312-85 Practice Test 11 — 15 Questions

Question 1

When performing quantitative analysis, which THREE of the following are necessary to calculate the Annualized Loss Expectancy (ALE)?

Accepted Answer

Single Loss Expectancy (SLE). ALE = SLE x ARO. SLE is calculated by Asset Value x Exposure Factor.

Answer

Employee performance ratings.

Answer

Total cost of the organization's office space.

Question 2

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Accepted Answer

A list of identified threats categorized by type.. Documentation must define the scope of the system and the potential threats identified against that scope.

Answer

The budget allocated for the security team.

Answer

The employee handbook for the IT department.

Answer

A list of all employees with admin access.

Question 3

Which TWO of the following are recognized categories of threat intelligence sources?

Accepted Answer

Open Source Intelligence (OSINT).. Threat intelligence sources are generally categorized into open-source (OSINT) and closed/proprietary sources.

Answer

Local User Logs.

Answer

Internal Hardware Inventory.

Answer

Network Topology Maps.

Question 4

Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?

Accepted Answer

The TIP requires a schema transformation for STIX 1.x to 2.x. STIX 2.x is not backward compatible with STIX 1.x due to significant changes in the JSON structure and object models.

Answer

The feed is missing the mandatory TAXII headers

Answer

The feed contains invalid XML tags

Answer

STIX 1.2 does not support JSON format

Question 5

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Accepted Answer

To represent the organization or individual performing or being targeted by an activity. The Identity object identifies the victim or the perpetrator, providing context on who is being targeted or who is performing the action.

Answer

To list the malware families used

Answer

To define the technical infrastructure of the attacker

Answer

To provide the IP addresses of the C2

Question 6

Which of the following is an example of 'structured' threat intelligence data?

Accepted Answer

A STIX 2.1 JSON file.. STIX/TAXII provides a machine-readable, structured format for intelligence.

Answer

An email body.

Answer

A handwritten note.

Answer

A PDF report from a vendor.

Question 7

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Accepted Answer

Define specific PIRs regarding third-party software vendors and update frequency. Refining requirements involves transforming abstract topics into measurable intelligence needs (Priority Intelligence Requirements).

Answer

Ignore the request until more data is available

Answer

Purchase all available supply chain threat reports

Answer

Automate the collection of all supply chain news

Question 8

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

Accepted Answer

TAXII. TAXII (Trusted Automated eXchange of Intelligence Information) is the application-layer protocol designed specifically to transport STIX information.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 9

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

Accepted Answer

Lack of standardized formatting.. Data volume, lack of standardization, and quality/noise are the most significant hurdles in intelligence ingestion.

Answer

Lack of internet access.

Answer

Defaulting to TLP:CLEAR.

Question 10

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

Accepted Answer

The object ID (UUID).. The 'pattern' or 'hash' (if applicable) or a unique 'external_id' are common identifiers, but 'id' in STIX is the unique object identifier.

Answer

The file size.

Answer

The source name.

Answer

The timestamp of ingestion.

Question 11

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Accepted Answer

Standardizing time formats (e.g., UTC).. Normalization involves mapping diverse data to a common schema and standardizing fields like time and identity.

Answer

Deleting all historical data.

Answer

Increasing the firewall throughput.

Answer

Disabling API authentication.

Question 12

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

Accepted Answer

Apply the TLP marking to the document. The TLP (Traffic Light Protocol) is the globally accepted standard for communicating intelligence sensitivity and sharing boundaries.

Answer

Send the report via an encrypted channel

Answer

Password protect the document

Answer

Use a disclaimer at the bottom of the email

Question 13

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

Accepted Answer

Malware Hashes. Tactical intelligence is focused on immediate, technical indicators that can be used to stop an attack, such as IOCs and malware hashes.

Answer

Geopolitical threat assessments

Answer

Executive risk summaries

Answer

Industry trend analysis

Question 14

Which of the following is a 'pull-based' method of threat intelligence data collection?

Accepted Answer

TAXII Poll.. A TAXII client requesting data from a TAXII server (Poll) is a pull-based method.

Answer

Webhook notifications.

Answer

Email distribution lists.

Answer

RSS feeds.

Question 15

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

Accepted Answer

Validate the JSON bundle against the STIX 2.1 schema. Validating the JSON schema against the STIX 2.1 specification is the definitive way to identify structural inconsistencies in the received bundle.

Answer

Restart the TAXII server service

Answer

Check the TLS certificate expiration date

Answer

Check the firewall rules for port 443