312-85 Practice Test 18 — 15 Questions

Question 1

A manufacturing firm's CTI analyst receives a report describing a new malware loader used by a financially motivated group. The report lists file hashes but no context on targeting or exploitation. The analyst must decide how to classify and route this intelligence internally. Which action best reflects sound intelligence practice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enrich the report with targeting and TTP context, assess relevance to the firm, then disseminate to detection and leadership as appropriate. Intelligence gains value when analysts add context and tailor it to the consumer. Enriching the report with targeting and TTP information, judging its relevance to a manufacturing environment, and disseminating appropriately to technical and business audiences turns raw indicators into actionable intelligence. Blocking blindly, forwarding raw data upward, or discarding incomplete reports all skip essential analysis steps.

Answer

Forward the full report unchanged to the executive team and await direction

Answer

Immediately block the hashes at the perimeter and close the ticket as handled

Answer

Discard the report because it lacks targeting information and therefore has no intelligence value

Question 2

You are the lead CTI analyst at a financial services firm. After a recent breach, you must deliver a threat intelligence report to the board of directors. The board has limited technical background but needs to understand the business impact and make risk-based decisions. Which reporting approach is most appropriate for this audience?

Accepted Answer

Deliver a concise executive summary highlighting business impact, risk posture, and recommended strategic actions.. The board of directors requires strategic intelligence that translates technical threats into business risk. An executive summary should focus on impact, risk, and recommended actions, avoiding technical jargon. This enables informed decision-making on resource allocation and policy. Other options are too technical or raw, failing to meet the audience's needs for concise, actionable insights.

Answer

Share the raw threat feed data and let the board draw their own conclusions.

Answer

Provide a tactical report focusing on adversary TTPs and specific detection signatures.

Answer

Provide a detailed technical report with IOCs, YARA rules, and MITRE ATT&CK technique mappings.

Question 3

An analyst is preparing a threat intelligence report that includes a new malware family's capabilities and infrastructure. The report is intended for a closed group of trusted partners under TLP:AMBER. Which of the following is the most critical element to include to ensure the report is both actionable and compliant?

Accepted Answer

A clear TLP:AMBER marking on every page and a statement of handling restrictions.. When disseminating under TLP:AMBER, the most critical element is proper marking and communication of handling restrictions. This ensures recipients understand the sharing limitations and comply with the protocol. While actionable content like IOCs is important, without TLP compliance, the report could be mishandled, leading to unauthorized disclosure and loss of trust.

Answer

A detailed attribution to a specific threat actor group with supporting evidence.

Answer

A recommendation to share the report widely within the partner's industry to maximize defense.

Answer

A list of all IOCs with high confidence scores and detection signatures.

Question 4

During an active ransomware incident, your SOC manager asks you to quickly determine whether the malware family has known lateral movement capabilities against Windows environments. Which threat intelligence product best supports this immediate need?

Accepted Answer

A technical malware analysis report detailing the family's TTPs and MITRE ATT&CK mappings. Technical threat intelligence from malware analysis is the right choice because it documents the specific behaviors and MITRE ATT&CK techniques the ransomware uses, including lateral movement. During an active incident, responders need this behavioral detail to decide on containment and hunting. Strategic, tactical, and operational products serve different purposes and lack the granular capability information required here.

Answer

A tactical feed of current IP addresses and file hashes associated with the ransomware

Answer

A strategic threat intelligence report on ransomware trends in your industry

Answer

An operational report on the ransomware group's campaign targeting patterns and victimology

Question 5

You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?

Accepted Answer

Develop an ETL/transformation script.. The critical step is to develop an ETL/transformation script because STIX (Structured Threat Information Expression) is a JSON-based language for cyber threat intelligence, while CSV is a flat, tabular format. A transformation script extracts relevant fields from STIX objects (e.g., indicators, observed-data), maps them to CSV columns, and handles nested structures. Without this, the SIEM cannot ingest the data. This is a classic ETL (Extract, Transform, Load) requirement when bridging incompatible data formats.

Answer

Ignore the format mismatch.

Answer

Enable automatic STIX parsing in the SIEM engine.

Answer

Increase the SIEM storage capacity.

Question 6

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Accepted Answer

Determine the Tactic and map the specific Technique ID.. MITRE ATT&CK is organized as a matrix of Tactics (the adversary's goal, e.g., Persistence, Defense Evasion) and Techniques (how the goal is achieved, e.g., T1574.002 DLL Side-Loading). To map an observation like DLL Side-Loading, the analyst identifies the relevant Tactic (Defense Evasion, and often Persistence or Privilege Escalation) and then maps the specific Technique ID. This is the standard analytical workflow for ATT&CK-based threat mapping.

Answer

Perform a Root Cause Analysis on the operating system.

Answer

Use the CVSS score of the DLL to prioritize the threat.

Answer

Calculate the frequency of the DLL calls to determine the actor intent.

Question 7

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

Accepted Answer

Internal IDS/IPS and firewall logs. Option A (Internal IDS/IPS and firewall logs) is correct because these are machine-generated telemetry from security controls that capture indicators such as source/destination IPs, ports, protocols, and signature matches, which is the essence of technical threat intelligence. Option C (Malware sandbox reports) is correct because sandboxing dynamically executes suspicious files and extracts technical artifacts like hashes, C2 domains/IPs, registry keys, and MITRE ATT&CK techniques. The unmarked options do not belong: legislative changes (B) are legal/policy intelligence, interviews with industry peers (D) are human-source or tactical/strategic context, and geopolitical risk analysis (E) is strategic threat intelligence rather than technical.

Answer

Legislative changes in cybersecurity law

Answer

Interviews with industry peers

Answer

Geopolitical risk analysis reports

Question 8

Which TWO of the following are primary goals of conducting a threat modeling exercise on a new software application?

Accepted Answer

To define security requirements based on the risk profile.. Option C is correct because threat modeling is performed early in the SDLC to derive and prioritize security requirements (e.g., authentication, authorization, input validation, encryption) directly from the identified threats and the application's risk profile, ensuring controls are proportionate to risk. Option E is correct because the core purpose of threat modeling is to proactively identify potential security flaws, attack vectors, and design weaknesses (using frameworks like STRIDE or attack trees) before code is written or deployed, when remediation is cheapest. Option A is incorrect because a marketing brochure is a promotional artifact unrelated to security analysis. Option B is incorrect because UI standards concern usability and design consistency, not threat identification or risk-based security requirements. Option D is incorrect because threat modeling complements, but never replaces, automated unit testing, which verifies code-level correctness and behavior.

Answer

To provide a complete marketing brochure for the software.

Answer

To ensure the software meets the latest UI standards.

Answer

To replace the need for automated unit testing.

Question 9

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

Accepted Answer

High volume of TXT record queries. DNS tunneling exfiltrates data or establishes C2 by encoding payloads in DNS query names and responses, most commonly using TXT records because they can carry arbitrary text up to 255 characters per string and are rarely queried in bulk during normal operations. A high volume of TXT record queries — especially to a single domain or with long, encoded subdomains — is a strong indicator of tunneling tools like iodine, dnscat2, or DNSExfiltrator.

Answer

Low volume of DNS failures

Answer

High volume of A record queries

Answer

Frequent SRV record updates

Question 10

An analyst is collecting threat intelligence from a new OSINT source that provides indicators in a structured format. The analyst needs to ensure that the data is ingested into the threat intelligence platform (TIP) without manual reformatting. Which data format is most commonly supported by TIPs for automated ingestion?

Accepted Answer

STIX 2.1. STIX 2.1 is the industry standard for structured threat intelligence, and TIPs commonly support it for automated ingestion. It provides a well-defined schema that allows platforms to parse and ingest data without manual reformatting. Other formats like PDF, CSV, or plain text lack the standardized structure needed for seamless automation, making STIX 2.1 the correct choice.

Answer

PDF reports

Answer

CSV files

Answer

Plain text emails

Question 11

A junior analyst is tasked with creating a report for the SOC manager on the current threat landscape. The analyst has collected data from various sources, including open-source reports, internal incident tickets, and premium feeds. Which phase of the threat intelligence lifecycle should the analyst focus on to ensure the report is tailored to the organization's specific needs?

Accepted Answer

Planning and Direction. The Planning and Direction phase is where the analyst defines the intelligence requirements based on the SOC manager's needs. This ensures the report focuses on relevant threats and is tailored to the organization. Without this phase, the report may be generic and not actionable for the SOC.

Answer

Analysis

Answer

Collection

Answer

Dissemination

Question 12

A threat intelligence analyst is collecting data from a dark web forum to identify emerging threats. The analyst uses a web scraping tool that automatically extracts posts and user metadata. After several hours, the tool is blocked and the analyst's IP is banned. Which of the following is the most likely cause of the block, and what should the analyst have implemented to prevent it?

Accepted Answer

The tool triggered rate limiting; the analyst should have used rotating proxies and randomized delays.. The most likely cause of the block is that the scraping tool exceeded the forum's rate limits. To prevent this, the analyst should have implemented rotating proxies and randomized delays to distribute requests and mimic human behavior. Other measures like VPNs, headless browsers, or TLS do not directly address rate limiting.

Answer

The tool did not use a VPN; the analyst should have connected through a Tor exit node.

Answer

The tool did not parse JavaScript; the analyst should have used a headless browser.

Answer

The tool used HTTP instead of HTTPS; the analyst should have enforced TLS.

Question 13

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

Accepted Answer

TLP:RED. TLP:RED is used for information that cannot be shared outside of the specific recipients, which is appropriate for sensitive zero-day intelligence.

Answer

TLP:GREEN

Answer

TLP:AMBER

Answer

TLP:CLEAR

Question 14

A threat hunter is reviewing PowerShell operational logs collected via Windows Event Forwarding and notices Event ID 4104 entries that contain a script block defining a function which, when invoked, calls System.Net.WebClient.DownloadString with a hard-coded IP address and then passes the returned content to Invoke-Expression. The parent process is winword.exe. Which hunting conclusion is most defensible?

Accepted Answer

The script block logging captured a defensible indicator of a macro-driven download-and-execute chain that warrants escalation and endpoint containment.. The combination of de-obfuscated script block content, a download cradle using System.Net.WebClient, execution through Invoke-Expression, a hard-coded IP, and Office parentage forms a coherent attack chain that a hunter can defend. Escalation is warranted because the telemetry captures both intent and mechanism.

Answer

The event should be ignored because Event ID 4104 only records the script's file path and never the actual code that ran.

Answer

The event proves a remote code execution vulnerability in Word was exploited, because winword.exe parentage always indicates memory corruption exploitation.

Answer

The event is benign because Script Block Logging only fires for scripts run through the PowerShell ISE, and Word cannot launch the ISE in this manner.

Question 15

A CTI analyst is conducting a review of the intelligence program after six months of operation. The review reveals that several PIRs are no longer relevant due to a recent merger and acquisition. The analyst must realign the intelligence requirements with the new business strategy. Which of the following activities should the analyst perform FIRST to ensure the requirements remain effective?

Accepted Answer

Re-interview key stakeholders to update intelligence needs. Following a merger, business priorities change, so the first step is to re-engage stakeholders to capture new intelligence requirements. This ensures that subsequent activities like collection and analysis are aligned with the updated strategy. Without this step, any adjustments to collection or frameworks may be based on obsolete needs, leading to wasted effort and ineffective intelligence support.

Answer

Revise the collection management framework

Answer

Immediately expand collection sources to cover new assets

Answer

Perform a gap analysis of existing intelligence holdings