312-85 Practice Test 23 — 15 Questions

Question 1

You are a threat intelligence analyst at a financial services firm. After a recent intrusion, you need to produce a report for the board of directors that explains the likely threat actor, their motivation, and potential business impact. Which reporting format is most appropriate for this audience?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A strategic intelligence report focusing on trends, risks, and business implications.. A strategic intelligence report is tailored for executive audiences, providing context on threat actors, their motivations, and potential business impact without overwhelming technical details. This format enables the board to make informed decisions about risk management and resource allocation. The other options are too technical or operational and do not serve the board's need for high-level, decision-focused intelligence.

Answer

An operational intelligence report detailing the TTPs used by the threat actor.

Answer

A tactical intelligence report listing IP addresses, domains, and file hashes.

Answer

A technical intelligence report with packet captures and malware analysis.

Question 2

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Accepted Answer

Strategic. Strategic threat intelligence is tailored for senior leadership and decision-makers, focusing on high-level trends, adversary motivations, geopolitical context, and risk to the business — exactly what informs budget allocation and long-term security investment. It answers 'what threats matter to our organization and how should we prioritize resources?' rather than providing technical indicators or TTP-level detail. Because management needs a summary to justify spending, strategic reporting is the correct audience-appropriate choice.

Answer

Technical

Answer

Operational

Answer

Tactical

Question 3

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Accepted Answer

The use of a custom remote access trojan (RAT) with specific DGA algorithms. Capability refers to the specific tools, malware, or techniques an adversary uses to achieve their objectives.

Answer

The target organization's industry sector

Answer

The frequency of the adversary's campaigns

Answer

The adversary's base of operations in a specific country

Question 4

You are a threat intelligence analyst supporting a SOC. The SOC uses a SIEM that ingests indicators from multiple feeds. You notice that a high-priority indicator from a trusted feed is not generating alerts. After investigation, you find the indicator is an IPv6 address, but the SIEM's ingestion parser only supports IPv4. What is the most appropriate action to improve the intelligence program?

Accepted Answer

Update the SIEM's indicator ingestion and detection capabilities to support IPv6. The most appropriate action is to update the SIEM to support IPv6 indicators. This addresses the technical limitation and ensures that all indicators from trusted feeds are ingested and actionable. Removing the feed, using NAT64, or manual monitoring are either overreactions or ineffective workarounds that do not solve the underlying problem and may introduce new risks or inefficiencies.

Answer

Remove the feed entirely and replace it with one that only provides IPv4 indicators

Answer

Configure the SIEM to convert IPv6 indicators to IPv4 using NAT64

Answer

Manually monitor IPv6 indicators outside the SIEM and create tickets for each

Question 5

A junior analyst presents a chart showing that malware detections in your environment dropped 40 percent after a new endpoint agent was deployed. You suspect the chart is misleading because the agent only covers Windows servers, while the previous agent covered servers and workstations. Which analytic step should you take FIRST to validate whether the apparent drop is real?

Accepted Answer

Recalculate the detection rate using only Windows servers for both the pre-deployment and post-deployment periods.. Before drawing conclusions from a trend, the analyst must ensure the compared populations are equivalent. Because the new agent covers only Windows servers while the old agent covered more endpoint types, the raw detection drop is confounded by scope. Normalizing to Windows servers for both periods is the necessary first step to determine whether the decline is real.

Answer

Extend the post-deployment observation window to twelve months to smooth out short-term variance.

Answer

Ask the endpoint agent vendor to confirm that the new agent has a higher detection efficacy than the previous one.

Answer

Apply a statistical significance test to the raw 40 percent drop to determine whether it is meaningful.

Question 6

A threat hunter is reviewing Sysmon logs to detect potential credential dumping via LSASS memory access. Which Sysmon Event ID should the hunter prioritize to identify suspicious access to the lsass.exe process?

Accepted Answer

Event ID 10 (ProcessAccess). Sysmon Event ID 10 (ProcessAccess) captures detailed information about processes opening handles to other processes, including the target lsass.exe and the requested access rights. Credential dumping tools like Mimikatz typically request access rights such as 0x1010 or 0x1410 to read LSASS memory. By monitoring Event ID 10 for suspicious access to lsass.exe, hunters can detect credential dumping attempts in real time.

Answer

Event ID 7 (Image Loaded)

Answer

Event ID 1 (Process Creation)

Answer

Event ID 8 (CreateRemoteThread)

Question 7

A junior analyst at a managed security services provider receives a feed of IP addresses and file hashes from a vendor and is told to push them to the firewall and endpoint platform for automatic blocking. What type of threat intelligence is the analyst handling?

Accepted Answer

Technical threat intelligence. Atomic, machine-readable artifacts such as IP addresses and file hashes that are loaded into blocking and detection controls constitute technical threat intelligence. It is the most perishable and lowest-context form of intelligence, valuable for immediate prevention but requiring frequent refresh and enrichment with higher-level context to remain useful.

Answer

Operational threat intelligence

Answer

Strategic threat intelligence

Answer

Tactical threat intelligence

Question 8

Which TWO aspects of a threat intelligence report are most useful for long-term strategic risk management decisions?

Accepted Answer

Long-term trend forecasting. Long-term trend forecasting (A) is correct because strategic risk management depends on understanding how the threat landscape evolves over quarters and years, enabling investment and policy decisions rather than immediate tactical fixes. Threat actor motivation analysis (C) is also correct because knowing why adversaries target an organization or sector informs durable, strategic defenses such as sector-wide controls, governance priorities, and risk appetite. Incident response ticket numbers (B) are operational tracking artifacts with no strategic value. Specific file hashes (D) are tactical indicators used for detection and blocking, and firewall rule recommendations (E) are tactical/technical controls, neither of which supports long-term strategic planning.

Answer

Incident response ticket numbers

Answer

Specific file hashes

Answer

Firewall rule recommendations

Question 9

Which THREE of the following are valid Traffic Light Protocol (TLP) labels?

Accepted Answer

TLP:AMBER. TLP:AMBER (B) is a valid label used when information may be shared only on a need-to-know basis within the recipient's organization and its clients, and it is one of the standard TLP 2.0 designations. TLP:RED (C) is valid for information that must not be disclosed beyond the specific individuals present in the exchange, making it the most restrictive TLP label. TLP:GREEN (D) is valid for information that can be shared within the wider community but not publicly, such as among peers in the same sector. The other options are not part of the TLP standard: TLP:INTERNAL (A) is not a defined TLP label (it resembles internal handling markings used by some organizations), and TLP:PRIVATE (E) is likewise not a recognized TLP designation.

Answer

TLP:INTERNAL

Answer

TLP:PRIVATE

Question 10

A threat intelligence analyst is examining a malware sample that uses a domain generation algorithm (DGA) to create a large number of pseudo-random domain names. The malware queries these domains to locate its command-and-control (C2) server. Which of the following best describes the primary purpose of using a DGA in this context?

Accepted Answer

To evade domain blacklisting by constantly changing the C2 domain. A domain generation algorithm (DGA) produces a large number of domain names that malware uses to find its C2 server. This technique helps adversaries evade domain blacklisting and takedowns because defenders cannot easily predict or block all possible domains. It provides resilience and stealth for command-and-control communications.

Answer

To encrypt command-and-control traffic to avoid network inspection

Answer

To hide the malware's presence by mimicking legitimate domain names

Answer

To distribute malware payloads to multiple victims simultaneously

Question 11

A threat intelligence analyst is studying a sophisticated APT group that has been observed using a previously unknown backdoor. The analyst wants to create a detection rule that focuses on the adversary's operational behavior rather than static indicators. Which of the following best describes the type of detection logic the analyst should prioritize?

Accepted Answer

Behavioral detection using indicators of behavior (IOBs) mapped to MITRE ATT&CK techniques. The analyst should prioritize behavioral detection using IOBs mapped to MITRE ATT&CK techniques. IOBs describe the adversary's actions—such as how the backdoor persists, escalates privileges, or communicates—and are more durable than static indicators. By focusing on behaviors, the analyst can detect the backdoor even if its code changes, because the underlying TTPs remain consistent. This aligns with the goal of detecting a previously unknown backdoor based on its operational patterns.

Answer

Anomaly-based detection focusing on deviations from normal network traffic patterns

Answer

Signature-based detection using file hashes of the backdoor

Answer

Heuristic detection based on file entropy and packing characteristics

Question 12

A newly formed CTI team is defining the requirements for its intelligence program. The team lead wants to ensure the program produces intelligence that is both actionable and aligned with business risk. Which TWO characteristics should the program prioritize? (Choose two.)

Accepted Answer

Timeliness so that intelligence arrives before the adversary's window of opportunity closes. Actionable, risk-aligned intelligence must be relevant to the organization's assets and adversaries and timely enough to inform defensive action before harm occurs. Raw volume, an exclusive focus on exotic threats, and mandatory nation-state attribution all divert resources from decisions that actually reduce risk. Relevance and timeliness are the two characteristics that most directly connect a new program's output to business value.

Answer

Maximum volume of raw indicators collected from every available feed

Answer

Exclusive focus on zero-day exploits and advanced persistent threats

Answer

Complete attribution of every incident to a named nation-state actor

Question 13

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Accepted Answer

Standardizing time formats (e.g., UTC).. Option B is correct because normalizing threat data requires aligning timestamps across disparate sources, and converting all events to a single reference such as UTC eliminates timezone offsets so that correlation and timeline reconstruction work reliably. Option E is correct because mapping heterogeneous feeds to a common schema such as STIX (Structured Threat Information Expression) gives fields like indicators, observables, and relationships a consistent structure, which is the core of data normalization. The remaining options do not belong: deleting all historical data (A) destroys the evidence needed for analysis rather than normalizing it, increasing firewall throughput (C) is a performance/network change unrelated to data format consistency, and disabling API authentication (D) weakens security and has nothing to do with harmonizing threat data.

Answer

Deleting all historical data.

Answer

Increasing the firewall throughput.

Answer

Disabling API authentication.

Question 14

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

Accepted Answer

TAXII. TAXII (Trusted Automated Exchange of Intelligence Information) is the OASIS-standardized application-layer protocol designed specifically to transport STIX-formatted threat intelligence over HTTPS. It defines services like Discovery, Collections, and Channels for publishing and subscribing to CTI. TAXII 2.1 is the current version and is the de facto transport for STIX 2.x.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 15

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Accepted Answer

Infrastructure. In the Diamond Model, Infrastructure represents the physical and logical communication paths and services, such as IPs and domains, used by the adversary.

Answer

Capability

Answer

Adversary

Answer

Victim