312-85 Practice Test 12 — 15 Questions

Question 1

A threat hunter is examining network traffic to identify potential command-and-control (C2) communication. Which characteristic of the traffic is most indicative of a C2 channel using HTTP?

Accepted Answer

Regular, periodic beaconing with consistent intervals. C2 communication often exhibits beaconing, where the malware periodically contacts the C2 server at regular intervals. This regular timing is a hallmark of automated C2 frameworks like Cobalt Strike or Metasploit. While other characteristics like encryption or port usage can be present, beaconing is the most consistent and specific indicator. Hunters should analyze network flow data for periodic connections to external hosts, especially those with consistent intervals and small data transfers.

Answer

Use of standard ports like 80 and 443

Answer

Encrypted payloads with self-signed certificates

Answer

Large outbound data transfers to a single external IP

Question 2

You are analyzing a large set of security events to identify patterns of malicious activity. You decide to use a pivot table to summarize the data by source IP and event type. Which of the following is the primary benefit of using pivot tables in threat data analysis?

Accepted Answer

They allow quick summarization and cross-tabulation of large datasets to reveal patterns.. Pivot tables allow analysts to quickly summarize and cross-tabulate large datasets, revealing patterns and relationships between variables such as source IP and event type. This helps in threat hunting by making it easier to spot anomalies and prioritize investigations. They are a fundamental tool for exploratory data analysis in threat intelligence.

Answer

They encrypt sensitive data to ensure compliance.

Answer

They automatically detect and block malicious IP addresses.

Answer

They provide real-time streaming analytics for continuous monitoring.

Question 3

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

Accepted Answer

type. In STIX 2.1, every STIX Object, including the File SCO (Cyber Observable Object), must have a 'type' property that specifies the kind of object it is. For a File object, the value of 'type' is fixed as 'file'. This field is mandatory and serves as the discriminator that tells parsers and tools how to interpret the rest of the object's properties. Without it, the object cannot be validated or processed correctly.

Answer

name

Answer

spec_version

Answer

hashes

Question 4

A threat intelligence analyst is collecting data from a paste site that frequently removes posts within hours. The analyst wants to preserve the content for later analysis and ensure that the original source can be verified even if the post is deleted. Which collection practice best meets these requirements?

Accepted Answer

Capture the page content along with a timestamped hash and store the raw artifact with provenance metadata.. Ephemeral sources require immediate preservation of the raw artifact with verifiable provenance. Capturing content, a timestamped hash, and metadata such as URL and collection time ensures the data can be analyzed later and its origin verified even after deletion. Extracting only indicators or relying on screenshots loses the verifiability and context needed for intelligence work.

Answer

Copy only the indicator values into a spreadsheet and discard the surrounding page content to save space.

Answer

Take screenshots of the page and rely on the image files as the primary record of collection.

Answer

Set up a monitoring alert that notifies the analyst if the paste site removes the post in the future.

Question 5

A risk manager asks you to provide threat intelligence that helps prioritize patching efforts for a newly disclosed vulnerability in your internet-facing VPN appliance. Which type of intelligence is most relevant for this request?

Accepted Answer

Operational intelligence on campaigns targeting VPN appliances, including exploitation status. Operational intelligence is most relevant because it provides current information on whether the VPN vulnerability is being actively exploited in campaigns, by which actors, and with what urgency. This directly informs patching prioritization by adding threat context to severity. Strategic, tactical, and technical intelligence each provide different pieces but do not alone answer the question of active exploitation risk.

Answer

Strategic intelligence on the geopolitical motivations of threat actors exploiting VPNs

Answer

Technical intelligence detailing the vulnerability's CVSS score and patch availability

Answer

Tactical intelligence listing IP addresses of known exploit attempts

Question 6

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

Accepted Answer

Timeliness. Timeliness (B) is essential because an IOC loses operational value as the threat evolves; indicators must be current enough to detect active adversary activity before the associated infrastructure or malware is retired. Relevance (C) is essential because an IOC must pertain to the organization's industry, technologies, geography, or threat model to be actionable rather than generating noise. Accuracy (E) is essential because a false or unverified indicator produces false positives, wastes analyst time, and can erode trust in the intelligence-sharing program. File Size (A) is not a quality criterion for an IOC, since size alone says nothing about whether the indicator is valid or useful, and Vendor Popularity (D) is irrelevant because the reputation of a source does not guarantee the indicator's timeliness, relevance, or accuracy.

Answer

File Size

Answer

Vendor Popularity

Question 7

You are a CTI analyst preparing a weekly intelligence summary for your organization's executive leadership. The report will include a high-level overview of the current threat landscape, key risks, and recommended strategic actions. To ensure the report is actionable and aligns with the audience's needs, which of the following should be the primary focus of the report?

Accepted Answer

An overview of key threats, their potential business impact, and strategic recommendations for risk mitigation.. Executive reports should focus on strategic intelligence: the threat landscape, business impact, and recommendations. Technical details like IOCs or TTPs are for tactical teams. The goal is to enable executives to make informed decisions about risk management and resource allocation, not to provide operational data.

Answer

A comprehensive list of all vulnerabilities discovered in the organization's infrastructure during the past week.

Answer

A summary of threat actor tactics, techniques, and procedures (TTPs) with mitigation steps for security operations.

Answer

Detailed technical indicators of compromise (IOCs) such as IP addresses and file hashes.

Question 8

A threat intelligence analyst is preparing to ingest a new threat feed that provides indicators in STIX 2.1 format. Before ingestion, the analyst must ensure the data is properly structured and can be processed by the TIP. Which of the following are valid steps to prepare the STIX 2.1 data for ingestion? (Choose two.)

Accepted Answer

Check that all objects have a unique ID and that relationships reference existing objects. Before ingesting STIX 2.1 data, analysts should validate the bundle against the official JSON schemas to ensure structural conformity, and verify that all objects have unique IDs and that relationships reference existing objects. These steps guarantee the data is well-formed and internally consistent, which prevents ingestion errors and ensures the TIP can process the indicators correctly. Other actions like encryption or manual review are not part of the structural preparation for STIX ingestion.

Answer

Manually review each indicator to ensure it is not a false positive

Answer

Convert all STIX patterns to regular expressions for compatibility with legacy systems

Answer

Encrypt the STIX bundle using AES-256 before ingestion to protect sensitive data

Question 9

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

Accepted Answer

JSON Schema Validator.. JSON Schema validation is the standard method for verifying the structure and types of JSON data.

Answer

Netstat.

Answer

Nmap.

Answer

Wireshark.

Question 10

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Accepted Answer

Monitor for anomalous process execution patterns. Because they use legitimate tools, you must focus on behavioral detection (Tactic-Technique-Procedure analysis) rather than signature-based file detection.

Answer

Scan for known malware signatures

Answer

Update firewall rules for all known ports

Answer

Focus on file hash blacklisting

Question 11

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Accepted Answer

Enrichment with context. During the Processing phase of the intelligence cycle, raw collected data is converted into a usable, standardized form, so enrichment with context (B) is correct because adding contextual metadata such as source reputation, geolocation, timestamps, or threat actor associations increases the value and interpretability of the data. Normalization of data formats (C) is correct because converting disparate formats (for example, timestamps to a common standard like ISO 8601 or IP addresses to a consistent notation) enables correlation and comparison across sources. Deduplication of entries (D) is correct because removing redundant records reduces noise, storage overhead, and analyst confusion, directly improving data quality and integrity. Physical media scanning (A) belongs to the Collection phase, where data is actually gathered from sources, not processed. Executive sign-off (E) is a management/approval activity that occurs outside the technical Processing phase and does not contribute to data quality.

Answer

Physical media scanning

Answer

Executive sign-off

Question 12

During an incident response engagement, a threat intelligence analyst observes that the adversary used a compromised employee's VPN credentials to access the corporate network, and then moved laterally to other systems using legitimate administrative tools. The analyst wants to map these actions to the MITRE ATT&CK framework. Which tactic best describes the initial use of valid VPN credentials?

Accepted Answer

Initial Access. The initial use of compromised VPN credentials to access the corporate network is an example of the Valid Accounts technique under the Initial Access tactic. Initial Access describes how adversaries gain an entry point, and using legitimate credentials is a common method. Lateral Movement, Persistence, and Privilege Escalation describe subsequent phases, not the initial entry.

Answer

Persistence

Answer

Privilege Escalation

Answer

Lateral Movement

Question 13

A SOC analyst receives a threat intelligence report indicating that a new phishing campaign is targeting your industry with a specific malicious domain. The analyst wants to quickly check if any internal hosts have communicated with that domain. Which action should the analyst take first?

Accepted Answer

Search historical DNS and proxy logs for the malicious domain. The first step is to determine if any internal hosts have already communicated with the malicious domain. Searching historical DNS and proxy logs provides that answer quickly using existing data. Blocking, sandboxing, and creating future alerts are all useful but secondary to identifying current exposure. This approach aligns with the incident response principle of detection before containment.

Answer

Submit the domain to a public sandbox for dynamic analysis

Answer

Block the domain at the firewall and update the SIEM watchlist

Answer

Create a new SIEM correlation rule to alert on future connections to the domain

Question 14

A threat intelligence analyst is supporting an incident response team during an active ransomware outbreak. The IR team needs to know if the ransomware strain has been observed using a specific lateral movement technique. Which action should the analyst take to provide the most actionable intelligence?

Accepted Answer

Search a threat intelligence platform for the ransomware family and its associated TTPs. During an active ransomware incident, the IR team needs specific, timely intelligence about the threat actor's known behaviors. A threat intelligence platform provides curated reports and TTP mappings for ransomware families, allowing the analyst to confirm whether a lateral movement technique is associated with the strain. This directly informs hunting and containment decisions, unlike internal logs or generic frameworks.

Answer

Submit the ransomware sample to a public sandbox and wait for the report

Answer

Query the internal SIEM for historical alerts related to the technique

Answer

Review the MITRE ATT&CK framework for all known lateral movement techniques

Question 15

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

Accepted Answer

Tactical Intelligence. Tactical intelligence focuses on immediate, actionable technical indicators — file hashes, IP addresses, domain names, and URLs — that defenders use to detect and block threats in the short term. It is the layer of CTI that feeds SIEM rules, IDS signatures, and blocklists, and it is what most SOC analysts consume daily.

Answer

Financial Intelligence

Answer

Operational Intelligence

Answer

Strategic Intelligence