312-85 Practice Test 15 — 15 Questions

Question 1

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

Accepted Answer

Get-ScheduledTask. Get-ScheduledTask is the PowerShell cmdlet that retrieves scheduled tasks from the local or remote computer. It allows auditors and threat hunters to enumerate scheduled tasks across the enterprise, which is critical for detecting persistence mechanisms. It can be combined with Invoke-Command or CIM sessions for remote auditing.

Answer

Get-Service

Answer

Get-Process

Answer

Get-WmiObject Win32_StartupCommand

Question 2

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Accepted Answer

To define specific information needs that support organizational decision-making and risk reduction. Priority Intelligence Requirements (PIRs) are the specific, decision-relevant intelligence questions that drive collection and analysis. Defining them during Requirements Planning ensures the CTI program produces intelligence that supports organizational decision-making and risk reduction, rather than unfocused data gathering.

Answer

To schedule routine penetration testing intervals across the enterprise network

Answer

To outline the budget allocation for commercial threat feed subscriptions

Answer

To establish automated firewall blocklists for known malicious IP addresses

Question 3

Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?

Accepted Answer

GDPR. GDPR (General Data Protection Regulation) governs the processing and cross-border transfer of personal data of individuals in the EU/EEA. When threat intelligence contains PII and is shared with international partners, GDPR's lawful basis, data minimization, and transfer mechanism requirements (such as Standard Contractual Clauses or adequacy decisions) directly apply. This makes it the framework a company must consider in that scenario.

Answer

HIPAA

Answer

SOX

Answer

PCI-DSS

Question 4

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

Accepted Answer

Sensitive file access and data movement tracking.. Insider threats are detected via access logs, file activity, and network communication patterns.

Answer

Employee cafeteria transaction history.

Answer

Public internet speed test results.

Question 5

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

Accepted Answer

The vulnerability has a high severity rating based on its characteristics.. CVSS scores represent the severity of a vulnerability, with higher scores indicating higher severity.

Answer

The vulnerability is currently being exploited in the wild.

Answer

The vulnerability affects only Windows systems.

Answer

The vulnerability is already patched.

Question 6

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Accepted Answer

A command-line execution sequence. An Indicator of Attack (IOA) focuses on the behavior or intent of an attack in progress — such as a suspicious command-line execution sequence — rather than static artifacts. IOAs are behavioral and can detect novel attacks even when no known signature exists.

Answer

A known malicious file hash

Answer

A specific registry key for malware persistence

Answer

A blacklisted IP address

Question 7

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Accepted Answer

The ephemeral nature of cloud assets. Option C is correct because cloud assets are ephemeral — instances, containers, and serverless functions are created, destroyed, and rescheduled constantly, so indicators of compromise (IOCs) and threat context tied to a specific IP, hostname, or instance ID quickly become stale, making correlation and tracking of threats difficult. Option D is correct because the shared responsibility model splits visibility and control between the cloud provider and the customer, so logs, telemetry, and enforcement points span multiple parties, which complicates attribution of an attack to a specific actor, misconfiguration, or tenant. Option A is incorrect because cloud workloads are fully susceptible to malware, cryptojacking, and ransomware; the cloud changes the attack surface, not immunity. Option B is incorrect because cloud environments generate extensive logs (e.g., AWS CloudTrail, Azure Activity Log, VPC Flow Logs), though access and normalization can be challenging. Option E is incorrect because API-based intelligence collection is widely used and often essential in cloud threat intelligence, not impossible.

Answer

Cloud environments are immune to malware

Answer

The total lack of logs in cloud environments

Answer

The inability to use API-based intelligence collection

Question 8

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Accepted Answer

Execution. Execution is the tactic used to run malicious code on a target system; PowerShell is a common technique within that tactic.

Answer

Persistence

Answer

Exfiltration

Answer

Privilege Escalation

Question 9

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

Accepted Answer

Assume TLP:RED.. When TLP is missing, the default safest practice is to assume TLP:RED or the most restrictive category to prevent unauthorized disclosure.

Answer

Publish to public forums.

Answer

Discard the data entirely.

Answer

Assume TLP:CLEAR.

Question 10

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Accepted Answer

Shift intelligence requirements to focus on initial access vectors, third-party supplier dependencies, and forums frequented by Initial Access Brokers (IABs). Refining collection requirements and pivoting focus toward upstream threat indicators (such as supplier dependencies, third-party vendor risks, and initial access brokers) addresses late detection of supply chain intrusions.

Answer

Disable all external threat intelligence feeds to reduce noise in the security operations center

Answer

Reassign all malware reverse engineering tasks to helpdesk support personnel

Answer

Increase the budget for automated SIEM log retention from 30 days to 90 days

Question 11

You are implementing a TIP and want to prioritize intelligence based on the source's reputation. Where should you configure this logic?

Accepted Answer

In the Source Reliability or Feed Weighting module. The Source Reliability or Feed Weighting module is specifically designed to assign trust scores or weights to intelligence sources based on their historical accuracy, credibility, and reputation. This allows the TIP to prioritize or deprioritize intelligence from each feed, ensuring that higher-quality data drives decision-making. Configuring this logic elsewhere, such as in TAXII or STIX settings, does not address source reputation.

Answer

In the TAXII discovery root

Answer

In the User Access Control settings

Answer

In the STIX parser settings

Question 12

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Accepted Answer

Define specific PIRs regarding third-party software vendors and update frequency. The Direction phase translates broad stakeholder intent into actionable intelligence requirements. Refining 'Supply Chain threats' into specific Priority Intelligence Requirements (PIRs) — such as which third-party vendors, what indicators, and how often to refresh — makes collection and production measurable and scoped. This is exactly what the Direction phase demands: turning vague asks into defined, answerable questions.

Answer

Ignore the request until more data is available

Answer

Purchase all available supply chain threat reports

Answer

Automate the collection of all supply chain news

Question 13

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

Accepted Answer

Lack of standardized formatting.. Option A is correct because threat intelligence feeds arrive in many incompatible schemas and formats (for example STIX/TAXII JSON, CSV, MISP events, OpenIOC, and vendor-proprietary layouts), so normalizing and correlating indicators across sources is a genuine ingestion challenge. Option B is correct because feeds can deliver millions of indicators per day, and the sheer data volume can exceed the storage, parsing, and enrichment capacity of SIEM, TIP, or SOAR pipelines, causing latency and dropped records. Option E is correct because many feeds contain stale, low-fidelity, or unverified indicators, so a high false-positive rate creates noise that wastes analyst time and can trigger erroneous blocking. Option C is not a standard ingestion challenge because feeds are inherently network-delivered and organizations consuming them already have connectivity; the real issues are format, scale, and quality. Option D is not a challenge but a handling concern: defaulting to TLP:CLEAR is a sharing/marking policy decision, not an obstacle to ingesting feeds.

Answer

Lack of internet access.

Answer

Defaulting to TLP:CLEAR.

Question 14

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Accepted Answer

Registry key modification. A host-based IOC is an artifact found on an endpoint or host system, such as a modified registry key, a suspicious file hash, a rogue process, or a persistence entry. Registry key modification is a classic host-based indicator because attackers use registry Run keys, services, or COM hijacking to establish persistence on Windows systems. It is observable only by inspecting the host, distinguishing it from network-based IOCs.

Answer

User-Agent string in HTTP header

Answer

Domain name for C2 beaconing

Answer

Source IP address in firewall logs

Question 15

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

Accepted Answer

It helps filter out random 'noise' to highlight consistent temporal patterns.. A rolling average smooths short-term fluctuations in a time series, making underlying trends and periodic patterns more visible. In C2 beaconing detection, the signal is a consistent periodic callback (e.g., every 60 seconds) buried in noisy traffic, so smoothing highlights that regularity. This is a standard statistical technique for anomaly and pattern detection in security analytics.

Answer

It increases the absolute volume of the data collected.

Answer

It eliminates the need for further traffic inspection.

Answer

It encrypts the log data for safer analysis.