312-85 Practice Test 19 — 15 Questions

Question 1

A threat intelligence analyst is processing a set of indicators and needs to ensure that the data is properly enriched and contextualized before dissemination. Which TWO of the following actions are appropriate during the processing phase of the threat intelligence lifecycle? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Normalizing indicators to a consistent format. During the processing phase, analysts normalize and enrich indicators to ensure consistency and add context. Normalization standardizes data formats, while enrichment appends valuable information like geolocation or WHOIS. These steps prepare intelligence for analysis and dissemination. Dissemination, collection, and deployment are separate phases and not part of processing.

Answer

Collecting indicators from new OSINT sources

Answer

Disseminating indicators to stakeholders via email

Answer

Deploying indicators to security controls like firewalls

Question 2

A CTI analyst is developing a set of Specific Intelligence Requirements (SIRs) to support the organization's PIRs. The analyst must ensure that each SIR is measurable and time-bound. Which of the following is the BEST example of a well-formulated SIR?

Accepted Answer

Determine whether APT29 has exploited CVE-2023-1234 against our email servers in the last 90 days.. The best example is determining whether APT29 has exploited CVE-2023-1234 against the organization's email servers in the last 90 days. This SIR is specific, measurable, and time-bound, directly supporting intelligence requirements. It allows the analyst to focus collection and analysis on a clear question, yielding actionable intelligence that can inform defensive actions. The other options are either too broad, vague, or lack measurable criteria.

Answer

Monitor dark web forums for any mentions of our company name.

Answer

Identify all threat actors targeting the financial sector within the next 30 days.

Answer

Understand the tactics, techniques, and procedures (TTPs) of ransomware groups.

Question 3

A threat hunter is asked to determine whether a suspected intrusion involved beaconing over HTTPS to an external command-and-control server. The organization has full network metadata but no TLS interception. Which hunting approach is most appropriate to identify beaconing behavior without decrypting traffic?

Accepted Answer

Analyze connection periodicity, duration, and byte-count symmetry for repeated sessions to the same external destination.. Without TLS interception, beaconing is best detected through traffic metadata: regular connection intervals, consistent session durations, and stable payload sizes to the same external destination. SNI, certificates, and DNS cache entries reveal naming and authentication details but not application data, and encrypted HTTP response codes are not observable, so metadata periodicity analysis is the appropriate method.

Answer

Correlate HTTP response codes from the external server with the internal host's DNS cache entries.

Answer

Decode the TLS certificate chain presented by each external server to read the encrypted application data.

Answer

Inspect the Server Name Indication field to recover the plaintext contents of each HTTPS request.

Question 4

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Accepted Answer

Indicators of Compromise. The Indicators of Compromise (IOCs) section is the most critical for incident responders because it contains the concrete, actionable artifacts — file hashes, IP addresses, domain names, registry keys, mutexes — that responders use to search their environment for signs of the malware. Without IOCs, responders cannot perform the host and network sweeps needed to confirm local presence. Attribution, mitigation, and executive summary provide context but do not enable detection.

Answer

Threat Actor Attribution

Answer

Mitigation Strategy

Answer

Executive Summary

Question 5

You are analyzing an intrusion set and need to assess how consistently a specific adversary group has targeted your industry over the past 18 months. You have a feed of 4,200 indicators, but 3,100 of them are domain names that resolve to shared CDN infrastructure used by thousands of legitimate sites. Which structured analytic technique is MOST appropriate to reduce this noise before you draw conclusions about targeting patterns?

Accepted Answer

Apply pivoting on the shared infrastructure to cluster indicators by hosting ASN, then filter clusters that also contain non-targeted victim domains.. The scenario requires separating adversary-specific infrastructure from commodity shared hosting before analyzing targeting patterns. Pivoting on hosting ASN and filtering clusters that contain non-targeted victims directly addresses that requirement by removing indicators with low discriminative value. The other techniques either fail to reduce CDN noise, introduce resolution artifacts, or artificially inflate confidence without improving data quality.

Answer

Convert the domain indicators to IP addresses using current passive DNS and re-run the frequency count.

Answer

Increase the confidence rating on all indicators from the feed because the feed is a commercial source.

Answer

Run all 4,200 indicators through a sandbox and retain only those that trigger a malicious verdict.

Question 6

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Accepted Answer

PowerShell Script Block Logging. PowerShell Script Block Logging (Option A) is critical because fileless malware frequently executes malicious code through PowerShell without writing a payload to disk, and Script Block Logging (Event ID 4104) captures the full de-obfuscated script content that defenders need for detection and analysis. WMI Repository contents (Option B) are equally important because fileless attacks commonly abuse WMI for persistence and execution via event subscriptions and __EventFilter/CommandLineEventConsumer classes stored in the repository, which leaves no traditional executable on disk. In contrast, File System MFT records (Option C) mainly track file creation and metadata, which is largely irrelevant when the attack avoids dropping files, and Browser Cache History (Option D) only reflects web browsing artifacts unrelated to in-memory or WMI-based execution. Windows Update logs (Option E) record patching activity and have no bearing on detecting fileless malware techniques.

Answer

File System MFT records

Answer

Browser Cache History

Answer

Windows Update logs

Question 7

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

Accepted Answer

Damage. DREAD is a risk assessment model with five factors: Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. The 'D' stands for Damage, which rates how severe the impact would be if the threat were realized.

Answer

Deployment

Answer

Detection

Answer

Data loss

Question 8

A CTI analyst is conducting a review of the intelligence requirements after a series of false positives from automated collection tools. The review aims to refine the requirements to reduce noise. Which of the following actions best addresses this issue?

Accepted Answer

Increase the specificity of the Essential Elements of Information (EEIs) to focus collection on precise indicators.. Increasing the specificity of EEIs directly addresses false positives by making collection criteria more precise, ensuring that only relevant information is gathered. This refinement helps align collection with the actual intelligence needs, reducing noise and improving the signal-to-noise ratio without sacrificing coverage of critical threats.

Answer

Broaden the scope of the intelligence requirements to capture more data for analysis.

Answer

Reduce the number of intelligence requirements to only those that are easiest to collect.

Answer

Disable automated collection tools and rely solely on manual analysis.

Question 9

A threat intelligence analyst is building a report on an advanced persistent threat (APT) group that has been observed targeting a government contractor. The analyst wants to characterize the group's operational infrastructure using the Diamond Model of Intrusion Analysis. Which TWO of the following activities would the analyst classify as belonging to the Infrastructure axis? (Choose two.)

Accepted Answer

A set of domains registered through a privacy-protected registrar and resolved via a fast-flux DNS scheme. The Diamond Model's Infrastructure axis captures the physical and logical resources the adversary controls or rents, such as hosting providers, domains, and DNS schemes. A bulletproof host and a fast-flux domain set are both adversary-controlled platforms used to stage tools and route traffic. The custom loader is a capability, the victim VPN concentrator is victim-owned, and the phishing email is a delivery method rather than infrastructure.

Answer

A victim organization's externally exposed VPN concentrator that the group later exploited

Answer

A spear-phishing email that delivers a malicious shortcut file to a finance employee

Answer

A custom loader that injects a beacon into the memory of a legitimate signed process

Question 10

You are reviewing a large NetFlow data set and observe an internal workstation sending 40-byte UDP packets to a single external IP address every 60 seconds for several days, with almost no return traffic. Which analytic interpretation is most appropriate?

Accepted Answer

This pattern is consistent with command-and-control beaconing and warrants endpoint and DNS investigation.. Fixed-interval, low-volume, unidirectional traffic to a single external host is a textbook beaconing indicator in network flow analysis. The analyst should pivot to DNS logs, endpoint process data, and destination reputation to determine whether the traffic is authorized software or an implanted controller channel before escalating or closing the lead.

Answer

This pattern is consistent with a distributed denial-of-service attack originating from the workstation.

Answer

This pattern is consistent with a misconfigured NTP client and requires no further action.

Answer

This pattern is consistent with normal software update polling and can be dismissed as benign.

Question 11

You are conducting threat intelligence research on a newly discovered APT group. You have collected various data points. Which TWO of the following are considered Tactics, Techniques, and Procedures (TTPs) according to the MITRE ATT&CK framework? (Choose two.)

Accepted Answer

The group uses PowerShell to execute Base64-encoded commands for defense evasion.. TTPs in the MITRE ATT&CK framework refer to the tactics (goals), techniques (methods), and procedures (specific implementations) that adversaries use. Spear-phishing with malicious attachments and PowerShell with Base64 encoding are both techniques, reflecting how the adversary operates. The other options are atomic indicators like hashes, IP addresses, and strings, which are not TTPs.

Answer

The group's C2 server is located at IP address 192.0.2.10.

Answer

The group's malware contains a specific string 'XYZ123'.

Answer

The group uses a specific malware hash (e.g., SHA256: 3a4b...).

Question 12

Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?

Accepted Answer

-WindowStyle Hidden. Option A, -WindowStyle Hidden, is highly suspicious because it deliberately conceals the PowerShell console window from the user, a common technique in malware and post-exploitation frameworks to hide malicious activity from the victim. Option B, -EncodedCommand, is highly suspicious because it accepts a Base64-encoded command string, which attackers use to obfuscate payloads and evade simple string-based detection in command-line telemetry. In contrast, -File (C) is a normal parameter for executing a script file and is routinely used in legitimate administration, -InputFormat (D) merely specifies the input format (e.g., XML or text) for commands and is benign, and -Version (E) only selects which PowerShell engine version to run and carries no inherent malicious intent.

Answer

-File

Answer

-InputFormat

Answer

-Version

Question 13

You are an analyst at a financial services firm. Your team has collected a large set of indicators of compromise (IOCs) from an open-source feed. Before integrating them into your SIEM for automated blocking, you need to perform data enrichment. Which of the following best describes the primary goal of enriching these IOCs with contextual data?

Accepted Answer

To add context such as geolocation, WHOIS, and reputation to assess relevance and priority.. Enrichment adds context such as geolocation, WHOIS, and reputation to raw IOCs. This context allows analysts to assess relevance and priority, which is essential before integrating indicators into automated systems. In a financial services firm, blocking an IOC without understanding its context could disrupt legitimate transactions or customers, so enrichment is a critical step.

Answer

To convert all indicators into a standardized format like STIX.

Answer

To automatically block all indicators without human review.

Answer

To increase the total number of indicators available for detection.

Question 14

A CTI analyst is tasked with creating a collection plan for a new intelligence requirement focused on advanced persistent threat (APT) actors targeting the organization's cloud infrastructure. The analyst must consider various factors to ensure the plan is effective. Which TWO of the following are essential components of an effective collection plan for this requirement? (Choose two.)

Accepted Answer

Defining specific intelligence questions that the collection should answer.. An effective collection plan must start with specific intelligence questions to guide collection and then identify and prioritize the most relevant sources. These two components ensure that the plan is focused on the APT threat to cloud infrastructure and that resources are allocated efficiently. Without clear questions and prioritized sources, collection may be unfocused and fail to produce actionable intelligence.

Answer

Establishing a schedule for automated data ingestion from all available sources.

Answer

Creating a detailed budget for acquiring new threat intelligence tools.

Answer

Developing a process for disseminating raw data to all stakeholders immediately.

Question 15

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Accepted Answer

number_observed. In STIX 2.1, the Observed Data SDO is designed to convey cyber observable information along with the time window and count of observations, so option A (number_observed) is correct because it is a required integer property recording how many times the data was seen. Option D (last_observed) is correct because it is a required timestamp property marking the end of the observation period. Option E (first_observed) is correct because it is a required timestamp property marking the beginning of the observation period. The unmarked options do not belong: vulnerability_scanner_id is not a defined STIX 2.1 Observed Data property, and root_password is not a STIX property at all (and would be inappropriate sensitive data to store in this object).

Answer

vulnerability_scanner_id

Answer

root_password