312-85 Practice Test 15 — 15 Questions

Question 1

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyzing threat actor campaigns, motivations, and Tactics, Techniques, and Procedures (TTPs). CTI teams are responsible for analyzing threat actor TTPs and providing actionable intelligence to defenders. They do not typically manage network firewalls or perform software development.

Answer

Performing physical security audits of corporate parking garages

Answer

Writing and deploying custom business logic for customer-facing web applications

Answer

Directly configuring enterprise firewall access control lists and routing tables

Question 2

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

Accepted Answer

Core industrial control systems or production manufacturing IT/OT infrastructure. Critical assets driving CTI requirements typically include intellectual property, customer Personally Identifiable Information (PII), and core operational infrastructure.

Answer

Publicly available marketing brochures hosted on the corporate website

Answer

Breakroom snack inventory logs

Question 3

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

Accepted Answer

Tactical Intelligence. Tactical threat intelligence focuses on low-level indicators of compromise (IOCs), hashes, IPs, and domains used by automated security defenses.

Answer

Financial Intelligence

Answer

Operational Intelligence

Answer

Strategic Intelligence

Question 4

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Accepted Answer

Downloading remote payloads. Certutil.exe is frequently abused to download files from remote URLs using the -urlcache -split -f flags.

Answer

Extracting browser passwords

Answer

Clearing event logs

Answer

Modifying system registry keys

Question 5

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Accepted Answer

Planning and Direction. The 'Planning and Direction' phase defines the requirements, including identifying which threat actors are relevant to the organization's risk profile.

Answer

Dissemination

Answer

Processing

Answer

Collection

Question 6

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

Accepted Answer

Process Explorer. Sysinternals Process Explorer is the industry standard for viewing hierarchical process structures (tree view).

Answer

Resource Monitor

Answer

PowerShell ISE

Answer

Wireshark

Question 7

Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?

Accepted Answer

-WindowStyle Hidden. -EncodedCommand and -NoP (NoProfile) are hallmarks of malicious script execution designed to bypass standard environment configs.

Answer

-File

Answer

-InputFormat

Answer

-Version

Question 8

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

Accepted Answer

root\subscription. The root\subscription namespace stores the classes (EventFilter, EventConsumer, FilterToConsumerBinding) used to execute malicious payloads.

Answer

root\default

Answer

root\security

Answer

root\cimv2

Question 9

Which TWO file integrity monitoring (FIM) events would be most useful to detect potential unauthorized persistence mechanisms?

Accepted Answer

Creation of files in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. Monitoring changes to Startup folders and registry Run keys are essential to detect persistence.

Answer

Access to C:\Windows\System32\drivers\etc\hosts

Answer

Changes to desktop background images

Answer

Reading of browser profile files

Question 10

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

Accepted Answer

It indicates a specific C2 listener implementation. A unique JA3S value in a specific environment often points to a specific server-side implementation of a C2 listener.

Answer

The connection is encrypted with an expired certificate

Answer

The client has been compromised

Answer

It is a standard browser connection

Question 11

When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?

Accepted Answer

Remote RDP access to a Domain Controller. Remote service creation, RDP to domain controllers, and unusual process spawning from WMI are clear indicators of lateral movement.

Answer

Opening a local text file

Answer

Standard user running 'whoami'

Question 12

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Accepted Answer

Logon Type 3 occurring from a workstation to a workstation. Pass-the-hash involves abnormal logon types, NTLM usage, and suspicious logons from unexpected source IPs.

Answer

Success of local service startup

Answer

High volume of Kerberos TGS requests

Question 13

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

Accepted Answer

Get-ScheduledTask. Get-ScheduledTask is the standard management cmdlet for listing and inspecting scheduled tasks in Windows.

Answer

Get-Service

Answer

Get-Process

Answer

Get-WmiObject Win32_StartupCommand

Question 14

To effectively hunt for C2 communication, which THREE indicators should be monitored in your proxy or firewall logs?

Accepted Answer

High frequency of connections (beaconing). Unusual User-Agents, connection frequency, and destination domain age are critical indicators of C2 infrastructure.

Answer

Traffic volume spikes

Answer

TCP Window size changes

Question 15

Which TWO types of intelligence are most essential for an Incident Response team during an active attack investigation?

Accepted Answer

Tactical Intelligence. Tactical and Operational intelligence are essential for responding to live incidents. Tactical details the TTPs, while Operational provides the immediate indicators.

Answer

Regulatory Intelligence

Answer

Market Intelligence

Answer

Strategic Intelligence