312-85 Practice Test 22 — 15 Questions

Question 1

Which TWO of the following are recognized categories of threat intelligence sources?

Accepted Answer

Open Source Intelligence (OSINT).. OSINT is a formally recognized category of threat intelligence sources, referring to publicly available information such as vendor blogs, CERT advisories, government publications, and social media that is collected, processed, and analyzed for security purposes. Option C (Commercial/Proprietary Feeds) is also correct because commercial threat intelligence feeds from vendors like Recorded Future, Mandiant, or CrowdStrike are a standard recognized source category, providing curated indicators of compromise (IOCs), malware signatures, and adversary tracking data. The remaining options do not belong: Local User Logs (B) are internal telemetry data generated by systems, not a threat intelligence source category; Internal Hardware Inventory (D) is an asset management artifact; and Network Topology Maps (E) are internal documentation of infrastructure, not a recognized threat intelligence source.

Answer

Local User Logs.

Answer

Internal Hardware Inventory.

Answer

Network Topology Maps.

Question 2

A retail company's SOC manager wants to shift from reactive alert triage to a proactive posture. The CISO has approved budget for a program that will produce finished assessments about which adversaries are most likely to target the company's new contactless payment platform, why they would do so, and what business impact an intrusion would create. Which type of intelligence best matches this deliverable?

Accepted Answer

Strategic threat intelligence. The requirement is a decision-support product for leadership that explains adversary intent, likely targeting of a new payment platform, and resulting business impact. That combination of audience, abstraction, and planning horizon defines strategic threat intelligence, which converts intelligence into risk and prioritization guidance rather than detection content or atomic indicators.

Answer

Operational threat intelligence

Answer

Technical threat intelligence

Answer

Tactical threat intelligence

Question 3

You are an intelligence analyst preparing a report on a new malware variant. You have obtained technical details from a trusted partner under TLP:AMBER. You need to include these details in an internal report for your organization's incident response team. Which of the following is the most appropriate way to handle the TLP:AMBER information in your internal report?

Accepted Answer

Include the information and clearly mark the specific section with TLP:AMBER, while the rest of the report can have a different TLP marking if appropriate.. TLP markings should be applied to the specific information that is sensitive, not necessarily the entire document. Section-level marking with TLP:AMBER ensures the partner's restrictions are honored while allowing other parts of the report to be shared appropriately. Removing or omitting markings violates the sharing agreement.

Answer

Include the information without any TLP marking because it is for internal use only.

Answer

Include the information verbatim and mark the entire internal report as TLP:AMBER.

Answer

Include the information but remove the TLP marking to avoid confusing internal readers.

Question 4

A SOC analyst is building a risk-based alert prioritization model in their SIEM. They want to enrich incoming alerts with threat intelligence that reflects the organization's specific business context. Which TWO data sources should be integrated into the risk scoring to achieve this? (Choose two.)

Accepted Answer

Asset criticality inventory mapping business services to hosts. Risk-based alert prioritization requires combining threat context with business impact. Industry-specific ISAC feeds supply threat indicators relevant to the organization's sector, while asset criticality maps technical assets to business services. Together they ensure alerts are scored by both the likelihood of targeting and the potential business impact, which is the essence of contextual risk scoring.

Answer

The SIEM's built-in list of common false-positive signatures

Answer

A global vulnerability database of all CVEs published this year

Answer

Raw packet captures from the DMZ spanning the last 30 days

Question 5

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Accepted Answer

Tactical level (SIEM systems, Automated security controls, SOC analysts). The three correct answers are A, B, and D because a comprehensive intelligence plan must serve all three recognized consumer tiers. Option A, the tactical level (SIEM systems, automated security controls, SOC analysts), is correct because these consumers need immediate, machine-readable and indicator-level intelligence to drive detection, blocking, and alerting in real time. Option B, the strategic level (executive leadership, Board of Directors), is correct because these consumers require high-level, long-term intelligence about risks, trends, and business impact to inform governance, budgeting, and risk decisions. Option D, the operational level (SOC managers, incident responders), is correct because these consumers need campaign-level, contextual intelligence to prioritize investigations, allocate resources, and coordinate response activities. Option C is incorrect because corporate real estate leasing committees are not a standard intelligence consumer category and have no defined role in threat intelligence requirements. Option E is incorrect because external product marketing teams fall outside the organization's security intelligence consumer model and are not part of a CTI plan's defined audience.

Answer

Corporate real estate leasing committees

Answer

External consumer product marketing teams

Question 6

Your organization uses a commercial TI platform that ingests multiple feeds. During an incident review, you notice that one feed consistently produces indicators that later turn out to be benign cloud provider IP ranges. What is the most appropriate corrective action to improve the intelligence program?

Accepted Answer

Apply feed-specific filtering and scoring, and provide feedback to the vendor about the false positives. A feed producing recurring false positives should be tuned at ingestion with filtering and scoring, and the vendor should receive feedback about the observed problem. This preserves the feed's legitimate value, reduces analyst noise, and creates a documented quality record. Removing the feed, suppressing all cloud ranges, or raising global thresholds all introduce broader harm than the original issue.

Answer

Remove the feed entirely and rely on the remaining sources without further review

Answer

Increase the confidence threshold on all feeds to the maximum setting to eliminate false positives

Answer

Keep the feed but add a suppression rule for all cloud provider IP ranges in the SIEM

Question 7

A threat hunter wants to detect adversaries abusing the Windows Management Instrumentation command-line utility to execute code on remote hosts during a hunt for lateral movement. Which artifact should the hunter prioritize to identify the remote execution attempt on the target machine?

Accepted Answer

Windows Security Event ID 4688 process creation records showing wmiprvse.exe spawning a child process such as cmd.exe or powershell.exe.. The most direct artifact of remote WMI code execution is the WMI provider host spawning an unexpected child process on the target. Process creation auditing that captures parent image and command line lets the hunter see wmiprvse.exe launching shells or scripting engines, which is difficult to explain as benign. Network-level RPC or logon events are supporting context but do not demonstrate execution.

Answer

Windows Security Event ID 5156 records showing inbound connections to TCP port 135 on the target host.

Answer

Windows Security Event ID 4703 records showing token privilege adjustments on the target host.

Answer

Windows Security Event ID 4624 logon records showing Logon Type 10 on the target host.

Question 8

You are a threat intelligence analyst and have just finished writing a report on a new malware campaign. Before disseminating it, you need to ensure the report meets the criteria for actionable intelligence. Which of the following best describes actionable intelligence?

Accepted Answer

Intelligence that is timely, accurate, specific, and provides clear guidance for action.. Actionable intelligence is characterized by timeliness, accuracy, specificity, and clear guidance for action. These attributes ensure that the intelligence can be used to make informed decisions and take effective measures. A list of IOCs, classification level, or production method alone does not guarantee actionability. The focus should be on providing context and recommendations that enable the recipient to act.

Answer

Intelligence that is produced using automated tools and machine learning algorithms.

Answer

Intelligence that includes a comprehensive list of all known IOCs related to the campaign.

Answer

Intelligence that is classified as top secret and shared only with cleared personnel.

Question 9

You are reviewing a threat intelligence report that includes an indicator of compromise (IoC) in the form of a file hash. The report states that the hash is 'SHA-256: 8f14e45fceea167a5a36dedd4bea2543...'. What is the primary purpose of including this hash in the report?

Accepted Answer

To provide a unique identifier for the malicious file that can be used for detection and blocking. Including a SHA-256 hash in a threat intelligence report provides a unique identifier for the malicious file. Security tools can use this hash to detect and block the file across systems, and it can be shared with other organizations for collaborative defense. Hashes are precise and difficult to forge, making them reliable IoCs.

Answer

To indicate the severity of the threat based on the hash value

Answer

To serve as a password for accessing the file in a sandbox

Answer

To decrypt the malicious file for further analysis

Question 10

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Accepted Answer

To link two objects together.. The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.

Answer

To define the schema version.

Answer

To encrypt the data transport.

Answer

To set the confidence score.

Question 11

A CTI team is developing its intelligence requirements for the upcoming year. The team lead wants to ensure that the requirements are structured to support both tactical and strategic decision-making. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs)?

Accepted Answer

To guide the collection and analysis of intelligence that supports specific decisions. PIRs are the mechanism to translate decision-maker needs into focused intelligence questions. They prioritize collection and analysis so that resources are used efficiently and outputs are relevant. By defining PIRs, a CTI team ensures that both tactical and strategic decisions are supported with timely and actionable intelligence, rather than being overwhelmed by irrelevant data.

Answer

To provide a comprehensive list of all potential threats to the organization

Answer

To establish the technical specifications for threat intelligence platform integration

Answer

To catalog all available threat data sources for future reference

Question 12

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

Accepted Answer

Analyst professional development, training, and industry certifications. Option A is correct because a CTI program depends on skilled analysts, so budgeting for professional development, training, and industry certifications (e.g., GCTI, CTIA) ensures the team can perform collection, analysis, and dissemination effectively. Option C is correct because threat intelligence sharing memberships such as ISACs and ISAOs require fees and resources, and they provide sector-specific indicators, tactical intelligence, and peer collaboration essential to a CTI program. Option E is correct because commercial threat intelligence feed subscriptions and Threat Intelligence Platforms (TIP) are core technical and data resources needed to ingest, normalize, correlate, and operationalize threat data. Option B is incorrect because fleet vehicle insurance for corporate delivery trucks is a logistics/operations expense unrelated to cyber threat intelligence capabilities. Option D is incorrect because commercial cafeteria food and beverage restocking is a facilities expense and has no bearing on CTI program resources.

Answer

Fleet vehicle insurance policies for corporate delivery trucks

Answer

Commercial cafeteria food and beverage restocking contracts

Question 13

A threat intelligence analyst is integrating a new external feed into the organization's SIEM. The feed provides indicators with varying confidence levels. The analyst must ensure that only high-confidence indicators trigger automated alerts to reduce false positives. Which component of the intelligence lifecycle is most directly involved in this filtering process?

Accepted Answer

Analysis. The analysis phase of the intelligence lifecycle involves evaluating collected data for reliability, relevance, and confidence. In this scenario, the analyst uses confidence levels to filter indicators for automated alerting. This ensures that only trustworthy intelligence drives actions, reducing false positives and maintaining SOC efficiency.

Answer

Dissemination

Answer

Collection

Answer

Processing

Question 14

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

Accepted Answer

Centralizing threat data from multiple disparate sources. Option A is correct because a Threat Intelligence Platform (TIP) aggregates and normalizes threat data from many disparate sources—such as OSINT feeds, commercial vendors, ISACs, and internal telemetry—into a single searchable repository, which is a core function of a TIP. Option B is correct because TIPs integrate with security controls (e.g., firewalls, SIEMs, EDR, and proxies) via APIs and formats like STIX/TAXII to automate the dissemination and ingestion of indicators of compromise (IOCs), enabling faster detection and response. Option C is incorrect because TIPs manage and correlate threat intelligence, not provide malware source code, which is rarely available and not a TIP function. Option D is incorrect because no platform can eliminate all false positives; TIPs can enrich and prioritize indicators to reduce noise, but false positives still occur. Option E is incorrect because a TIP augments, rather than replaces, the security analyst team, which is still needed for interpretation, hunting, and decision-making.

Answer

Providing the original source code of all malware

Answer

Eliminating all false positives

Answer

Replacing the need for a security analyst team

Question 15

A threat intelligence analyst is assigned to establish a collection plan for a new business unit that has just expanded its operations to the cloud. The analyst needs to determine the most effective source to gather information about threat actors specifically targeting cloud service providers and their attack techniques. Which of the following sources should the analyst prioritize?

Accepted Answer

Commercial threat intelligence feeds that specialize in cloud threat actors and their TTPs.. The collection plan requires sources that directly address the specific threat landscape of cloud service providers. Commercial threat intelligence feeds specializing in cloud threats offer the necessary depth, including actor profiles and TTPs, which are critical for understanding how adversaries operate in cloud environments. These feeds are tailored to meet operational intelligence requirements and provide actionable data for defense.

Answer

Government alerts and advisories from national cybersecurity agencies.

Answer

Internal incident reports from the organization's own security operations center (SOC).

Answer

Open-source intelligence (OSINT) feeds from general cybersecurity news websites.