312-85 Practice Test 11 — 15 Questions

Question 1

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IP addresses of the Command and Control servers used. In the Diamond Model of Intrusion Analysis, the four core nodes are Adversary, Capability, Infrastructure, and Victim. The Infrastructure node represents the physical or logical resources the adversary uses to deliver capabilities and maintain control — most commonly C2 servers, IP addresses, domains, and staging points. Since the question asks what belongs in Infrastructure, the IP addresses of the Command and Control servers are the correct fit.

Answer

The time of day the attack occurred

Answer

The specific malware hash used in the attack

Answer

The adversary's primary motivation

Question 2

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Accepted Answer

Delivering intelligence in a usable, timely format. Dissemination is the phase in the threat intelligence lifecycle where finished intelligence is delivered to the consumers who need it — in this case, the IR team — in a format and timeframe that makes it actionable. The key characteristics are timeliness, relevance, and usability: raw or unformatted intel is useless if responders cannot quickly parse it during an active incident. This phase bridges collection/analysis and operational action, ensuring the IR team receives indicators, context, and prioritization aligned to their response playbooks.

Answer

Defining incident response procedures

Answer

Validating the data source reliability

Answer

Archiving incident data

Question 3

You are conducting a threat intelligence analysis on a recent cyber espionage campaign. You have collected various data points and need to assess the credibility of the intelligence. Which two of the following factors are most critical in evaluating the reliability of the threat data? (Choose two.)

Accepted Answer

The source of the intelligence and its historical accuracy. The reliability of threat intelligence is primarily evaluated by the credibility of its source and the consistency of the data with other independent sources. Source reliability, including historical accuracy, and information credibility, such as technical depth and corroboration, are core principles of intelligence analysis, as codified in the Admiralty Code.

Answer

The number of times the intelligence has been shared on social media

Answer

The formatting and presentation style of the threat report

Answer

The color scheme used in the report's visualizations

Question 4

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Accepted Answer

Strategic Threat Intelligence Analyst. The Threat Intelligence Manager or Strategic Threat Analyst bridges the gap between technical threat indicators and business risk, ensuring executive leadership understands the strategic impact.

Answer

Vulnerability Assessor

Answer

Malware Reverse Engineer

Answer

Incident Responder

Question 5

A CTI analyst is conducting the direction phase for a new intelligence requirement focused on a persistent threat group targeting the organization's financial systems. The analyst must define the Essential Elements of Information (EEI) to guide collection. Which of the following best describes the purpose of EEIs in this context?

Accepted Answer

They outline the critical information gaps that must be filled to satisfy the intelligence requirement.. EEIs are the specific information requirements that must be satisfied to answer a broader intelligence requirement. They help analysts focus collection and analysis on the most critical unknowns. In this case, identifying the gaps about the threat group's methods and targets ensures that the intelligence produced is relevant and actionable for protecting financial systems.

Answer

They provide a prioritized list of intelligence consumers and their respective information needs.

Answer

They establish the timeline and milestones for delivering intelligence products to stakeholders.

Answer

They specify the exact data fields and sources required to answer the intelligence requirement.

Question 6

A CTI analyst is developing a collection plan to support a new intelligence requirement on ransomware targeting the healthcare sector. The analyst needs to identify the most appropriate type of collection to gather information on ransomware variants and their tactics. Which of the following collection sources is best suited for this requirement?

Accepted Answer

Open-source intelligence (OSINT) from healthcare industry reports and ransomware tracking blogs.. OSINT is the most suitable collection source because it leverages publicly available reports and analyses from healthcare organizations and security researchers, providing timely and relevant information on ransomware variants and tactics. It is accessible, cost-effective, and directly addresses the requirement without the risks or limitations of other intelligence disciplines.

Answer

Human intelligence (HUMINT) from undercover agents within ransomware groups.

Answer

Imagery intelligence (IMINT) from satellite reconnaissance of ransomware infrastructure.

Answer

Signals intelligence (SIGINT) from intercepted communications of ransomware operators.

Question 7

A threat intelligence manager is briefing new analysts on the differences between strategic, operational, and tactical intelligence. Which TWO of the following products are best characterized as strategic intelligence? (Choose two.)

Accepted Answer

A board-level brief on how a new data residency regulation could change the organization's exposure and intelligence priorities.. Strategic intelligence serves executive decision-making over long horizons, connecting threat trends to policy, regulation, budget, and risk appetite. The year-ahead geopolitical assessment and the board-level regulatory brief both operate at that altitude. Campaign infrastructure mapping, tactical indicator feeds, and weekly sector exploitation summaries support near-term defensive action, which places them in the operational or tactical tiers rather than the strategic one.

Answer

A report mapping a specific adversary's current campaign infrastructure to help the SOC tune detection rules this quarter.

Answer

A weekly summary of exploited vulnerabilities observed in the organization's industry sector.

Answer

A daily feed of newly observed malware hashes and command-and-control domains pushed to the SIEM.

Question 8

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

Accepted Answer

Commercial threat feed. A commercial threat feed is a classic 'push' source because the vendor proactively delivers indicators and reports to the subscriber without the subscriber having to request each item — data flows outward from provider to consumer. Push sources are characterized by automated, scheduled, or real-time delivery of curated intelligence, often via API, TAXII, or email. This contrasts with pull sources, where the analyst must actively query or retrieve data.

Answer

Internal log analysis

Answer

Packet capture

Answer

Manual web research

Question 9

An intelligence analyst is preparing a report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report contains threat indicators and analysis. Which TWO of the following are required to ensure proper TLP handling and dissemination? (Choose two.)

Accepted Answer

Ensure the recipient has a need to know and is authorized to receive information at that TLP level.. Proper TLP handling requires clear marking of the TLP level and ensuring recipients are authorized and have a need to know. These two actions are fundamental to comply with TLP and prevent unauthorized disclosure. Encryption, disclaimers, and written permission are not TLP requirements and may be additional measures depending on the situation.

Answer

Include a disclaimer that the information is provided 'as is' without warranty.

Answer

Obtain written permission from the original source before sharing with the partner.

Answer

Encrypt the report using PGP before sending it via email.

Question 10

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

Accepted Answer

Event ID 4768 with pre-auth not required. AS-REP Roasting targets accounts configured with 'Do not require Kerberos preauthentication.' When pre-auth is disabled, an attacker can send an AS-REQ without proving identity, and the domain controller responds with an AS-REP containing a ticket encrypted with the user's password hash — which the attacker can crack offline. The corresponding DC event is Event ID 4768 (Kerberos authentication ticket TGT requested), and the key indicator is the pre-authentication type field showing that pre-auth was not required.

Answer

Event ID 4771

Answer

Event ID 4624

Answer

Event ID 4769

Question 11

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Accepted Answer

Capability. In the Diamond Model, the four core vertices are Adversary, Capability, Infrastructure, and Victim. Capability represents the tools and techniques (TTPs) used by the adversary.

Answer

Infrastructure

Answer

Adversary

Answer

Victim

Question 12

You are analyzing a threat actor that consistently registers look-alike domains resembling your organization's partners and sends spear-phishing emails from those domains to your finance team. According to the Diamond Model of Intrusion Analysis, how should the adversary's use of these domains be classified?

Accepted Answer

As the Infrastructure component of the model, because the domains are resources the adversary uses to deliver the attack and maintain control.. The Diamond Model classifies adversary-controlled resources such as domain names, IP addresses, and servers as Infrastructure. Look-alike domains registered by the threat actor to impersonate partners are used to deliver phishing emails and potentially host command-and-control, making them part of the adversary's infrastructure rather than a capability, victim, or the adversary itself.

Answer

As the Adversary component of the model, because the domains are operated by the threat actor.

Answer

As the Victim component of the model, because the finance team members are the targets who receive the emails.

Answer

As the Capability component of the model, because the domains are the functional tools that enable the phishing attack to succeed.

Question 13

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

Accepted Answer

Ensuring the intelligence is delivered effectively to the target audience. Dissemination is the phase of the threat intelligence lifecycle where finished intelligence is delivered to the appropriate consumers — executives, SOC analysts, incident responders — in a format and timeframe that supports their decisions. It ensures the right intelligence reaches the right audience with the right context, whether through reports, feeds, or briefings. Without effective dissemination, even high-quality analysis delivers no value.

Answer

Analyzing the data collected

Answer

Collecting data from the dark web

Answer

Developing new security tools

Question 14

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Accepted Answer

Planning and Direction. The Planning and Direction phase of the intelligence cycle is where the organization defines its intelligence requirements, including identifying which threat actors (e.g., specific APT groups) are likely to target it. This drives the collection and analysis that follow. Determining whether you are a target for a specific APT is a requirements-setting activity, which belongs here.

Answer

Dissemination

Answer

Processing

Answer

Collection

Question 15

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

Accepted Answer

To prevent false positives from blocking legitimate traffic. Vetting is the quality-control step in the threat intelligence lifecycle where raw indicators are checked for accuracy, relevance, and context before operational use. Its primary purpose is to filter out false positives — such as shared IPs from CDNs, cloud providers, or sinkholes — so that blocking them does not disrupt legitimate business traffic. This protects availability while preserving the value of the feed.

Answer

To reduce the volume of indicators for storage

Answer

To increase the threat score of each IP

Answer

To format the IP addresses into CIDR blocks