismatch.

Answer

Data normalization failure.