312-85 Practice Test 16 — 15 Questions

Question 1

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

Accepted Answer

Reconnaissance. Reconnaissance (A) is correct because it is the first Cyber Kill Chain phase, in which the attacker passively or actively gathers information about the target (e.g., via OSINT, DNS queries, or port scanning) without yet touching the target environment. Weaponization (C) is correct because the attacker pairs an exploit with a deliverable payload (e.g., a malicious Office document or a weaponized PDF) entirely within their own infrastructure, before any interaction with the victim. Delivery (B) is correct because it is the phase in which the weaponized payload is transmitted toward the victim (e.g., via phishing email, USB drive, or watering-hole site) — it is the last pre-compromise phase and still precedes actual execution inside the target environment. Installation (D) and Exploitation (E) are not among the three pre-target phases: Exploitation occurs when the payload triggers a vulnerability on the victim system, and Installation is the follow-on phase where the attacker establishes persistence on the compromised host — both happen after the target environment has already been reached.

Answer

Installation

Answer

Exploitation

Question 2

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

Accepted Answer

Relevance of the feed data to the organization's specific industry sector and geographic footprint. Option A is correct because a threat intelligence feed must be relevant to the organization's specific industry sector and geographic footprint; intelligence about threats targeting unrelated sectors or regions wastes resources and fails to inform risk-based decisions. Option D is correct because actionability is a core vetting criterion: the intelligence must be timely, contextual, and specific enough to drive concrete updates to security controls such as firewall rules, IDS/IPS signatures, or SIEM detections. Option B is incorrect because a vendor's marketing budget has no bearing on the technical quality, accuracy, or usefulness of its intelligence. Option C is incorrect because publicly sharing all threat data on open-source social media does not indicate vendor quality and may actually reduce the exclusivity and value of the feed. Option E is incorrect because raw volume of unverified IP addresses without regard to false positive rates is a poor metric; high false positives degrade detection fidelity and increase analyst workload.

Answer

The marketing budget of the threat intelligence vendor

Answer

Whether the vendor shares all threat data publicly on open-source social media platforms

Answer

The total number of unverified IP addresses included in the feed without regard to false positive rates

Question 3

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Accepted Answer

A list of identified threats categorized by type.. Option A is correct because a threat model must document the identified threats themselves, typically categorized by type (for example STRIDE categories such as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege), so that each threat can be assessed and mitigated. Option B is correct because a detailed system architecture diagram (data flow diagrams, trust boundaries, entry points, and components) is a foundational artifact of threat modeling, providing the context needed to identify where threats apply. The remaining options are not essential components of a threat model: the security team's budget (C) is a financial/management detail, the IT employee handbook (D) is a policy document unrelated to modeling threats against a system, and a list of admin-access employees (E) is an access-control inventory rather than a threat model component.

Answer

The budget allocated for the security team.

Answer

The employee handbook for the IT department.

Answer

A list of all employees with admin access.

Question 4

You are selecting a format for sharing intelligence with a heterogeneous group of partners. Which THREE of the following are benefits of choosing STIX/TAXII over unstructured CSV/PDF reporting?

Accepted Answer

Reduction in analyst time spent on manual data entry.. Option C is correct because STIX's structured, machine-readable schema lets partners ingest indicators programmatically instead of re-keying them from CSV/PDF reports, cutting manual data-entry effort. Option D is correct because STIX defines standardized objects, properties, and relationships (e.g., Indicator, Malware, Attack Pattern, and relationship types), so the same intelligence retains consistent meaning across heterogeneous tools and vendors. Option E is correct because TAXII provides a standardized HTTPS/RESTful transport for exchanging STIX content, enabling automated ingestion into SIEM and SOAR platforms via APIs rather than manual parsing. Option A is not correct because STIX/TAXII does not by itself guarantee encryption at rest; TAXII specifies transport (typically TLS in transit), while at-rest protection depends on the storage platform. Option B is not correct because human-readable plain-text commentary is equally achievable in CSV/PDF and is not a distinguishing benefit of STIX/TAXII.

Answer

Guaranteed encryption of all shared data at rest.

Answer

Ability to include human-readable commentary in plain text.

Question 5

Which TWO of the following are common actions performed during the 'processing' phase of the threat intelligence lifecycle?

Accepted Answer

Normalization to a unified format.. Option A (Normalization to a unified format) is correct because the processing phase converts collected raw intelligence into a consistent, structured format (e.g., STIX/TAXII or a common schema) so that disparate feeds can be correlated, deduplicated, and analyzed. Option B (Parsing of raw data files) is correct because processing involves extracting usable fields and indicators from raw feeds, logs, or files (e.g., JSON, XML, CSV) before enrichment and analysis. Option C is incorrect because physically installing servers is an infrastructure/deployment task, not part of the intelligence lifecycle's processing phase. Option D is incorrect because writing incident response playbooks is a defensive/operational preparation activity, not intelligence processing. Option E is incorrect because final delivery to the CISO corresponds to the dissemination phase, which occurs after processing and analysis.

Answer

Physical installation of servers.

Answer

Writing incident response playbooks.

Answer

Final delivery to the CISO.

Question 6

When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?

Accepted Answer

Remote RDP access to a Domain Controller. Option A is correct because interactive RDP logons to a Domain Controller are highly unusual in normal operations — DCs are administered via RSAT, WinRM, or console access, so a Type 10 logon (Event ID 4624) to a DC often indicates credential abuse or lateral movement toward the highest-value target. Option C is correct because WMI is a legitimate remote management mechanism, but services.exe (or its child processes) being spawned via WMI (e.g., Win32_Process Create) is a classic lateral-movement and execution technique used by tools like Impacket's wmiexec and Cobalt Strike, since it lets an attacker run code remotely without dropping a binary to disk. Option E is correct because creating a service remotely with sc.exe (or PsExec-style service creation) is a well-known lateral-movement and persistence method — it requires admin rights on the target and results in Event ID 7045 (a new service was installed) plus 4697, making it a strong indicator of compromise. Option B is not suspicious because opening a local text file is a routine user action with no lateral-movement significance. Option D is not suspicious because 'whoami' is a benign built-in command that standard users and administrators run constantly for troubleshooting, and it does not by itself indicate movement across hosts.

Answer

Opening a local text file

Answer

Standard user running 'whoami'

Question 7

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

Accepted Answer

To uniquely identify a specific set of intelligence within an API Root. In TAXII 2.1, a Collection is a logical grouping of CTI objects within an API Root, and the Collection ID is a globally unique identifier (typically a UUID) that allows clients to request, poll, or subscribe to that specific set of intelligence. It is the addressing mechanism used in TAXII endpoint URLs such as /{api-root}/collections/{collection-id}/objects/, so without it a consumer cannot target the exact data feed it needs. It does not perform integrity, retention, or encryption functions — those are handled elsewhere in the STIX/TAXII stack.

Answer

To verify the integrity of the STIX bundle

Answer

To define the retention period for the objects

Answer

To encrypt the data payload during transit

Question 8

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

Accepted Answer

Develop requirements to identify ransomware campaigns, threat actor TTPs, and third-party vendors targeting our critical supply chain ecosystem. Translating executive concerns into formal requirements involves formulating specific, answerable questions regarding supply chain vulnerabilities and active ransomware campaigns targeting third-party vendors.

Answer

Collect all CVEs published daily by the National Vulnerability Database (NVD)

Answer

Deploy endpoint detection and response (EDR) agents to all contractor laptops

Answer

Execute regular phishing simulations for all internal business unit employees

Question 9

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Accepted Answer

Defense Evasion. Process Hollowing (T1055.012) is a sub-technique of Process Injection, which falls under the Defense Evasion tactic in MITRE ATT&CK. The technique involves creating a legitimate process in a suspended state, hollowing out its memory, and replacing it with malicious code, so the malicious activity appears to originate from a trusted process. This masks the adversary's code from security tools that rely on process reputation or signature-based detection, directly supporting the goal of evading defenses.

Answer

Lateral Movement

Answer

Credential Access

Answer

Persistence

Question 10

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Accepted Answer

Information Disclosure. Logging authentication tokens in plain text exposes sensitive credentials to anyone with log access, which is a direct violation of confidentiality — the defining concern of the Information Disclosure category in STRIDE. STRIDE's 'I' maps to confidentiality breaches, and plaintext token logging is a textbook example.

Answer

Elevation of Privilege

Answer

Tampering

Answer

Repudiation

Question 11

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

Accepted Answer

How changes in input variables affect the model's output.. Sensitivity Analysis is a modeling technique that determines how variation or uncertainty in input variables affects the model's output. In threat modeling, this means asking questions like: if the likelihood of a given threat increases by 20%, how does the overall risk score change? It identifies which inputs drive the model's conclusions and where uncertainty matters most, helping prioritize which assumptions to validate.

Answer

Whether the threat actor has successfully exfiltrated data.

Answer

The total number of threat actors targeting the organization.

Answer

The cryptographic strength of the data being protected.

Question 12

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

Accepted Answer

Validate the JSON bundle against the STIX 2.1 schema. When one platform receives a STIX 2.1 bundle but fails to parse it, the most likely cause is a malformed or non-conformant JSON structure. Validating the bundle against the STIX 2.1 JSON schema (B) will reveal missing required properties, incorrect object types, or invalid pattern syntax, which are the typical reasons a parser rejects a bundle even though transport succeeded.

Answer

Restart the TAXII server service

Answer

Check the TLS certificate expiration date

Answer

Check the firewall rules for port 443

Question 13

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

Accepted Answer

Sysmon Event ID 1. Sysmon Event ID 1 (Process Create) is essential because it captures detailed process creation telemetry including the full command line, parent process, image path, hashes, and user context, which is exactly what is needed to spot legitimate Windows binaries like powershell.exe, rundll32.exe, or certutil.exe being abused for LotL activity. Security Event ID 4688 (A New Process Has Been Created) is also essential because it records process creation with the new process name, creator process, and — when command-line auditing is enabled — the full command line, providing native Windows visibility into LotL binary execution even without Sysmon deployed. Together these two process-creation sources give the command-line and parent-child process context that LotL hunting fundamentally depends on. System Event Log Event ID 7045 only shows service installation and would miss the vast majority of LotL execution that does not install a service. DHCP Server logs only record IP lease assignments and offer no process or command-line visibility. DNS Query logs can reveal malicious domains but do not show which binary or command line made the query, so they are supporting rather than essential for identifying LotL binary abuse.

Answer

System Event Log (Event ID 7045)

Answer

DHCP Server logs

Answer

DNS Query logs

Question 14

Which TWO components are mandatory for a valid STIX 2.1 'Indicator' object to function within an automated ingestion system?

Accepted Answer

pattern. In STIX 2.1, the Indicator SDO requires the 'pattern' property (option C), which contains the actual detection expression (e.g., a STIX Patterning string) that an automated ingestion system parses and matches against telemetry, making it mandatory for the object to function. The 'pattern_type' property (option D) is also required because it tells the consuming tool which patterning language/specification the pattern uses (e.g., 'stix'), so the pattern can be correctly interpreted; without it the pattern cannot be reliably evaluated. By contrast, 'created_by_ref' (option A) is optional and only identifies the Identity that created the object, 'valid_from' (option B) is optional and merely indicates when the Indicator is considered valid, and 'confidence' (option E) is optional and expresses a subjective confidence level — none of these are needed for the Indicator's detection logic to be ingested and processed.

Answer

created_by_ref

Answer

valid_from

Answer

confidence

Question 15

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

Accepted Answer

Source IP blacklisting.. Automated scraping tools that ignore rate limits send requests far faster than a site's acceptable-use policy permits, and the target's WAF or IDS will flag the traffic pattern as abusive and block the source IP. Once blacklisted, the collector loses access to that source entirely, which is the primary operational risk of aggressive OSINT harvesting. Encryption, STIX versioning, and normalization are downstream data-handling concerns, not the immediate consequence of ignoring rate limits.

Answer

Lack of data encryption.

Answer

STIX version mismatch.

Answer

Data normalization failure.