312-85 Practice Test 2 — 10 Questions

Question 1

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 2

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Accepted Answer

Data Exfiltration. This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.

Answer

Reconnaissance of the target

Answer

Establishing a backdoor

Answer

Sending phishing emails

Question 3

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Accepted Answer

Monitor for anomalous process execution patterns. Because they use legitimate tools, you must focus on behavioral detection (Tactic-Technique-Procedure analysis) rather than signature-based file detection.

Answer

Scan for known malware signatures

Answer

Update firewall rules for all known ports

Answer

Focus on file hash blacklisting

Question 4

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Accepted Answer

Endpoint Detection and Response (EDR). The Installation phase involves the malware establishing a persistent foothold on the host, which is best detected by host-based security tools like EDR.

Answer

DNS sinkholing

Answer

Email gateway filtering

Answer

Social engineering training

Question 5

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

Accepted Answer

Assuming historical trends will continue indefinitely without accounting for environmental shifts.. Extrapolating short-term patterns into long-term certainties is a common error in trend analysis.

Answer

Ignoring the total volume of data available.

Answer

Collecting too much data from different sources.

Answer

Using visual graphs to display the results.

Question 6

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Accepted Answer

number_observed. Observed data objects record the 'first_observed', 'last_observed', and 'number_observed' properties to provide context to the sighting.

Answer

vulnerability_scanner_id

Answer

root_password

Question 7

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

Accepted Answer

JSON Schema Validator.. JSON Schema validation is the standard method for verifying the structure and types of JSON data.

Answer

Netstat.

Answer

Nmap.

Answer

Wireshark.

Question 8

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

Accepted Answer

Delivery. Social engineering and phishing attacks occur during the Delivery phase, which is best addressed by human-centric training.

Answer

Weaponization

Answer

Installation

Answer

Actions on Objectives

Question 9

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence, Defense Evasion, and Privilege Escalation are essential for staying on a system and remaining undetected.

Answer

Exfiltration

Answer

Reconnaissance

Question 10

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

Accepted Answer

TLP:RED. TLP:RED is used for information that cannot be shared outside of the specific recipients, which is appropriate for sensitive zero-day intelligence.

Answer

TLP:GREEN

Answer

TLP:AMBER

Answer

TLP:CLEAR