312-85 Practice Test 21 — 15 Questions

Question 1

You are correlating host and network telemetry after an intrusion and need to establish which account was used to move laterally between servers. Which two data sources are most directly useful for this determination? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication logs from the centralized directory service showing which accounts authenticated and from which hosts.. Establishing which account moved laterally requires authentication records from both endpoints and the directory service, because each captures the account-to-source relationship from a different vantage point. Correlating endpoint logon events with centralized authentication logs lets the analyst reconstruct the sequence of hosts and confirm the credential involved.

Answer

Full packet captures of encrypted administrative sessions retained for the entire incident window.

Answer

Vulnerability scan results for the affected servers collected during the previous quarter.

Answer

Asset inventory records listing the operating system and owner of each server.

Question 2

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

Accepted Answer

Industry-specific ISACs and regulatory compliance bodies. Industry-specific Information Sharing and Analysis Centers (ISACs) and regulatory compliance bodies are the authoritative sources for sector-specific threat intelligence, providing curated threat feeds, indicators, and best practices tailored to industries like finance (FS-ISAC), healthcare (H-ISAC), and energy (E-ISAC). They also align intelligence requirements with regulatory obligations, ensuring the CTI team's methodology reflects both threat reality and compliance mandates.

Answer

Social media marketing agencies

Answer

Commercial real estate brokers

Answer

Consumer product retail vendors

Question 3

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

Accepted Answer

In the TAXII client configuration settings.. In a TAXII 2.1 architecture, the TAXII Client is the component that polls or subscribes to a TAXII Server's collections. Filtering for high-confidence indicators is applied on the client side — either in the client configuration (e.g., specifying a confidence threshold in the SIEM's TAXII connector) or in the SIEM's ingestion pipeline after the STIX objects are received. TAXII 2.1 itself does not define a server-side confidence filter parameter, so the client must apply the filter.

Answer

At the firewall level.

Answer

By disabling the feed authentication.

Answer

By modifying the STIX schema.

Question 4

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

Accepted Answer

Port 445. Port 445 is the standard TCP port for SMB (Server Message Block) over TCP, used for file sharing, named pipes, and remote administration. Attackers commonly abuse SMB via tools like PSExec, which uses SMB to copy and execute binaries on remote hosts, making port 445 a primary vector for lateral movement and ransomware propagation (e.g., WannaCry, NotPetya).

Answer

Port 80

Answer

Port 3389

Answer

Port 22

Question 5

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

Accepted Answer

Create a custom CSV mapping template in the 'Import' module. MISP's CSV import module supports saved mapping templates that let you define which CSV column maps to which MISP attribute field (e.g., 'Category', 'Type', 'to_ids'). Creating a custom template persists the column-to-field mapping so every future import using that template parses Category correctly without manual intervention. This is the designed, repeatable mechanism for structured CSV ingestion in MISP.

Answer

Change the file extension to .misp

Answer

Manually edit each indicator after the import is complete

Answer

Use the MISP API to overwrite the database schema

Question 6

A CTI manager is conducting a formal review of the intelligence program to ensure it remains aligned with business goals. The review will assess the effectiveness of the requirements planning, direction, and review phases. Which TWO activities are essential components of the review phase in the intelligence cycle? (Choose two.)

Accepted Answer

Evaluating the relevance of existing PIRs to current business objectives. The review phase is about evaluating the intelligence program's effectiveness and alignment with business goals. Assessing the relevance of PIRs ensures requirements stay current, while measuring the impact of intelligence products determines whether they support decision-making. These activities drive continuous improvement and are distinct from planning, collection, or dissemination.

Answer

Collecting data from newly identified sources to fill intelligence gaps

Answer

Disseminating intelligence reports to stakeholders

Answer

Drafting new intelligence requirements based on emerging threats

Question 7

A newly hired CTI analyst at a regional bank is asked to define the organization's intelligence requirements before any feeds are purchased. The CISO wants to ensure collection efforts remain focused and measurable. Which activity should the analyst perform FIRST?

Accepted Answer

Identify the key intelligence questions that align with the bank's critical assets and business risks.. The Planning and Direction phase begins with defining what the organization needs to know, expressed as key intelligence questions tied to critical assets and business risk. Only after those requirements exist can the analyst sensibly choose sources, tools, and sharing mechanisms. Purchasing feeds, standing up TAXII infrastructure, or scanning the estate may all happen later, but none of them establish the focus and measurability the CISO requested.

Answer

Subscribe to as many open-source and commercial feeds as the budget allows to maximize coverage.

Answer

Run a full vulnerability scan of the bank's internet-facing estate to enumerate what attackers could target.

Answer

Deploy a TAXII 2.1 server so external partners can push indicators directly into the bank's SIEM.

Question 8

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Accepted Answer

Decode the content and extract nested indicators.. Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.

Answer

Replace the payload with a static hash.

Answer

Discard the indicator as encrypted.

Answer

Store the raw base64 string as a comment.

Question 9

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

Accepted Answer

Command and Control. Command and Control (C2) is the Cyber Kill Chain phase where an adversary establishes a persistent communication channel with compromised systems to issue commands and exfiltrate data. Persistent communication with an external host is the defining characteristic of C2, typically using protocols like HTTP/S, DNS, or custom beacons to evade detection. Exploitation and Installation precede C2, while Actions on Objectives follow it.

Answer

Exploitation

Answer

Installation

Answer

Actions on Objectives

Question 10

An analyst is processing a set of indicators received in a CSV file. The file contains a column labeled 'ip_address' with values such as '192.168.1.1' and '10.0.0.1'. The analyst needs to import these into a threat intelligence platform that expects indicators to be classified by type. Which of the following actions should the analyst take to ensure proper classification?

Accepted Answer

Import the IP addresses as 'ipv4-addr' objects after validating they are not private or reserved.. The analyst should validate that the IP addresses are not private or reserved, as those are not useful threat indicators, and then import them as 'ipv4-addr' objects. This ensures correct classification and enables proper correlation and detection within the threat intelligence platform.

Answer

Import the IP addresses as 'domain-name' objects since they are alphanumeric strings.

Answer

Import the IP addresses as 'mutex' objects because they can be used to identify malicious processes.

Answer

Import the IP addresses as 'url' objects by prepending 'http://' to each value.

Question 11

A junior analyst receives a CSV export from a partner that contains a column named 'indicator' with values such as 'hxxp://malicious[.]example[.]com/path'. The analyst needs to prepare these values for ingestion into a threat intelligence platform that expects defanged indicators to be normalized. Which action should the analyst take?

Accepted Answer

Refang the indicators by replacing hxxp with http and removing brackets around dots before ingestion.. Defanged indicators are safe for human viewing but must be refanged before automated ingestion. Replacing hxxp with http and removing brackets restores the canonical URL so the platform can match it against telemetry. Keeping defanged values or hashing them would make the indicators unusable for detection and analysis.

Answer

Hash each defanged indicator and ingest only the hashes to avoid storing malicious URLs.

Answer

Convert the CSV to JSON and ingest the defanged values into a custom field for manual review.

Answer

Leave the indicators defanged and ingest them as-is so analysts do not accidentally visit malicious sites.

Question 12

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Accepted Answer

Reduces false positives from stale indicators. Setting an expiration time on STIX/TAXII indicators ensures that the SIEM automatically stops using them after a defined period. Threat intelligence indicators often have a limited useful lifespan; after that, they may become irrelevant or even lead to false positives. By expiring stale indicators, the SIEM reduces false positives and maintains detection accuracy.

Answer

Increases ingestion speed

Answer

Decreases storage costs

Answer

Complies with GDPR

Question 13

You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?

Accepted Answer

Blocking legitimate business traffic. Automated blocking without human verification means the firewall acts on TI indicators (IPs, domains, hashes) immediately, and if the feed contains false positives — such as shared hosting IPs, CDN ranges, or legitimate SaaS domains — the organization blocks its own business traffic. This is the primary operational risk because it directly impacts availability and user productivity. Human verification (or at least a staging/allowlist review) is required to prevent TI-driven outages.

Answer

Increased malware infection rate

Answer

Overloading the SIEM

Answer

Higher license costs

Question 14

Which TWO of the following are common challenges when sharing intelligence between organizations?

Accepted Answer

Lack of trust between organizations. Option D is correct because a lack of trust between organizations is a fundamental obstacle to intelligence sharing: participants must worry about data being leaked, misused, or attributed back to them, which is why frameworks like TLP (Traffic Light Protocol) and legal agreements such as NDAs and ISAC/ISAO trust models exist to govern handling and dissemination. Option E is correct because incompatible data formats are a pervasive technical challenge: different organizations use different schemas, taxonomies, and standards (for example STIX/TAXII versus proprietary CSV or SIEM-specific formats), so indicators and context often must be normalized and mapped before they can be consumed, which is precisely the problem standards like STIX 2.x and MISP aim to solve. Option A is not a typical challenge in this context, since intelligence sharing relies on APIs, feeds, and standardized transports rather than end-user browser rendering. Option B is not a defining challenge, as shared indicator feeds are generally small text-based payloads that do not strain bandwidth. Option C is incorrect because intelligence sharing consumes storage rather than being impeded by having too much disk space.

Answer

Browser compatibility

Answer

Insufficient bandwidth

Answer

Too much disk space usage

Question 15

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a specific, testable proposition about adversary behavior — typically derived from a known TTP, threat intel report, or ATT&CK technique — and then searches telemetry for evidence that confirms or refutes it. Because the hypothesis is anchored to a known adversary tactic, the analyst works backward from the tactic to the artifacts it would leave in logs (e.g., process creation, registry writes, network connections). This structured, deductive approach is the defining characteristic of hypothesis-driven threat hunting.

Answer

Incident response forensics

Answer

Machine learning-based hunting

Answer

Alert-driven hunting