312-85 Practice Test 14 — 15 Questions

Question 1

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Industry-specific ISACs and regulatory compliance bodies. Information Sharing and Analysis Centers (ISACs) or Information Sharing and Analysis Organizations (ISAOs) provide sector-specific threat intelligence and peer collaboration crucial for accurate threat requirements.

Answer

Social media marketing agencies

Answer

Commercial real estate brokers

Answer

Consumer product retail vendors

Question 2

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

Accepted Answer

High volume of TXT record queries. Extremely high volumes of TXT or NULL record queries are classic indicators of DNS tunneling for data exfiltration.

Answer

Low volume of DNS failures

Answer

High volume of A record queries

Answer

Frequent SRV record updates

Question 3

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

Accepted Answer

Port 445. TCP Port 445 is the standard port for SMB/CIFS, which is essential for lateral movement tools like PSExec.

Answer

Port 80

Answer

Port 3389

Answer

Port 22

Question 4

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

Accepted Answer

Ensuring the intelligence is delivered effectively to the target audience. Dissemination focuses on ensuring the right information reaches the right person in the right format at the right time.

Answer

Analyzing the data collected

Answer

Collecting data from the dark web

Answer

Developing new security tools

Question 5

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

Accepted Answer

The IP addresses of the Command and Control servers used. The Infrastructure node in the Diamond Model describes the physical or logical communication channels used by the adversary, such as C2 servers or IP addresses.

Answer

The time of day the attack occurred

Answer

The specific malware hash used in the attack

Answer

The adversary's primary motivation

Question 6

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Accepted Answer

The vendor's track record for providing accurate, validated intelligence. Reliability is determined by the vendor's transparency, consistency, and the quality of their data collection processes.

Answer

The volume of indicators provided without context

Answer

The number of social media followers the vendor has

Question 7

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Accepted Answer

To define specific information needs that support organizational decision-making and risk reduction. PIRs focus the entire threat intelligence collection and analysis effort on answering specific, critical questions that drive decision-making for leadership.

Answer

To schedule routine penetration testing intervals across the enterprise network

Answer

To outline the budget allocation for commercial threat feed subscriptions

Answer

To establish automated firewall blocklists for known malicious IP addresses

Question 8

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

Accepted Answer

Internal IDS/IPS and firewall logs. Technical intelligence typically comes from logs, network traffic, and malware analysis.

Answer

Legislative changes in cybersecurity law

Answer

Interviews with industry peers

Answer

Geopolitical risk analysis reports

Question 9

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

Accepted Answer

Lockheed Martin Cyber Kill Chain. MITRE ATT&CK and the Lockheed Martin Cyber Kill Chain are core frameworks used in threat intelligence and defense planning.

Answer

Simple Mail Transfer Protocol (SMTP) specification

Answer

Hypertext Transfer Protocol Secure (HTTPS) RFC standards

Answer

Basic Input/Output System (BIOS) UEFI firmware specifications

Question 10

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Accepted Answer

Triage, validate, and prioritize the RFI against established intelligence priorities. Once an RFI is submitted, it must be triaged, validated, and prioritized against existing intelligence requirements before collection and analysis tasks are assigned.

Answer

Immediately publish the raw telemetry to the corporate intranet without validation

Answer

Archive the RFI immediately as operational queries fall outside the scope of CTI

Answer

Initiate an immediate red-team attack campaign against the external supplier

Question 11

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

Accepted Answer

Standard deviation on interval deltas. Calculating the variance or standard deviation of time intervals between connections (the 'delta') is the standard method for identifying programmatic beaconing.

Answer

Sum aggregation on connection counts

Answer

Min/Max aggregation on bytes

Answer

Cardinality count on source IPs

Question 12

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

Accepted Answer

The ratio of high-value intelligence reports produced that directly answered PIRs versus total raw data collected. Collection efficiency measures how effectively the sources being collected actually provide answers to the established PIRs, filtering out noise.

Answer

The number of firewall rule changes approved by change management

Answer

The total financial cost of commercial intelligence subscriptions divided by the number of employees

Answer

The average time it takes an analyst to write a quarterly report

Question 13

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

Accepted Answer

Relevance of the feed data to the organization's specific industry sector and geographic footprint. When vetting threat intelligence feeds or vendors, relevance to the organization's specific threat landscape and actionability of the data are paramount.

Answer

The marketing budget of the threat intelligence vendor

Answer

Whether the vendor shares all threat data publicly on open-source social media platforms

Answer

The total number of unverified IP addresses included in the feed without regard to false positive rates

Question 14

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

Accepted Answer

Access to lsass.exe. Mimikatz typically attempts to access LSASS.exe with specific access masks to read memory.

Answer

Access to csrss.exe

Answer

Access to svchost.exe

Answer

Access to explorer.exe

Question 15

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

Accepted Answer

Dissemination and Feedback. Feedback and review from completed intelligence operations and stakeholder evaluations provide the necessary insights to refine and adjust requirements in the direction and planning phase.

Answer

Processing and Exploitation

Answer

Automated Malware Sandboxing

Answer

Tactical Log Ingestion