312-85 Practice Test 17 — 15 Questions

Question 1

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

Accepted Answer

Delivery. Social engineering and phishing attacks occur during the Delivery phase, which is best addressed by human-centric training.

Answer

Weaponization

Answer

Installation

Answer

Actions on Objectives

Question 2

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

Accepted Answer

Core industrial control systems or production manufacturing IT/OT infrastructure. Option A is correct because ICS, SCADA, and OT/production manufacturing infrastructure are crown-jewel assets whose compromise can halt physical operations, cause safety incidents, or enable destructive attacks, so they must directly shape intelligence requirements. Option C is correct because customer PII and financial records are regulated, high-value data (e.g., under GDPR, PCI DSS, HIPAA) whose theft drives breach costs, notification duties, and attacker monetization, making them a primary intelligence priority. Option E is correct because proprietary source code and intellectual property represent competitive advantage and are frequent targets of nation-state and corporate espionage, so collection requirements should focus on actors, TTPs, and exfiltration vectors targeting them. Option B does not belong because publicly available marketing brochures are intentionally disclosed, non-sensitive, and carry no confidentiality or operational impact. Option D does not belong because breakroom snack inventory logs have no security, regulatory, financial, or mission value and would not drive intelligence requirements.

Answer

Publicly available marketing brochures hosted on the corporate website

Answer

Breakroom snack inventory logs

Question 3

When analyzing network traffic for C2 communication, which THREE anomalies are common indicators of malicious activity?

Accepted Answer

Unexpected use of common protocols like DNS or HTTP/S for data exfiltration.. Option C is correct because attackers frequently abuse ubiquitous, allowed protocols such as DNS tunneling or HTTP/S POST requests to blend exfiltration into normal traffic, so unexpected use of these protocols for data transfer is a classic C2 anomaly. Option D is correct because malware beacons often call back at fixed, high-frequency intervals (e.g., every 60 seconds) to receive commands, and such regular periodicity is rare in legitimate user-driven traffic. Option E is correct because connections to known malicious infrastructure or newly registered domains are strong threat-intelligence indicators of C2, since legitimate services rarely rely on freshly created domains. Option A does not belong because standard web browsing during working hours is expected baseline activity, not an anomaly. Option B does not belong because high-volume internal server traffic is typically normal east-west data center communication rather than a C2 indicator.

Answer

Standard web browsing traffic during working hours.

Answer

High volume of legitimate internal server traffic.

Question 4

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

Accepted Answer

Malware Hashes. Options B and D are correct because tactical intelligence consists of the specific, machine-readable indicators of compromise (IOCs) that security tools consume to detect and block active threats in the short term. Malware hashes (B) are cryptographic fingerprints (e.g., MD5/SHA-256 values) of known malicious files that endpoint and antivirus systems use for immediate signature-based detection. C2 IP addresses (D) are network indicators of command-and-control infrastructure that firewalls, IDS/IPS, and proxies can block to disrupt an ongoing attack. In contrast, geopolitical threat assessments (A) and industry trend analysis (E) are strategic intelligence, focused on long-term, high-level risk context rather than immediate operational indicators, and executive risk summaries (C) are management-level reporting that translates intelligence for business decision-makers rather than tactical detection data.

Answer

Geopolitical threat assessments

Answer

Executive risk summaries

Answer

Industry trend analysis

Question 5

Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?

Accepted Answer

Verify network connectivity (e.g., ping/telnet).. Option B is correct because a failed TAXII 2.1 connection often stems from basic reachability problems, so verifying network connectivity with tools like ping or telnet to the server's host and port (typically 443 for HTTPS) confirms whether the endpoint is reachable before deeper troubleshooting. Option C is correct because TAXII 2.1 servers are accessed over HTTPS, and an invalid, expired, or untrusted TLS certificate chain will cause the client's TLS handshake to fail, so validating the certificate chain (issuer, expiration, and trust anchors) is essential. Option E is correct because TAXII 2.1 servers commonly require authentication via HTTP Basic, Bearer tokens, or similar API credentials, and invalid or expired credentials will result in 401/403 responses that break the connection. Option A is not appropriate because reinstalling the operating system is a drastic, unrelated action that does not address TAXII connectivity issues. Option D is not appropriate because the TAXII protocol specification is a fixed standard and should never be modified during troubleshooting.

Answer

Reinstall the operating system.

Answer

Modify the TAXII protocol specification.

Question 6

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

Accepted Answer

The ratio of high-value intelligence reports produced that directly answered PIRs versus total raw data collected. Collection Efficiency measures how well the collection process converts raw data into intelligence that answers Priority Intelligence Requirements (PIRs). The ratio of high-value reports that directly answered PIRs to total raw data collected captures this conversion rate — a high ratio means the collection sources are well-targeted and not producing excessive noise. This is the standard CTI metric for evaluating whether collection resources are being used effectively.

Answer

The number of firewall rule changes approved by change management

Answer

The total financial cost of commercial intelligence subscriptions divided by the number of employees

Answer

The average time it takes an analyst to write a quarterly report

Question 7

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Accepted Answer

Time-series analysis of IP resolution logs.. Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.

Answer

Vulnerability scanning.

Answer

Qualitative SWOT analysis.

Answer

Static analysis of the malware binary.

Question 8

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Accepted Answer

A list of known malicious file hashes. An IOC is a piece of forensic evidence that indicates a system has been compromised.

Answer

A description of an adversary's motivation

Answer

A whitepaper on general cybersecurity trends

Answer

An organization's security policy document

Question 9

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

Accepted Answer

Lockheed Martin Cyber Kill Chain. The Lockheed Martin Cyber Kill Chain (A) is correct because it is a widely adopted intelligence-driven defense model that structures threat intelligence planning and collection by breaking an intrusion into seven sequential phases—Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives—allowing defenders to map intelligence to each stage and disrupt attacks. The MITRE ATT&CK Framework (E) is also correct because it catalogs real-world adversary tactics, techniques, and procedures (TTPs) across the enterprise, mobile, and ICS matrices, providing a common taxonomy that organizations use to structure threat intelligence collection, prioritize defenses, and align detection engineering with observed adversary behavior. The remaining options do not belong: SMTP (B) and HTTPS RFC standards (C) are communication protocol specifications, not threat intelligence or defense-operation frameworks, and BIOS/UEFI firmware specifications (D) define platform boot firmware interfaces, which are unrelated to structuring threat intelligence planning, collection, or defense operations.

Answer

Simple Mail Transfer Protocol (SMTP) specification

Answer

Hypertext Transfer Protocol Secure (HTTPS) RFC standards

Answer

Basic Input/Output System (BIOS) UEFI firmware specifications

Question 10

A CTI analyst is tasked with developing a collection plan to support the organization's intelligence requirements. The analyst must prioritize sources based on reliability, relevance, and cost. Which of the following criteria should be the PRIMARY consideration when selecting sources?

Accepted Answer

The source's ability to provide timely and actionable information that directly addresses the intelligence requirements.. The primary consideration should be the source's ability to provide timely and actionable information that directly addresses the intelligence requirements. This ensures that collection efforts are driven by decision-maker needs rather than convenience or cost alone. While cost, popularity, and integration are factors, they are secondary to the fundamental purpose of intelligence: supporting timely and informed decisions.

Answer

The source's popularity and widespread use in the industry.

Answer

The source's cost, ensuring it fits within the allocated budget.

Answer

The source's technical format and ease of integration with existing tools.

Question 11

You are an intelligence analyst tasked with disseminating a tactical threat intelligence report to your organization's SOC analysts. The report contains specific IOCs and TTPs that need to be acted upon quickly. Which dissemination method is most appropriate for ensuring timely and actionable delivery to the SOC?

Accepted Answer

Integrate the report into the SIEM or TIP so that IOCs are automatically ingested and alerts are generated.. Tactical intelligence requires rapid dissemination and action. Integrating the report into SIEM or TIP allows for automated ingestion and alerting, ensuring IOCs are acted upon immediately. Other methods like intranet posts, newsletters, or meetings introduce delays and are not optimized for time-sensitive operational response.

Answer

Publish the report on the corporate intranet and send a link via email.

Answer

Include the report in a monthly intelligence newsletter distributed to all employees.

Answer

Schedule a meeting with SOC analysts to walk through the report in detail.

Question 12

A threat intelligence analyst is collecting data from various sources to understand a new malware campaign. The analyst uses both internal telemetry from the organization's SIEM and external reports from commercial threat feeds. Which term best describes the combination of these sources?

Accepted Answer

All-source intelligence. All-source intelligence integrates information from diverse sources, including internal telemetry and external feeds, to create a comprehensive understanding. This approach reduces bias and fills gaps by corroborating data across sources. The other terms refer to specific collection disciplines, not the integration of multiple source types.

Answer

Human intelligence

Answer

Open-source intelligence

Answer

Data fusion

Question 13

During the direction phase of the intelligence cycle, a CTI analyst receives a request from the Chief Information Security Officer (CISO) for intelligence on a specific threat actor group that has been targeting the organization's industry. The analyst must translate this request into a formal intelligence requirement. Which of the following is the most appropriate first step?

Accepted Answer

Clarify the CISO's specific intelligence needs, including the desired format and timeline.. The direction phase emphasizes understanding the consumer's intelligence needs. By clarifying the CISO's specific requirements—such as the focus of the intelligence, the desired format, and the deadline—the analyst can create a precise intelligence requirement that guides efficient collection and analysis. This step prevents misalignment and ensures the final product meets the consumer's expectations.

Answer

Immediately begin collecting data from all available sources about the threat actor.

Answer

Draft a comprehensive report on the threat actor using existing internal data.

Answer

Escalate the request to the incident response team for immediate action.

Question 14

An analyst is enriching indicators of compromise before publishing them for detection engineering. Which action best reflects sound intelligence preparation for an IP address indicator?

Accepted Answer

Record the IP with a confidence rating, a first-seen and last-seen timestamp, and context describing the associated campaign.. Indicators are perishable and only useful when accompanied by confidence, observation windows, and campaign context, which allow consumers to assess relevance and lifetime. Recording first-seen and last-seen times in particular enables retrospective hunting and prevents stale blocking rules from persisting long after the adversary has moved infrastructure.

Answer

Convert the IP address into a hash so it can be matched against endpoint detection rules.

Answer

Publish the raw IP address alone so consumers can block it immediately without further processing.

Answer

Escalate the IP directly to the incident response team as a confirmed compromise indicator.

Question 15

A CTI analyst is defining Intelligence Requirements (IRs) for a new threat intelligence program. The CISO asks the analyst to ensure that the IRs are both actionable and aligned with the organization's risk appetite. Which of the following is the MOST appropriate first step in this process?

Accepted Answer

Conduct a stakeholder workshop to identify critical assets and business processes.. The correct answer is to conduct a stakeholder workshop to identify critical assets and business processes. This step ensures that Intelligence Requirements are grounded in the organization's actual risk landscape and business objectives, making them actionable and aligned with the CISO's risk appetite. It also facilitates prioritization and consensus among stakeholders, which is essential for a successful CTI program.

Answer

Review past incident reports to identify all previous attacker techniques.

Answer

Deploy a SIEM and begin collecting all available log sources.

Answer

Subscribe to multiple threat intelligence feeds to gather as much data as possible.