312-85 Practice Test 20 — 15 Questions

Question 1

A CTI team is conducting a requirements review with stakeholders to ensure the intelligence program remains aligned with business objectives. Which TWO activities are essential during this review? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assessing whether current intelligence products are meeting stakeholder needs.. The essential activities are assessing whether current intelligence products meet stakeholder needs and updating requirements based on changes in the threat landscape and business priorities. These activities ensure the program remains aligned with business objectives, delivers value, and adapts to evolving risks. They also foster stakeholder engagement and continuous improvement, which are critical for a successful CTI program.

Answer

Conducting a penetration test to identify vulnerabilities.

Answer

Replacing all existing intelligence requirements with new ones from scratch.

Answer

Increasing the number of intelligence feeds to cover more sources.

Question 2

Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?

Accepted Answer

Industry vertical focus. Option A (Industry vertical focus) is correct because threat intelligence relevance depends on whether the feed targets threats, actors, and campaigns specific to your sector (e.g., finance, healthcare, energy), since adversaries and TTPs differ by industry. Option C (Technology stack alignment) is correct because a feed is only actionable if it covers the platforms, software, and vulnerabilities you actually run — indicators for products absent from your environment add noise rather than detection value. Option D (Geographical region coverage) is correct because threats are often region-specific (e.g., APT groups, regional fraud campaigns, local regulatory-targeted attacks), so feeds must cover the geographies where you operate and host infrastructure. Option B (Number of API calls) is not a relevance factor but a technical/operational integration metric affecting throughput and licensing, not whether the intelligence matches your threat profile. Option E (Cost of the feed) is a budgetary/procurement consideration, not an indicator of whether the intelligence is relevant to your organization's risk exposure.

Answer

Number of API calls

Answer

Cost of the feed

Question 3

You are an analyst at a government agency. You need to share a threat intelligence report with a trusted partner in the private sector. The report contains indicators that are sensitive and should not be shared publicly. Which dissemination method is most appropriate?

Accepted Answer

Send the report via encrypted email to the specific partner contact.. Encrypted email to a specific partner contact is the most appropriate method because it ensures the report is delivered only to the intended recipient and protects it during transmission. Public posting, closed mailing lists, and public file-sharing services either violate TLP restrictions or lack the necessary security controls. This method balances confidentiality and timeliness, aligning with best practices for disseminating sensitive threat intelligence.

Answer

Post the report on a public-facing website with a TLP:RED marking.

Answer

Share the report on a closed industry mailing list with TLP:GREEN.

Answer

Upload the report to a public file-sharing service and send the link to the partner.

Question 4

You are drafting a threat intelligence report for an internal audience that includes both technical staff and non-technical executives. The report contains actionable indicators and a strategic assessment. Which intelligence reporting approach best serves this mixed audience?

Accepted Answer

Produce a single report with both technical details and an executive summary at the top, using clear language and a TLP marking.. The best approach combines an executive summary with technical details in one report, ensuring both audiences receive relevant information without fragmentation. This maintains consistency, respects the TLP marking, and provides actionable intelligence for all recipients. It balances strategic context with operational specifics, which is essential for effective decision-making across the organization.

Answer

Disseminate only the strategic assessment to all audiences to avoid confusion, omitting technical indicators that could aid defense.

Answer

Create two separate reports: one fully technical for staff and one purely strategic for executives, with no cross-references.

Answer

Write a single technical report with extensive jargon and raw indicators, assuming executives will have analysts explain it to them.

Question 5

You are an intelligence analyst tasked with disseminating a tactical threat report to your organization's security operations center (SOC). The report includes specific indicators of compromise (IOCs) and recommended detection rules. Which dissemination method is most appropriate to ensure the SOC can rapidly ingest and act on the IOCs?

Accepted Answer

Provide the IOCs in a structured format such as STIX/TAXII or a CSV file, and push them directly to the SOC's TIP or SIEM.. Using a structured format like STIX/TAXII or CSV and pushing directly to the SOC's tools ensures rapid, automated ingestion of IOCs. This enables immediate detection and response, which is the goal of tactical intelligence dissemination. Other methods require manual intervention and are slower, increasing the window of exposure.

Answer

Email the report as a PDF attachment to the SOC distribution list.

Answer

Include the IOCs in the body of a plain-text email and request that SOC analysts manually add them to the SIEM.

Answer

Publish the report on a shared wiki page and notify the SOC via chat.

Question 6

A threat intelligence analyst is tracking an adversary that has been observed using a unique, custom-built backdoor. The analyst wants to attribute the activity to a known threat group. According to the Diamond Model, which axis should the analyst focus on to link this activity to other events?

Accepted Answer

Capability, because the custom backdoor is a unique tool that can be linked to the adversary's previous operations.. In the Diamond Model, Capability encompasses the adversary's tools and malware. A custom backdoor is a distinctive capability that can be used to correlate activity across incidents, as it is likely unique to the threat group and persists over time. By focusing on Capability, the analyst can pivot to other events where the same tool was used, strengthening attribution.

Answer

Victim, because the targeted organizations can reveal the adversary's intent and help link to other victims.

Answer

Adversary, because the threat group is the entity conducting the attack and should be the focus of attribution.

Answer

Infrastructure, because the backdoor communicates with specific command-and-control servers that can be linked to the adversary.

Question 7

Which THREE of the following are core components of the STIX 2.1 Domain Object (SDO) structure?

Accepted Answer

Threat-Actor. Threat-Actor (A) is a core STIX 2.1 Domain Object (SDO) used to represent the individuals, groups, or organizations believed to be conducting malicious activities. Malware (B) is also a core SDO, defined as malicious code or software such as viruses, worms, or ransomware. Attack-Pattern (C) is a core SDO that describes the techniques or tactics adversaries use to compromise targets, aligning with frameworks like MITRE ATT&CK. TLP-Level (D) is not an SDO; TLP is a marking-definition concept applied via the marking-definition object, not a standalone domain object. TAXII-Server (E) is not an SDO either; TAXII is a separate transport protocol for exchanging STIX content, not part of the STIX domain object model.

Answer

TLP-Level

Answer

TAXII-Server

Question 8

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

Accepted Answer

Dissemination and Feedback. The intelligence cycle is a closed loop: Direction/Planning sets requirements, Collection gathers raw data, Processing turns it into usable form, Analysis produces intelligence, and Dissemination delivers it to consumers. The Feedback component of Dissemination is what tells planners whether the intelligence answered the original requirements, so it directly feeds back into the next Direction and Planning cycle. During a formal requirements review, this feedback loop is the mechanism that realigns intelligence requirements with evolving business goals.

Answer

Processing and Exploitation

Answer

Automated Malware Sandboxing

Answer

Tactical Log Ingestion

Question 9

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Accepted Answer

Threat actor aliases. In the Diamond Model of Intrusion Analysis, the Adversary vertex describes the actor conducting the intrusion, so threat actor aliases (C) belong there because they are the names, handles, or pseudonyms used to identify the adversary. Organizational affiliation (E) is also part of the Adversary vertex because it captures the actor's sponsorship, group membership, or association with a known entity. By contrast, a targeted industry (A) is part of the Victim vertex, an IP address range (B) is part of the Infrastructure vertex, and a malware variant (D) is part of the Capability vertex, so they do not belong to the Adversary vertex.

Answer

Targeted industry

Answer

IP address range

Answer

Malware variant

Question 10

You are responsible for disseminating threat intelligence to both technical and non-technical stakeholders within your organization. To ensure effective communication, which two of the following practices should you follow? (Choose two.)

Accepted Answer

Tailor the level of technical detail to the audience's expertise and role.. Effective dissemination requires tailoring the content to the audience's expertise and using standardized, clear formats to avoid ambiguity. These practices ensure that intelligence is both understandable and actionable for different stakeholders. Including all raw data, using a single channel, or delaying for completeness can reduce the effectiveness and timeliness of the intelligence, making those options incorrect.

Answer

Disseminate only through a single channel to maintain control over the information.

Answer

Delay dissemination until all information is verified and complete to avoid inaccuracies.

Answer

Include all raw data and indicators in every report to ensure completeness.

Question 11

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

Accepted Answer

Calculate the Z-score of the timestamp distribution.. The Z-score measures how many standard deviations a data point is from the mean, making it the appropriate statistical measure to determine if outliers are significant relative to the normal distribution. A high absolute Z-score (typically >3) indicates a statistically significant outlier that may warrant changes to threat modeling.

Answer

Apply the Mode of the frequency dataset.

Answer

Perform a simple Median split.

Answer

Use the Range calculation.

Question 12

A global manufacturing company is establishing a new CTI program. The CISO wants to ensure that intelligence production remains focused on the organization's most critical business assets and that resources are allocated efficiently. Which of the following should the CTI manager produce FIRST to define the specific intelligence needs that support strategic decision-making?

Accepted Answer

Priority Intelligence Requirements (PIRs). Priority Intelligence Requirements (PIRs) are the cornerstone of the direction phase, translating business objectives into specific intelligence questions. They guide collection and analysis, ensuring resources target what matters most. In this scenario, the CISO's emphasis on critical assets and strategic decision-making makes PIRs the necessary first output to focus the CTI program effectively.

Answer

Stakeholder contact list

Answer

Threat Intelligence Platform (TIP) deployment

Answer

Intelligence Collection Plan

Question 13

A threat hunter wants to detect adversary use of scheduled tasks for persistence on Windows endpoints and has Sysmon deployed with a configuration that includes process creation and file creation events. Which approach gives the most direct and reliable detection coverage for newly created scheduled tasks?

Accepted Answer

Monitor Sysmon Event ID 1 for schtasks.exe process creation with create arguments and correlate the resulting task file creation in the Windows Tasks directory.. Correlating schtasks.exe process creation with the task definition file written under the Windows Tasks directory captures both the act of creating persistence and the resulting artifact. This dual-signal approach is more reliable than any single event type and matches the telemetry the hunter already has enabled.

Answer

Monitor Sysmon Event ID 7 for image loads by svchost.exe from non-standard directories.

Answer

Monitor Sysmon Event ID 12 and 13 for registry modifications to the Run key under HKCU.

Answer

Monitor Sysmon Event ID 3 for network connections from taskeng.exe to external addresses.

Question 14

A threat intelligence analyst is drafting a report for external dissemination. The report includes indicators of compromise (IOCs) that are marked TLP:GREEN. Which of the following best describes the permitted sharing scope for this report?

Accepted Answer

The report can be shared within the recipient's organization and with peers in the same community, but not via public channels.. TLP:GREEN permits sharing within the community, which includes peers and partner organizations, but prohibits public release. This allows for broad but controlled dissemination to those who can use the information for defense. It is less restrictive than TLP:AMBER but more controlled than TLP:CLEAR, making it suitable for information that can be shared widely but not openly.

Answer

The report can be shared with government agencies only.

Answer

The report can be shared only with individuals who have a specific need to know within the recipient's organization.

Answer

The report can be shared publicly without restriction.

Question 15

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

Accepted Answer

Microsoft-Windows-PowerShell/Operational ID 4104. The Microsoft-Windows-PowerShell/Operational log (Event ID 4104) captures the full script block text, even if obfuscated or encoded.

Answer

System Event ID 7040

Answer

Application Event ID 1000

Answer

Security Event ID 4688