312-85 Practice Test 16 — 15 Questions

Question 1

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a theory or a TTP and searches for evidence to confirm or deny it.

Answer

Incident response forensics

Answer

Machine learning-based hunting

Answer

Alert-driven hunting

Question 2

In Palo Alto Networks Cortex XSOAR, you are building a playbook to automate the qualification of incoming phishing alerts. Which integration command is used to calculate a 'reputation score' based on data from a connected threat intelligence platform (TIP)?

Accepted Answer

!getIndicatorScore. The '!getIndicatorScore' command is the standard XSOAR automation command used to fetch and aggregate reputation scores from all integrated threat intelligence sources.

Answer

!fetchIntel

Answer

!updateReputation

Answer

!queryTI

Question 3

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Accepted Answer

Strategic. Strategic intelligence is designed for executive audiences to understand trends and risk posture over time.

Answer

Technical

Answer

Operational

Answer

Tactical

Question 4

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

Accepted Answer

Event ID 4768 with pre-auth not required. AS-REP Roasting targets accounts that do not require Kerberos pre-authentication.

Answer

Event ID 4771

Answer

Event ID 4624

Answer

Event ID 4769

Question 5

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

Accepted Answer

Sysmon Event ID 1. Security logs (4688) capture process launches with command lines, while Sysmon (Event ID 1) provides the parent-child context and hash data.

Answer

System Event Log (Event ID 7045)

Answer

DHCP Server logs

Answer

DNS Query logs

Question 6

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Accepted Answer

PowerShell Script Block Logging. Fileless malware resides in memory or the registry, so WMI and PowerShell logs are primary sources.

Answer

File System MFT records

Answer

Browser Cache History

Answer

Windows Update logs

Question 7

You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?

Accepted Answer

Relationship. The 'Relationship' object in STIX 2.1 is used to define how SDOs (STIX Domain Objects) interact, such as a Threat Actor 'uses' an Infrastructure object.

Answer

Indicator

Answer

Sighting

Answer

Identity

Question 8

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Accepted Answer

Reduces false positives from stale indicators. Setting an expiration period ensures that stale or obsolete indicators are removed, which reduces false positives and improves correlation performance.

Answer

Increases ingestion speed

Answer

Decreases storage costs

Answer

Complies with GDPR

Question 9

Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?

Accepted Answer

PowerShell Script Execution. PowerShell, WMI, and Scheduled Tasks are the most common vectors for adversary code execution on Windows systems.

Answer

ARP Spoofing

Answer

DNS Tunneling

Question 10

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Accepted Answer

join. The 'join' operator in KQL is required to correlate disparate datasets, such as threat intelligence logs and security event logs.

Answer

merge

Answer

lookup

Answer

union

Question 11

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Accepted Answer

Delivering intelligence in a usable, timely format. Dissemination ensures that relevant, actionable intelligence reaches the IR team in a format they can immediately use for investigation.

Answer

Defining incident response procedures

Answer

Validating the data source reliability

Answer

Archiving incident data

Question 12

You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?

Accepted Answer

FQL. CrowdStrike utilizes FQL (Falcon Query Language) to search across the sensor data and endpoint activity logs.

Answer

SPL

Answer

KQL

Answer

Lucene

Question 13

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

Accepted Answer

Commercial threat feed. A commercial threat intelligence platform (TIP) or feed is typically a 'push' source, providing updates to the enterprise as they are identified.

Answer

Internal log analysis

Answer

Packet capture

Answer

Manual web research

Question 14

Which TWO protocols are most commonly used for the automated exchange of threat intelligence between different organizations or platforms?

Accepted Answer

TAXII. TAXII is the transport protocol, and STIX is the serialization format, making them the standard combination for automated TI sharing.

Answer

ICMP

Answer

LDAP

Answer

SNMP

Question 15

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Accepted Answer

Indicators of Compromise. The Indicators of Compromise (IOC) section provides the specific hashes, IPs, and file paths needed for immediate detection.

Answer

Threat Actor Attribution

Answer

Mitigation Strategy

Answer

Executive Summary