312-85 Practice Exam 4 — 20 Questions

Question 1

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Strategic Threat Intelligence Analyst. The Threat Intelligence Manager or Strategic Threat Analyst bridges the gap between technical threat indicators and business risk, ensuring executive leadership understands the strategic impact.

Answer

Vulnerability Assessor

Answer

Malware Reverse Engineer

Answer

Incident Responder

Question 2

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

Accepted Answer

Identify (ID). The NIST CSF 'Govern' (GV) and 'Identify' (ID) functions encompass the establishment of policies, procedures, and asset/threat identification, with ID.RA (Risk Assessment) and GV subcategories guiding intelligence requirement definition.

Answer

Recover (RC)

Answer

Respond (RS)

Answer

Protect (PR)

Question 3

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

Accepted Answer

Target-Centric Intelligence Analysis. Target-centric intelligence analysis focuses specifically on the assets, events, or transactions of interest (such as an M&A deal) and maps out all threat actors known to target those specific equities.

Answer

Network Forensic Packet Capture Analysis

Answer

Signature-Based Intrusion Detection Analysis

Answer

Vulnerability Scoring via CVSS v3.1 Base Metrics

Question 4

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

Accepted Answer

Ticket lifetime (e.g., 10 years). The ticket lifetime and the account SID are key indicators; Golden Tickets often use a fake domain admin SID.

Answer

Domain controller name

Answer

Client IP address

Answer

Ticket encryption algorithm

Question 5

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

Accepted Answer

Executive Leadership and Risk Management (CISO, CRO). Engaging Incident Response, Security Operations, and Executive Management ensures that CTI requirements align with operational needs and executive risks.

Answer

Residential landscaping contractors

Answer

External catering service providers

Question 6

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Accepted Answer

Tactical level (SIEM systems, Automated security controls, SOC analysts). Intelligence plans address strategic (executive), operational (managerial/defense), and tactical (technical/SOC) consumers.

Answer

Corporate real estate leasing committees

Answer

External consumer product marketing teams

Question 7

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

Accepted Answer

Analyst professional development, training, and industry certifications. Budget planning for CTI must account for commercial tool subscriptions, personnel training/certifications, and intelligence platform licenses.

Answer

Fleet vehicle insurance policies for corporate delivery trucks

Answer

Commercial cafeteria food and beverage restocking contracts

Question 8

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

Accepted Answer

Event ID 8. Event ID 8 (CreateRemoteThread) is a primary indicator of process hollowing, where a process injects code into another process.

Answer

Event ID 1

Answer

Event ID 11

Answer

Event ID 3

Question 9

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

Accepted Answer

Microsoft-Windows-PowerShell/Operational ID 4104. The Microsoft-Windows-PowerShell/Operational log (Event ID 4104) captures the full script block text, even if obfuscated or encoded.

Answer

System Event ID 7040

Answer

Application Event ID 1000

Answer

Security Event ID 4688

Question 10

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

Accepted Answer

threat_intel_by_str. The 'threat_intel_by_str' lookup table is the primary repository for normalized threat intelligence data that Splunk ES uses for correlation across its dashboards.

Answer

assets_by_cidr

Answer

threat_group_mapping

Answer

notable_events_summary

Question 11

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the industry-standard framework for mapping adversarial techniques and identifying gaps in security controls.

Answer

STRIDE

Answer

OSINT

Answer

CVSS

Question 12

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

Accepted Answer

Initiate threat hunting across endpoints. High-confidence indicators should be validated against internal logs, the firewall/proxy should be updated to block the activity, and the threat should be hunted for historical presence.

Answer

Disable all network interfaces

Answer

Publicly disclose the intelligence

Question 13

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

Accepted Answer

It enables the visualization of relationships between the four core components of an intrusion.. The Diamond Model links the Adversary, Capability, Infrastructure, and Victim, providing a holistic view of the event.

Answer

It provides a vulnerability score for every asset.

Answer

It calculates the financial loss expectancy of a breach.

Answer

It replaces the need for SIEM log collection.

Question 14

Which of the following best describes an Advanced Persistent Threat (APT)?

Accepted Answer

Sophisticated, long-term, targeted attacks. APTs are characterized by their long-term, targeted, and sophisticated nature, often backed by nation-states.

Answer

Automated script kiddies

Answer

Uncoordinated network scanning

Answer

Short-term ransomware campaigns

Question 15

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

Accepted Answer

type. In STIX 2.1, the 'type' field is mandatory for all SDOs and SCOs, and for file objects, it must be set to 'file'.

Answer

name

Answer

spec_version

Answer

hashes

Question 16

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

Accepted Answer

The hypothesis is the least likely to be correct given the current evidence set.. In ACH, lower scores in the matrix often indicate that the evidence strongly contradicts the hypothesis.

Answer

The hypothesis is the most likely scenario.

Answer

The hypothesis is heavily supported by available data.

Answer

The hypothesis lacks enough evidence to be evaluated.

Question 17

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Accepted Answer

Defense Evasion. Process Hollowing is a form of Defense Evasion, as it allows malicious code to hide inside a legitimate process.

Answer

Lateral Movement

Answer

Credential Access

Answer

Persistence

Question 18

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Accepted Answer

T1018. T1087 (Account Discovery) or specifically T1018 (Remote System Discovery) are used for reconnaissance; 'net view' is specifically linked to Remote System Discovery.

Answer

T1071

Answer

T1059

Answer

T1027

Question 19

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Accepted Answer

Registry key modification. A Registry key modification is a change made directly to the infected host system, making it a host-based indicator.

Answer

User-Agent string in HTTP header

Answer

Domain name for C2 beaconing

Answer

Source IP address in firewall logs

Question 20

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Accepted Answer

Capability. The four core vertices of the Diamond Model are Adversary, Capability, Infrastructure, and Victim.

Answer

Network Topology

Answer

Payload