312-85 Practice Test 2 — 10 Questions

Question 1

A threat hunter reviewing Windows Security event logs notices that a service account's credentials were used to authenticate to 14 workstations within a 3-minute window, all successful logons with Logon Type 3. No scheduled tasks or administrative scripts are known to run under this account. Which hypothesis best explains this pattern and should drive the next hunt step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The account is being used for lateral movement via SMB or remote service execution, and the hunter should pivot to Event ID 5140/5145 and service creation telemetry on the target hosts.. A burst of successful Logon Type 3 authentications from one service account across many workstations is a strong lateral movement indicator. Attackers using SMB, remote service creation, or remote execution tools generate exactly this footprint. The productive next step is to pivot to the destination hosts and examine share access, service installation, and process creation events to determine what was executed after authentication.

Answer

The account is being brute-forced by an external attacker, and the hunter should immediately review Event ID 4625 failures on the domain controller.

Answer

The workstations are performing a scheduled vulnerability scan using domain credentials, and the hunter should correlate with the scanner's IP range before escalating.

Answer

The account is experiencing a Kerberos ticket renewal storm, and the hunter should analyze Event ID 4769 service ticket requests on the KDC.

Question 2

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

Accepted Answer

Access to lsass.exe. Mimikatz is a credential-dumping tool that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Its primary target is the Local Security Authority Subsystem Service (lsass.exe), which stores credential material in Windows. Therefore, the most common indicator of credential dumping is a process accessing lsass.exe memory, often via OpenProcess with PROCESS_VM_READ and ReadProcessMemory calls.

Answer

Access to csrss.exe

Answer

Access to svchost.exe

Answer

Access to explorer.exe

Question 3

A threat hunter is investigating possible data staging prior to exfiltration on a file server. The hunter has full Windows Security auditing, Sysmon, and PowerShell logging available. Which TWO telemetry patterns most directly indicate that an adversary is staging and compressing collected data on the host? (Choose two.)

Accepted Answer

A single process creating a large number of file read operations across many directories within a short window, followed by writes to one new archive file.. Staging is characterized by broad collection followed by consolidation into a single archive, and by archiving that deviates from normal administrative patterns. Reading many directories then writing one archive, and creating an encrypted archive with a non-standard extension from a web server parent, both directly evidence that behavior.

Answer

Repeated DNS queries from the server to a single external domain at irregular intervals with varying query types.

Answer

A high volume of failed authentication attempts against the file server from multiple internal workstations.

Answer

Scheduled tasks created by the built-in backup service account to copy files to a known backup share each night.

Question 4

A security analyst is mapping adversary behavior to the MITRE ATT&CK framework. The analyst observes that the adversary is using the 'Spearphishing Attachment' technique. Under which ATT&CK tactic does this technique fall?

Accepted Answer

Initial Access. Spearphishing Attachment is categorized under the Initial Access tactic in MITRE ATT&CK because it is a method adversaries use to gain an initial foothold into a network. The technique involves sending a phishing email with a malicious attachment, which aligns with the goal of initial access. Other tactics like Execution, Persistence, and Privilege Escalation describe different phases of an attack, not the initial entry point.

Answer

Persistence

Answer

Privilege Escalation

Answer

Execution

Question 5

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Accepted Answer

Logon Type 3 occurring from a workstation to a workstation. Option A is correct because Pass-the-Hash (PtH) abuses NTLM authentication to move laterally, and a Logon Type 3 (network logon) from one workstation to another is abnormal in most environments and is a classic signature of PtH lateral movement using stolen NTLM hashes. Option B is correct because a successful logon originating from an unexpected or unusual source IP indicates an attacker is authenticating with compromised credentials/hashes from a host that should not be initiating such access, which is a strong PtH indicator. Option D is correct because PtH relies on NTLM authentication (the hash is replayed directly), so observing NTLM authentication where Kerberos would normally be expected (e.g., in a domain environment that supports Kerberos) is a strong indicator of hash-based authentication abuse. Option C is not a PtH indicator because successful local service startup is normal system behavior and unrelated to credential theft or replay. Option E is not a PtH indicator because a high volume of Kerberos TGS requests suggests Kerberos ticket activity (e.g., Kerberoasting or normal service ticket requests), not NTLM hash replay.

Answer

Success of local service startup

Answer

High volume of Kerberos TGS requests

Question 6

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Accepted Answer

Percentage of intelligence reports that result in actionable security controls or detection rules. Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.

Answer

Number of threat intelligence blog posts published on the corporate website

Answer

Total gigabytes of threat data ingested from commercial feeds per month

Answer

Total number of security alerts generated by the SIEM

Question 7

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 8

A security analyst is reviewing threat intelligence reports and notices that an APT group frequently uses zero-day exploits and custom malware to target government agencies. The group maintains long-term access to victim networks and exfiltrates sensitive data over extended periods. Which characteristic best distinguishes this group as an Advanced Persistent Threat (APT)?

Accepted Answer

Long-term persistence and stealthy exfiltration. Advanced Persistent Threats (APTs) are defined by their persistence, stealth, and long-term focus. They maintain access to victim networks over extended periods, often exfiltrating data slowly to avoid detection. While zero-days, custom malware, and specific targets are common, the core distinguishing feature is the persistent and stealthy nature of the campaign.

Answer

Use of custom malware

Answer

Targeting government agencies

Answer

Use of zero-day exploits

Question 9

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Accepted Answer

Pivot to identify the Capability or Adversary. After identifying infrastructure, the next step is to pivot to identify the associated Capability or Adversary, creating a chain of evidence.

Answer

Update the firewall blacklist only

Answer

Change all user passwords

Answer

Close the incident ticket

Question 10

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Accepted Answer

Reconnaissance. Reconnaissance (A) is effectively defended at the network level because controls such as firewalls, IDS/IPS, and DNS/WHOIS privacy can hide or limit the information an adversary gathers during active scanning and enumeration. Delivery (B) is a network-level phase since malicious payloads arrive via email, web downloads, or exploit kits, and controls like secure email gateways, web proxies, and IPS signatures can block or quarantine them in transit. Command and Control (E) is also network-defensible because C2 traffic relies on protocols such as HTTP/HTTPS, DNS, or custom ports, and egress filtering, DNS sinkholing, and NGFW/IDS detection can disrupt beaconing. Installation (C) typically occurs on the endpoint after code execution, so it is better addressed by host-based controls like EDR, application allowlisting, and patching rather than network controls. Actions on Objectives (D) happen post-compromise on internal systems and data, requiring host, identity, and data-level defenses such as EDR, least privilege, and DLP instead of purely network-level security.

Answer

Installation

Answer

Actions on Objectives