312-85 Practice Test 13 — 15 Questions

Question 1

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the industry-standard framework for mapping adversarial techniques and identifying gaps in security controls.

Answer

STRIDE

Answer

OSINT

Answer

CVSS

Question 2

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

Accepted Answer

Executive Leadership and Risk Management (CISO, CRO). Executive Leadership and Risk Management (CISO, CRO) (B) must be engaged because they own the risk appetite, budget authority, and governance decisions that shape CTI requirements and priorities, ensuring the program aligns with organizational risk tolerance and regulatory obligations. SOC managers (C) are essential stakeholders since they are the primary consumers of CTI, and their detection, monitoring, and triage workflows define the intelligence requirements, formats, and timeliness needed for operational use. Incident Response team leads (D) must be involved because IR uses CTI during investigations and containment, so their feedback on indicators, threat context, and reporting cadence directly drives requirements during planning and review. The remaining options do not belong: residential landscaping contractors (A) and external catering service providers (E) have no role in cybersecurity intelligence requirements, governance, or incident handling, making them irrelevant to CTI stakeholder engagement.

Answer

Residential landscaping contractors

Answer

External catering service providers

Question 3

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Accepted Answer

To represent the organization or individual performing or being targeted by an activity. In STIX 2.x, the Identity object represents an actual individual, organization, or group — it is used to attribute who is performing an activity (e.g., a threat actor group) or who is being targeted (e.g., a victim organization). When you see an Identity object linked to a Campaign via a 'attributed-to' or 'targets' relationship, it identifies the actor or victim, not the malware or infrastructure.

Answer

To list the malware families used

Answer

To define the technical infrastructure of the attacker

Answer

To provide the IP addresses of the C2

Question 4

You are analyzing a malware sample that communicates with a command-and-control (C2) server. The network traffic shows periodic HTTP GET requests to a domain that resolves to multiple IP addresses, and the User-Agent string is identical across all requests. Which of the following analytical techniques would best help you identify the infrastructure and potential attribution of the threat actor?

Accepted Answer

Passive DNS analysis to map historical domain-to-IP resolutions.. Passive DNS analysis provides historical mappings of domain-to-IP resolutions, which is essential when a domain resolves to multiple IPs. This helps identify infrastructure patterns like fast flux and can link to other domains used by the same actor. It supports attribution by revealing the broader C2 infrastructure, which is more valuable than static or dynamic analysis alone in this scenario.

Answer

Reviewing the User-Agent string against known malware families.

Answer

Sandbox execution to observe the malware's behavior in a controlled environment.

Answer

Static malware analysis to extract embedded strings and configuration.

Question 5

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

Accepted Answer

Analyzing threat actor campaigns, motivations, and Tactics, Techniques, and Procedures (TTPs). Option C is correct because a core function of a dedicated Cyber Threat Intelligence (CTI) team is analyzing threat actor campaigns, motivations, and TTPs, typically mapped to frameworks like MITRE ATT&CK, to understand adversary behavior and inform defenses. Option D is correct because CTI teams produce finished intelligence reports and briefings tailored to operational and strategic stakeholders, translating raw data into actionable intelligence for decision-makers at different levels. Options A, B, and E do not belong: physical security audits of parking garages fall under corporate/physical security, writing custom business logic for customer-facing web applications is a software development responsibility, and directly configuring firewall ACLs and routing tables is a network/security engineering operational task, not a CTI analytical function.

Answer

Performing physical security audits of corporate parking garages

Answer

Writing and deploying custom business logic for customer-facing web applications

Answer

Directly configuring enterprise firewall access control lists and routing tables

Question 6

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Accepted Answer

Capability. The Diamond Model of Intrusion Analysis defines exactly four core vertices: Adversary, Capability, Infrastructure, and Victim. Option E (Adversary) is correct because the adversary is the actor or threat group conducting the intrusion, representing the 'who' of the event. Option C (Capability) is correct because capability covers the tools, malware, exploits, and techniques the adversary uses to achieve effects. Option D (Infrastructure) is correct because infrastructure describes the physical or logical resources (C2 servers, domains, IP addresses, email accounts) that the adversary uses to deliver and control capabilities. Option B (Payload) is not a vertex; payloads are a subset of capability rather than a top-level diamond component. Option A (Network Topology) is not a vertex; network topology is an environmental or situational factor that may inform analysis but is not one of the model's four primary components.

Answer

Network Topology

Answer

Payload

Question 7

A CTI analyst is tasked with producing a threat assessment for the upcoming quarter. The analyst must decide which intelligence requirements to prioritize based on the organization's risk appetite and current threat landscape. Which of the following criteria is most important when prioritizing requirements?

Accepted Answer

The potential impact on the organization's critical assets and business operations.. The most important criterion is the potential impact on critical assets and business operations, as this directly relates to organizational risk. Prioritizing requirements this way ensures that the CTI program addresses the most significant threats first, aligning with the risk appetite and supporting informed decision-making.

Answer

The personal interest of the CTI team members in specific threat actors.

Answer

The availability of open-source information on the threat.

Answer

The ease of collection and analysis for each requirement.

Question 8

A threat intelligence analyst is investigating an incident where an adversary used a spear-phishing email with a link to a malicious website. The website exploited a browser vulnerability to download and execute a payload. According to the Diamond Model of Intrusion Analysis, which axis represents the malicious website?

Accepted Answer

Infrastructure. In the Diamond Model, Infrastructure includes the physical and logical resources used by the adversary, such as servers, domains, and IP addresses. A malicious website used for exploitation is a logical resource, so it falls under Infrastructure. This axis helps analysts track and attribute adversary infrastructure.

Answer

Victim

Answer

Capability

Answer

Adversary

Question 9

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

Accepted Answer

Confirmation Bias. Confirmation bias is the tendency to search for, interpret, favor, and recall information in a way that confirms or supports one's prior beliefs or values.

Answer

Availability Heuristic

Answer

Mirror Imaging

Answer

Bandwagon Effect

Question 10

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

Accepted Answer

Assuming historical trends will continue indefinitely without accounting for environmental shifts.. Extrapolating short-term patterns into long-term certainties is a common error in trend analysis.

Answer

Ignoring the total volume of data available.

Answer

Collecting too much data from different sources.

Answer

Using visual graphs to display the results.

Question 11

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Accepted Answer

Clearing Windows Event Logs. Option A (Clearing Windows Event Logs) is a Defense Evasion technique because deleting or wiping Security, System, and Application logs (e.g., via wevtutil cl or Clear-EventLog) removes the audit trail that defenders rely on, directly undermining detection and incident response. Option E (Disabling security tools) is also Defense Evasion because turning off antivirus, EDR agents, Windows Defender (e.g., Set-MpPreference -DisableRealtimeMonitoring), or the firewall prevents defensive controls from detecting or blocking malicious activity. By contrast, option B (Brute-forcing RDP) is a Credential Access technique, as it attempts to guess valid credentials over port 3389. Option C (Setting up a VPN) is typically Command and Control or Defense Evasion only in specific tunneling contexts, but as a standalone action it is not classified as Defense Evasion here. Option D (Running a port scan) is Discovery, since it enumerates open ports and services to map the target environment.

Answer

Brute-forcing RDP

Answer

Setting up a VPN

Answer

Running a port scan

Question 12

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Accepted Answer

Command and Control. Beaconing is a primary method for establishing and maintaining Command and Control.

Answer

Exfiltration

Answer

Privilege Escalation

Answer

Collection

Question 13

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

Accepted Answer

'relationship_type'. The 'relationship_type' property defines the semantic nature of the link; if it does not match the STIX 2.1 controlled vocabulary for that SDO pair, the parser will reject the bundle.

Answer

'source_ref'

Answer

'target_ref'

Answer

'spec_version'

Question 14

Which THREE of the following are security best practices for managing a TAXII server?

Accepted Answer

Enforce TLS 1.2 or higher. Option A is correct because TAXII (Trusted Automated Exchange of Intelligence Information) transmits threat intelligence over HTTPS, and enforcing TLS 1.2 or higher protects data in transit from eavesdropping and man-in-the-middle attacks while disabling deprecated protocols like TLS 1.0/1.1. Option B is correct because TAXII servers authenticate clients via API keys or similar credentials, so strict API key management—rotation, least privilege, secure storage, and revocation—prevents unauthorized access and key leakage. Option C is correct because regularly auditing server access logs enables detection of anomalous or unauthorized TAXII collection requests, supports incident response, and satisfies compliance monitoring requirements. Option D is not appropriate because plain text HTTP exposes TAXII traffic to interception and tampering, and performance gains do not justify eliminating transport encryption. Option E is not appropriate because disabling all authentication would allow any anonymous client to read or write threat intelligence, violating the core access-control requirements of a TAXII server.

Answer

Use plain text HTTP for better performance

Answer

Disable all authentication

Question 15

Which THREE of the following are considered 'Internal' sources of threat intelligence for a SOC?

Accepted Answer

EDR platform alerts. Internal threat intelligence comes from telemetry and artifacts generated inside the organization's own environment. Option A (EDR platform alerts) is correct because endpoint detection and response tools continuously collect host-level events, process behavior, and indicators from the organization's own endpoints, making them a first-party internal source. Option C (SIEM logs) is correct because the SIEM aggregates and correlates logs from internal sources such as firewalls, servers, and authentication systems, producing intelligence derived from the organization's own infrastructure. Option D (Incident response reports) is correct because IR documentation captures lessons learned, observed TTPs, and IOCs from actual incidents handled within the organization, which is inherently internal intelligence. Option B (Twitter feeds) is not internal because it is an open-source, external social media source, and Option E (Commercial threat feeds) is not internal because it is a paid third-party subscription service providing externally sourced intelligence.

Answer

Twitter feeds

Answer

Commercial threat feeds