312-85 Practice Test 25 — 15 Questions

Question 1

When disseminating intelligence to C-level executives versus technical SOC analysts, you must adjust your reporting format. Which technique ensures compliance with intelligence cycle requirements for 'Actionable Intelligence'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use 'Executive Summaries' that highlight business impact and risk, while keeping technical IOCs in an attached appendix.. Actionable intelligence must be tailored to the audience; executives require strategic summaries (impact and risk), while analysts require technical indicators (IOCs).

Answer

Convert all technical reports to PDF only, removing machine-readable STIX.

Answer

Include raw PCAP files in all executive reports.

Answer

Remove TLP markings from executive reports to increase accessibility.

Question 2

A CTI manager is reviewing the intelligence requirements after a major business acquisition expanded the organization's presence into new regions. The manager must adjust the requirements to address new risks. Which TWO of the following actions are most appropriate during this review? (Choose two.)

Accepted Answer

Reassess the Priority Intelligence Requirements (PIRs) to reflect the new geopolitical and regulatory landscape.. The acquisition expands the organization's risk profile, so the CTI manager must update PIRs to reflect new geopolitical and regulatory factors and engage with new stakeholders to capture their intelligence needs. These actions ensure the requirements remain aligned with business goals and that intelligence supports decision-making across the expanded enterprise.

Answer

Immediately task collection assets to gather intelligence on all threat actors active in the new regions without updating requirements.

Answer

Reduce the scope of intelligence collection to only the original business units until the acquisition is fully integrated.

Answer

Maintain the existing intelligence requirements to avoid disrupting ongoing collection and analysis efforts.

Question 3

You are a CTI analyst at a multinational corporation. You have produced a strategic intelligence report assessing the long-term threat posed by a nation-state actor targeting your industry. The report includes sensitive details about your organization's defensive posture. You need to share it with your subsidiary in a foreign country. Which TLP marking should you apply to ensure the information is shared appropriately while protecting your organization's interests?

Accepted Answer

TLP:AMBER. TLP:AMBER is designed for information that should be shared within the organization and with clients or subsidiaries as needed. It protects sensitive details while enabling necessary operational action. TLP:RED is too restrictive, while TLP:GREEN and TLP:CLEAR are too permissive for this scenario.

Answer

TLP:CLEAR

Answer

TLP:RED

Answer

TLP:GREEN

Question 4

An organization wants to contribute intelligence to an ISAC (Information Sharing and Analysis Center). They need to ensure their sharing mechanism supports automated, near-real-time updates. Which standard should they adopt?

Accepted Answer

TAXII 2.1. TAXII 2.1 (Trusted Automated Exchange of Intelligence Information) is the OASIS standard specifically designed for automated, near-real-time exchange of cyber threat intelligence. It defines a RESTful API and a set of services (Collections, Channels, etc.) that allow ISAC members to publish and consume STIX-formatted intelligence programmatically. This enables machine-to-machine sharing without human intervention, which is exactly what the organization needs for near-real-time updates.

Answer

PDF report uploads

Answer

Email distribution lists

Answer

SFTP file drops

Question 5

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a novel technique to maintain persistence. The group modifies the Windows Registry to add a malicious DLL to the AppInit_DLLs key, which loads the DLL into every process that loads User32.dll. Which MITRE ATT&CK technique is this an example of?

Accepted Answer

AppInit DLLs. The AppInit DLLs technique specifically involves modifying the AppInit_DLLs registry key to load a malicious DLL into processes that load User32.dll. This provides persistence and often privilege escalation because the DLL runs in the context of multiple processes. The scenario describes exactly this behavior, so AppInit DLLs is the correct MITRE ATT&CK technique.

Answer

Registry Run Keys / Startup Folder

Answer

DLL Search Order Hijacking

Answer

Image File Execution Options Injection

Question 6

An energy utility's CTI analyst is asked to classify a collection source for an intelligence assessment. The source is a closed forum where criminal actors discuss operational security and sell access to corporate networks. The analyst must assign the correct source category and describe the handling caveat that applies. Which classification and caveat are most appropriate?

Accepted Answer

A covert human or closed access source, with handling caveats that protect the source identity and restrict onward sharing to approved recipients.. Content from a closed criminal forum is not open source. It comes from restricted access and often from sensitive collection methods, so it must be categorized as a protected or closed access source and handled with caveats that protect source identity and limit onward distribution. The other choices mislabel the source category or apply caveats that address the wrong risk.

Answer

Open-source intelligence, with no special handling caveat because forum content is publicly viewable by anyone who registers.

Answer

OSINT from a public research aggregator, with a caveat that the data may be outdated and should be corroborated before use.

Answer

Closed-source intelligence, with a caveat that the material must never be shared outside the team under any circumstances.

Question 7

A threat intelligence analyst is reviewing a report on a ransomware group that has targeted multiple hospitals. The report states the group uses the 'double extortion' model. Which of the following best describes this tactic?

Accepted Answer

The group encrypts victim data and demands a ransom for the decryption key, while also threatening to publicly release stolen sensitive data if the ransom is not paid.. Double extortion is a ransomware tactic where attackers encrypt data and also steal it, threatening to publish it if the ransom is not paid. This is particularly effective against healthcare organizations due to strict privacy regulations and the critical nature of patient data. The correct answer accurately captures both elements: encryption and the threat to leak stolen data.

Answer

The group encrypts victim data twice using two different encryption algorithms to make decryption more difficult.

Answer

The group demands two separate ransom payments: one for the decryption key and another to prevent a DDoS attack on the victim's network.

Answer

The group uses two different ransomware strains simultaneously to encrypt different parts of the victim's network.

Question 8

An analyst receives a collection of threat indicators from a partner in a STIX 2.1 bundle. Several indicators use the 'pattern' property with the 'LIKE' comparison operator, such as [file:name LIKE '%.exe']. The analyst needs to filter these indicators to only those that match files with a specific name exactly 'malware.exe'. Which STIX pattern should the analyst use to achieve this?

Accepted Answer

[file:name = 'malware.exe']. The equality operator '=' in STIX 2.1 patterns performs an exact match on the specified property. To filter for a file named exactly 'malware.exe', the analyst should use [file:name = 'malware.exe']. The LIKE operator is for wildcard or substring matches, and MATCHES is for regular expressions, neither of which guarantees an exact match. Using the correct operator ensures precise filtering.

Answer

[file:name =~ 'malware.exe']

Answer

[file:name LIKE 'malware.exe']

Answer

[file:name MATCHES 'malware.exe']

Question 9

A threat intelligence analyst is investigating a malware sample that communicates with a command-and-control (C2) server using a custom protocol over TCP port 443. The traffic is encrypted and does not match typical TLS patterns. The analyst observes that the malware sends a small beacon every 60 seconds, and the server responds with a similarly sized packet. Which analysis approach would BEST help the analyst understand the C2 protocol and extract potential indicators?

Accepted Answer

Perform dynamic analysis in a sandbox with network simulation to capture and inspect the C2 traffic.. Dynamic analysis in a sandbox with network simulation is the best approach because it allows the analyst to observe the malware's behavior in a controlled environment, capture the C2 traffic, and inspect the protocol. This can reveal the encryption method, message structure, and embedded indicators. Static analysis may be limited by obfuscation, NIDS only alerts, and memory forensics may not provide the full protocol context.

Answer

Perform memory forensics on the infected host to extract decrypted C2 communications from memory.

Answer

Use a network intrusion detection system (NIDS) to alert on the beaconing behavior.

Answer

Conduct static analysis of the malware binary to extract hardcoded C2 addresses and protocol details.

Question 10

You are a CTI analyst preparing a strategic intelligence report for your organization's executive committee. The report assesses a nation-state threat group's long-term intentions and capabilities. Which two actions are most appropriate to ensure the report effectively supports executive decision-making? (Choose two.)

Accepted Answer

Provide clear, actionable recommendations linked to business risks and strategic goals.. Executives require intelligence that is linked to business risks and strategic goals, with clear recommendations and transparent confidence levels. Including raw IOCs or focusing solely on TTPs does not serve strategic decision-making. Omitting uncertainty creates a false sense of certainty. Thus, actionable recommendations and probabilistic language are the most appropriate for executive audiences.

Answer

Omit any mention of uncertainty to present a confident, decisive assessment.

Answer

Include a detailed appendix of raw indicators of compromise (IOCs) for technical staff.

Answer

Focus exclusively on the technical tactics, techniques, and procedures (TTPs) of the threat group.

Question 11

A threat intelligence analyst is reviewing a report that describes an adversary using the 'Pyramid of Pain' model. The analyst wants to prioritize defensive actions based on the model. Which of the following indicators would cause the most pain to the adversary if blocked?

Accepted Answer

Tactics, Techniques, and Procedures (TTPs). The Pyramid of Pain ranks indicators by the difficulty they cause the adversary when blocked. TTPs are at the apex because they represent the adversary's behavior and methods. Blocking TTPs forces the adversary to change their entire approach, which is costly and time-consuming. Lower-level indicators like IPs, domains, and hashes are easily changed, so they cause little pain.

Answer

IP addresses

Answer

Domain names

Answer

Hash values

Question 12

A threat intelligence analyst is examining a malware sample and notices that the executable's import table contains only two functions from kernel32.dll: LoadLibraryA and GetProcAddress. The analyst suspects the sample is designed to evade static analysis. Which technique is MOST likely being used?

Accepted Answer

Dynamic API resolution. The presence of only LoadLibraryA and GetProcAddress in the import table is a strong indicator of dynamic API resolution. This technique allows malware to load libraries and resolve function addresses at runtime, thereby hiding its true capabilities from static analysis tools that inspect the import table. It is a common evasion method used by sophisticated malware to avoid detection and hinder reverse engineering.

Answer

API hooking

Answer

Process hollowing

Answer

DLL injection

Question 13

You are a CTI analyst and need to share a report marked TLP:AMBER with a trusted partner. What is the correct handling procedure for this report?

Accepted Answer

Share it only with individuals within your organization and the partner's organization who need to know.. TLP:AMBER designates information that can be shared within the recipient's organization and with clients on a need-to-know basis. It does not permit public release or unrestricted internal distribution. The correct procedure is to share only with those who require the information to perform their duties, ensuring both utility and confidentiality.

Answer

Share it with anyone in the partner's organization, including all employees.

Answer

Share it publicly on your organization's website.

Answer

Share it with the partner only if they agree to keep it secret indefinitely.

Question 14

You are a CTI analyst preparing to disseminate a report that includes indicators attributed to a specific nation-state actor. Your organization's legal team advises that sharing these indicators could reveal sensitive sources and methods. Which dissemination strategy best balances the need to inform stakeholders with the need to protect sources?

Accepted Answer

Disseminate a sanitized version that abstracts indicators into TTPs and provides strategic warnings, while sharing raw indicators only with a trusted, cleared subset.. A sanitized version that abstracts indicators into TTPs and strategic warnings, combined with restricted sharing of raw indicators to a trusted subset, best balances source protection and defensive needs. It informs stakeholders without compromising sensitive methods, and enables action by cleared personnel. This tiered dissemination is a standard practice in intelligence sharing.

Answer

Share the report only with the legal team and no one else.

Answer

Withhold the entire report from all stakeholders to protect sources.

Answer

Share the full report with all stakeholders, including raw indicators, to maximize defensive value.

Question 15

An analyst is using YARA to create a rule that detects a specific malware family by matching a unique string in memory. The analyst wants the rule to match when the string appears at least three times in the scanned data. Which YARA condition should the analyst use?

Accepted Answer

#string_name >= 3. YARA provides specific operators for string manipulation: '#' for count, '@' for offset, and '!' for length. To match a string that appears at least three times, the analyst must use the count operator. The condition '#string_name >= 3' correctly evaluates the number of times the string occurs in the scanned data, ensuring the rule triggers only when the frequency threshold is met.

Answer

!string_name >= 3

Answer

$string_name >= 3

Answer

@string_name >= 3