312-85 Practice Test 24 — 15 Questions

Question 1

You are a CTI analyst preparing to share a report with a partner organization. The report contains sensitive technical details about an ongoing investigation. You want to ensure the information is shared only with the intended recipients and that they understand the handling restrictions. Which action best fulfills this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mark the report with TLP:RED and deliver it only to the designated recipients.. TLP:RED is the most restrictive marking, indicating information should only be shared with designated recipients. It ensures the report is handled appropriately and prevents further dissemination. Other markings like TLP:AMBER or TLP:WHITE are less restrictive and do not meet the requirement to limit access strictly to intended individuals.

Answer

Apply the TLP:AMBER marking to the report and share it via a secure channel.

Answer

Use TLP:WHITE to allow broad sharing and rely on the partner's discretion.

Answer

Encrypt the report and send it via email with a password in a separate message.

Question 2

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

Accepted Answer

It indicates a specific C2 listener implementation. JA3S is the server-side TLS fingerprint derived from the ServerHello (TLS version, cipher suite, extensions). A JA3S value that is unique in the environment and appears across multiple hosts strongly indicates a specific C2 listener implementation — for example, a particular Cobalt Strike malleable profile or team server build — because legitimate servers usually share fingerprints with many peers.

Answer

The connection is encrypted with an expired certificate

Answer

The client has been compromised

Answer

It is a standard browser connection

Question 3

A CTI analyst is tasked with reviewing the effectiveness of the intelligence program. The analyst notices that despite having clear PIRs, the intelligence reports often fail to answer the specific questions posed by decision-makers. Which of the following should the analyst evaluate FIRST to identify the root cause?

Accepted Answer

The alignment between PIRs and the collection plan. The root cause of reports failing to answer PIRs is often a disconnect between the requirements and the collection plan. The collection plan operationalizes PIRs by specifying what data to collect, from where, and how. If it is not aligned, intelligence production will miss the mark. Therefore, evaluating this alignment is the logical first step before considering technology or distribution factors.

Answer

The frequency of intelligence report distribution

Answer

The technical capabilities of the threat intelligence platform

Answer

The number of intelligence sources available

Question 4

An analyst receives a report from a sharing partner containing indicators of compromise for a campaign against the energy sector. Before including these indicators in the organization's blocklists, the analyst must assess the source's reliability and the information's credibility. The partner has been accurate in past reporting but this specific report contains indicators that conflict with the organization's own telemetry. Which principle should guide the analyst's handling of this conflict?

Accepted Answer

Validate and enrich the indicators against internal telemetry, then assign confidence based on both source reliability and corroboration before acting.. Sound tradecraft separates source reliability from information credibility and requires corroboration before operational action. When external reporting conflicts with internal telemetry, the analyst should validate, enrich, and assign confidence rather than discard or blindly accept. Blocking decisions should follow the assessed confidence and potential impact, with monitoring or hunting used when confidence is not yet sufficient for enforcement.

Answer

Discard the partner's indicators entirely because internal telemetry always takes precedence over external reporting.

Answer

Publish the conflicting indicators to the organization's blocklists immediately to avoid missing the campaign, then investigate afterward.

Answer

Accept the partner's indicators without validation because a previously reliable source guarantees current accuracy.

Question 5

A newly hired SOC analyst is asked to explain the fundamental difference between data, information, and intelligence to a group of interns. The analyst wants to describe what specifically distinguishes finished threat intelligence from raw collected data. Which statement best describes this distinction?

Accepted Answer

Intelligence is data that has been collected, processed, and analyzed to provide context and support a specific decision.. Finished threat intelligence is the product of applying analysis and context to collected data so it can support a specific decision. Raw logs, packets, and feed indicators are inputs, not intelligence. The hierarchy of data to information to intelligence is a core concept in the Introduction to Threat Intelligence domain, and it explains why skilled analysts, not just collection tools, are required.

Answer

Intelligence is the total volume of threat data an organization collects, measured by the number of feeds ingested daily.

Answer

Intelligence is any indicator of compromise that has been assigned a confidence score by an automated feed.

Answer

Intelligence is raw logs and packet captures collected from sensors, while data is the final report delivered to stakeholders.

Question 6

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Accepted Answer

Relationship. In STIX 2.1, the 'Relationship' object is specifically used to connect two SDOs (Domain Objects) with a defined relationship type such as 'uses'.

Answer

Indicator

Answer

Sighting

Answer

Observed-Data

Question 7

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

Accepted Answer

The hypothesis is the least likely to be correct given the current evidence set.. In an Analysis of Competing Hypotheses (ACH) matrix, each hypothesis is scored against diagnostic evidence. A low score means the hypothesis has more inconsistencies with the evidence (i.e., more evidence items are rated as inconsistent or not supporting it). Therefore, the hypothesis with the lowest score is the least likely to be correct given the current evidence set. This is the core principle of ACH: hypotheses that are most inconsistent with the evidence are rejected.

Answer

The hypothesis is the most likely scenario.

Answer

The hypothesis is heavily supported by available data.

Answer

The hypothesis lacks enough evidence to be evaluated.

Question 8

You are a threat intelligence analyst at a healthcare organization. Your team is developing a threat model for a new telemedicine platform. You need to identify potential threat actors and their capabilities. Which two of the following factors are most critical to consider when assessing threat actor intent and capability? (Choose two.)

Accepted Answer

The actor's known tactics, techniques, and procedures (TTPs).. Assessing threat actor intent and capability requires understanding their TTPs and their financial resources and sponsorship. TTPs reveal how they operate and what techniques they might use against the telemedicine platform. Financial resources and sponsorship indicate their ability to sustain campaigns and acquire advanced tools. These factors directly inform the threat model, unlike organizational characteristics such as employee count or revenue.

Answer

The organization's annual revenue.

Answer

The number of employees in the organization.

Answer

The geographic location of the organization's data centers.

Question 9

A threat intelligence analyst is mapping adversary tactics to the MITRE ATT&CK framework. The analyst observes that an adversary is using scheduled tasks and Windows services to maintain persistence on compromised hosts. Which two ATT&CK techniques are being used? (Choose two.)

Accepted Answer

Scheduled Task/Job. The adversary uses scheduled tasks and Windows services to maintain persistence. In MITRE ATT&CK, these correspond to Scheduled Task/Job and Create or Modify System Process: Windows Service. Both are common persistence techniques that allow adversaries to survive system restarts and maintain long-term access.

Answer

Boot or Logon Autostart Execution: Shortcut Modification

Answer

Registry Run Keys / Startup Folder

Answer

Account Manipulation

Question 10

A SOC analyst receives a threat intelligence report indicating that a specific APT group is targeting the organization's industry with a new malware family that uses DNS tunneling for command and control. The analyst wants to create a detection rule in the SIEM to identify this activity. Which data source and detection logic would be most effective?

Accepted Answer

DNS query logs, looking for high-volume or unusually long subdomain queries to a single domain.. DNS tunneling for command and control is best detected by analyzing DNS query logs for anomalies such as high query volume or unusually long subdomain strings directed to a single domain. This approach directly targets the technique described in the threat intelligence and uses a data source that provides the necessary visibility. Firewall, endpoint, and proxy logs do not capture the DNS-layer behavior central to this C2 method.

Answer

Endpoint process logs, looking for suspicious child processes spawned by Microsoft Word.

Answer

Firewall logs, looking for large outbound data transfers to known malicious IP addresses.

Answer

Proxy logs, looking for HTTP POST requests with large payloads to newly registered domains.

Question 11

During a threat hunt for Kerberoasting, an analyst reviews Windows Security event logs and notices Event ID 4769 (Kerberos service ticket request) entries with RC4 encryption (0x17) for multiple service principal names from a single user account within a short window. Which additional context is most important to confirm malicious intent rather than benign service access?

Accepted Answer

The requesting account is a standard user who does not normally access those services, and the requests occur outside normal business hours.. Kerberoasting is possible for any authenticated user, so the reliable signal is behavioral: a low-privilege account requesting RC4 service tickets for many SPNs it never uses, often at odd hours. Target password length, responding DC identity, and default ticket lifetimes are normal environmental facts that do not distinguish abuse from routine Kerberos service access.

Answer

The service accounts associated with the requested SPNs have passwords longer than 25 characters.

Answer

The Kerberos ticket lifetime for the requested service tickets is set to the domain default of ten hours.

Answer

The domain controller that issued the tickets is the primary domain controller emulator.

Question 12

An analyst receives a raw log export from a partner organization containing firewall records, proxy logs, and endpoint telemetry related to a suspected intrusion. Before any conclusions can be drawn, the analyst normalizes timestamps to UTC, deduplicates records, decodes obfuscated URLs, and translates the field names into the team's common schema. Which phase of the threat intelligence lifecycle is the analyst performing?

Accepted Answer

Processing. The threat intelligence lifecycle moves from direction and planning through collection, processing, analysis, dissemination, and feedback. The activities described, normalizing, deduplicating, decoding, and schema mapping, are the mechanical transformations that turn raw collected data into a form suitable for analysis, which is precisely the processing phase.

Answer

Analysis

Answer

Collection

Answer

Dissemination

Question 13

A threat intelligence analyst is collecting data from a new OSINT source that provides indicators in a proprietary XML format. The analyst needs to extract the indicators and convert them into a structured format for ingestion into the organization's TIP. Which of the following is the most appropriate first step in processing this data?

Accepted Answer

Validate the XML against its schema to ensure it is well-formed and structurally correct. The first step in processing data from a new source should be to ensure the data is well-formed and valid according to its schema. This establishes a reliable foundation for any subsequent extraction or transformation. Validating the XML prevents parsing errors and ensures that the data can be accurately interpreted. Once validated, the analyst can proceed with mapping and transforming the indicators into a structured format like STIX for ingestion into the TIP.

Answer

Parse the XML using an XSLT stylesheet to transform it into STIX 2.1

Answer

Use a regular expression to extract all IP addresses and domains from the raw XML

Answer

Manually copy the indicators into a CSV file for import

Question 14

Which TWO file integrity monitoring (FIM) events would be most useful to detect potential unauthorized persistence mechanisms?

Accepted Answer

Creation of files in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. Option A is correct because the StartUp folder at C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp is a well-known autostart location, and creation of files there can indicate an attacker establishing persistence that executes at user logon. Option C is correct because the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key is a classic persistence mechanism, and its modification can reveal malicious programs configured to launch automatically at system startup. Option B is not correct because merely accessing the hosts file is not a persistence event, although unauthorized modification of it could be suspicious. Option D is not correct because desktop background changes are cosmetic and not a recognized persistence technique. Option E is not correct because reading browser profile files may indicate credential theft or reconnaissance, but it does not itself establish persistence.

Answer

Access to C:\Windows\System32\drivers\etc\hosts

Answer

Changes to desktop background images

Answer

Reading of browser profile files

Question 15

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Accepted Answer

Weaponization. The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.

Answer

Exploitation

Answer

Delivery

Answer

Installation