312-85 Practice Test 10 — 10 Questions

Question 1

An analyst at a financial services firm receives a threat feed where each entry contains a 'confidence' field set to 85. The feed vendor's documentation states that confidence values are expressed as a percentage. The analyst needs to normalize this data before loading it into the internal threat intelligence platform, which accepts confidence on a 0-100 integer scale. Which action should the analyst take during processing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Map the value directly as an integer without modification.. The vendor's confidence is already expressed as a percentage on a 0-100 scale, and the destination platform accepts the same scale. Therefore, the analyst should map the value directly without transformation. This preserves the original meaning and avoids introducing errors that would occur with unnecessary scaling or field removal.

Answer

Convert the value to a decimal between 0 and 1 by dividing by 100.

Answer

Multiply the value by 10 to expand the scale to 0-1000 for finer granularity.

Answer

Discard the confidence field and rely solely on the indicator type for prioritization.

Question 2

Your SOC is building a threat intelligence program and the CISO asks which outputs should be delivered to the risk management team to support enterprise risk decisions. (Choose two.)

Accepted Answer

A heat map of control gaps mapped to the ATT&CK techniques used by those prioritized actors. Risk management consumes intelligence that expresses threat in likelihood and impact terms. A sector-relevant actor assessment tells the organization who is likely to attack and how damaging that would be, while a control gap heat map tied to those actors' ATT&CK techniques shows where exposure is concentrated. Together they support risk treatment, control investment, and residual risk acceptance decisions.

Answer

A log of every SIEM alert triggered in the past quarter, including false positives

Answer

Raw packet captures from the SOC's network sensors for the past 90 days

Answer

The full, unfiltered indicator feed from every commercial TI vendor under contract

Question 3

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Accepted Answer

Processing. Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.

Answer

Collection

Answer

Dissemination

Answer

Analysis

Question 4

A threat hunter is reviewing DNS query logs from a corporate recursive resolver to identify hosts that may be beaconing to a domain generation algorithm (DGA) family. The hunter notices that one workstation generates many queries for short, random-looking domains that all fail with NXDOMAIN, while another workstation generates far fewer queries but with a consistent subdomain string appended to a long-lived domain. Which observation most strongly indicates an active DGA-based beacon rather than normal application behavior?

Accepted Answer

A high volume of NXDOMAIN responses for algorithmically generated names from a single internal host.. DGA malware must try many generated domains before finding one the attacker registered, so the resolver sees a burst of NXDOMAIN answers for random-looking names from one host. Stable subdomains, private-space lookups, and popular resolving domains all occur in benign traffic, making them poor DGA indicators. Volume, randomness, and failure ratio together distinguish DGA beaconing.

Answer

Queries for popular public domains that resolve successfully and are repeated across many workstations.

Answer

A consistent subdomain string appended to a single long-lived domain queried at regular intervals.

Answer

Queries for domains that resolve to private RFC1918 address space from an internal host.

Question 5

A CTI team is developing a collection plan for a new intelligence requirement focused on ransomware groups targeting the healthcare sector. The team must select the most relevant sources to gather information on these groups' tactics, techniques, and procedures (TTPs). Which of the following sources would provide the most direct and actionable intelligence for this requirement?

Accepted Answer

Dark web forums and marketplaces where ransomware groups communicate and advertise.. Dark web forums and marketplaces are where ransomware groups plan and coordinate, making them a direct source for intelligence on their TTPs. Monitoring these hidden channels can yield actionable information such as new ransomware variants, exploit techniques, and targeting preferences. This source aligns closely with the requirement to understand ransomware groups targeting healthcare, enabling proactive defense.

Answer

Industry reports from healthcare associations on cybersecurity best practices.

Answer

Vulnerability databases such as the National Vulnerability Database (NVD).

Answer

Social media platforms like Twitter and LinkedIn for general cybersecurity discussions.

Question 6

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Accepted Answer

The timeliness of the intelligence.. Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.

Answer

The size of the vendor's marketing department.

Answer

The format of the document (PDF vs CSV).

Question 7

A financial institution's threat intelligence team is evaluating a new commercial feed. The team needs to determine if the feed provides 'actionable' intelligence. Which characteristic of the feed is most critical to this determination?

Accepted Answer

The feed provides context and recommended actions for each indicator.. Actionable intelligence requires context and recommended actions so that defenders can respond effectively. For a financial institution, this means the feed should explain why an indicator is malicious and suggest mitigations. Real-time updates, broad coverage, and long expiration periods are useful but insufficient without actionable guidance.

Answer

The feed covers a wide range of threat actors.

Answer

The feed is updated in real-time.

Answer

The feed includes indicators with long expiration periods.

Question 8

An analyst is using the MITRE ATT&CK framework to categorize adversary behaviors observed during an incident. The analyst notes that the attacker used a scheduled task to maintain access and also encrypted files on a file share to disrupt operations. Which two ATT&CK tactics do these behaviors represent? (Choose two.)

Accepted Answer

Persistence. The scheduled task used to maintain access maps to the Persistence tactic, as it allows the adversary to keep a foothold. Encrypting files on a file share to disrupt operations maps to the Impact tactic, specifically Data Encrypted for Impact. These two tactics accurately categorize the described behaviors, while Privilege Escalation, Defense Evasion, and Discovery are not supported by the scenario details.

Answer

Discovery

Answer

Privilege Escalation

Answer

Defense Evasion

Question 9

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

Accepted Answer

It enables the visualization of relationships between the four core components of an intrusion.. The Diamond Model of intrusion analysis organizes an intrusion into four core features: adversary, capability, infrastructure, and victim. Its primary benefit is that it visually maps the relationships among these components, helping analysts understand how an attack is structured and how different events are connected. This relational view supports threat intelligence correlation and hypothesis generation, which is why option A is correct.

Answer

It provides a vulnerability score for every asset.

Answer

It calculates the financial loss expectancy of a breach.

Answer

It replaces the need for SIEM log collection.

Question 10

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

Accepted Answer

The client requested an unsupported content-type in the Accept header.. A 406 error typically indicates that the media type requested in the Accept header is not supported by the TAXII server, often due to a mismatch between STIX versioning expectations.

Answer

The connection is blocked by a firewall ACL.

Answer

The API key provided for authentication is expired.

Answer

The TAXII discovery service endpoint is misconfigured.