312-85 Practice Test 14 — 15 Questions

Question 1

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Accepted Answer

An executive summary of the potential business impact of the threat. Strategic intelligence, which focuses on trends and risk impact, is designed for executive audiences.

Answer

A detailed list of firewall rules to block the attacker

Answer

Raw log data from the IDS/IPS

Answer

A breakdown of the malware assembly code

Question 2

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Accepted Answer

Execution. While PowerShell can be used for execution, the act of running the script to download the payload is categorized under Execution. The Tactic is the 'why' of the action, and Execution covers running malicious code.

Answer

Discovery

Answer

Persistence

Answer

Command and Control

Question 3

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Accepted Answer

T1547.001: Registry Run Keys. Modifying HKLM\Software\Microsoft\Windows\CurrentVersion\Run is the canonical Registry Run Key persistence technique, mapped in MITRE ATT&CK as T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). The Run key causes the referenced program to execute at user logon.

Answer

T1003: OS Credential Dumping

Answer

T1059.001: PowerShell

Answer

T1021: Remote Services

Question 4

You are configuring a TAXII 2.1 client to consume feeds from an industry ISAC. You have successfully authenticated but are receiving empty response bodies for your collections. Which configuration setting should you verify in the TAXII client to ensure you are polling the correct resource path?

Accepted Answer

Verify the 'API Root' URL parameter in the client configuration.. In TAXII 2.1, the API Root is the base URL that scopes all collections and objects; if the client is pointed at the wrong API Root, requests to collection endpoints return empty bodies even though authentication succeeds. Verifying the API Root URL ensures the client is polling the correct resource path for the ISAC's collections.

Answer

Toggle the 'Enable TLS 1.3' checkbox.

Answer

Ensure the 'STIX Object Versioning' is set to 'Latest'.

Answer

Check the 'Discovery Service' endpoint path.

Question 5

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in AWS accounts, including who made API calls, when, from where, and with what credentials. Unauthorized API key usage would appear as anomalous or unexpected API calls in CloudTrail logs, making it the most directly relevant CTI source for investigating compromised or misused credentials.

Answer

AWS GuardDuty

Answer

AWS WAF

Answer

AWS Inspector

Answer

AWS Config

Question 6

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

Accepted Answer

Apply the TLP marking to the document. The Traffic Light Protocol (TLP) is the industry-standard marking system specifically designed to communicate information-sharing sensitivity to recipients. Applying a TLP marking (RED, AMBER, GREEN, CLEAR) directly on the document gives recipients an unambiguous, standardized instruction about how far they may redistribute the content. This is the most effective way to convey sensitivity because it is machine-readable and universally understood in the threat intelligence community.

Answer

Send the report via an encrypted channel

Answer

Password protect the document

Answer

Use a disclaimer at the bottom of the email

Question 7

A threat intelligence report uses the Diamond Model for Intrusion Analysis. You are adding a new 'Victim' node. What information should you include to align with this model?

Accepted Answer

The specific organization or target being attacked. The Diamond Model of Intrusion Analysis consists of four core features: Adversary, Capability, Infrastructure, and Victim. The Victim node represents the target of the intrusion — the specific organization, system, or asset being attacked — so the correct entry is the targeted organization or entity.

Answer

The malware hash used in the attack

Answer

The TTPs used by the attacker

Answer

The IP addresses of the attacker's C2

Question 8

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

SHA-256 File Hash. IOCs are typically digital forensic artifacts like file hashes or network connection logs.

Answer

Server rack temperature

Answer

Employee behavior patterns

Answer

Project management timeline

Question 9

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Accepted Answer

Endpoint Detection and Response (EDR). The Installation phase involves the malware establishing a persistent foothold on the host, which is best detected by host-based security tools like EDR.

Answer

DNS sinkholing

Answer

Email gateway filtering

Answer

Social engineering training

Question 10

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

Accepted Answer

Check if the source IP is whitelisted on the threat intelligence provider side.. 403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.

Answer

Update the SSL certificates on the collector.

Answer

Increase the connector memory allocation.

Answer

Restart the OpenCTI RabbitMQ service.

Question 11

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

Accepted Answer

Target-Centric Intelligence Analysis. Target-centric intelligence analysis focuses specifically on the assets, events, or transactions of interest (such as an M&A deal) and maps out all threat actors known to target those specific equities.

Answer

Network Forensic Packet Capture Analysis

Answer

Signature-Based Intrusion Detection Analysis

Answer

Vulnerability Scoring via CVSS v3.1 Base Metrics

Question 12

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

Accepted Answer

Process Explorer. Process Explorer is the Sysinternals tool that displays a hierarchical tree of processes showing parent-child relationships, which is exactly what is needed to visualize how processes spawned during a threat hunt. It shows the process tree, command lines, and parent PIDs, making it ideal for spotting suspicious process ancestry like a Word document spawning PowerShell. This directly supports identifying malicious process chains.

Answer

Resource Monitor

Answer

PowerShell ISE

Answer

Wireshark

Question 13

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Accepted Answer

To ensure data compatibility for correlation and cross-source analysis.. Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.

Answer

To reduce the storage space required for logs.

Answer

To increase the ingestion speed of the SIEM.

Answer

To encrypt the logs for regulatory compliance.

Question 14

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

Accepted Answer

Initiate threat hunting across endpoints. High-confidence indicators should be validated against internal logs, the firewall/proxy should be updated to block the activity, and the threat should be hunted for historical presence.

Answer

Disable all network interfaces

Answer

Publicly disclose the intelligence

Question 15

A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?

Accepted Answer

A1. Under the Admiralty Code, A1 represents a reliable source (A) and information that is confirmed by other independent sources (1).

Answer

C3

Answer

F6

Answer

B2