312-85 Practice Test 2 — 25 Questions

Question 1

An analyst is extracting indicators from a large collection of PDF reports. The reports contain IP addresses embedded in narrative text, tables, and footnotes with inconsistent formatting. The analyst needs a repeatable method to extract IPv4 addresses while minimizing false positives from version numbers such as 10.2.3.4. Which approach best supports this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Write regular expressions that match IPv4 octet ranges and require word boundaries, then manually review matches for context.. Unstructured reports require pattern-based extraction with validation and human review. Regular expressions can enforce IPv4 octet ranges and word boundaries, which filters out many version-number-like strings. Manual review then resolves ambiguous matches using context. This balances automation with accuracy and produces a repeatable process suitable for collection and processing workflows.

Answer

Import the PDFs into a SIEM and rely on the SIEM's built-in threat intelligence parser to extract addresses.

Answer

Use a YARA rule with strings matching dotted-decimal notation and scan the PDF files directly.

Answer

Convert the PDFs to plain text and upload them to a commercial sandbox for automated indicator extraction.

Question 2

You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?

Accepted Answer

Execution. PowerShell is a command-line shell and scripting language used for execution. In MITRE ATT&CK, the use of PowerShell for executing commands is mapped to the Execution tactic, specifically technique T1059.001 (PowerShell).

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 3

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 4

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Accepted Answer

Cross-referencing indicators across multiple sources.. Option C (Cross-referencing indicators across multiple sources) is correct because corroborating an indicator such as an IP address, domain, or file hash against independent feeds reduces false positives and increases confidence in its accuracy and relevance. Option D (Validating the source authenticity) is correct because confirming that a feed genuinely originates from a trusted, reputable provider (for example via signed feeds, verified credentials, or established reputation) prevents ingestion of spoofed or poisoned intelligence that would degrade reliability. Option A is wrong because metadata such as timestamps, confidence scores, and provenance is essential for assessing indicator freshness and trustworthiness, so removing it harms reliability. Option B is wrong because increasing ingest frequency only refreshes data faster; it does not improve the accuracy or trustworthiness of the intelligence itself. Option E is wrong because automatically trusting all feeds is the opposite of reliability, as it allows unvetted or malicious data to enter the pipeline unchecked.

Answer

Removing all metadata.

Answer

Increasing the ingest frequency.

Answer

Automatically trusting all feeds.

Question 5

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Accepted Answer

Tasking collection assets and monitoring the flow of raw intelligence data. Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.

Answer

Conducting corporate financial payroll audits

Answer

Configuring office building climate control thermostats

Answer

Writing custom assembly code for rootkit deployment

Question 6

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

Accepted Answer

The adversary's phishing email address and spoofed sender domain. Infrastructure in the Diamond Model comprises the physical and logical communication structures the adversary uses, such as command-and-control domains, IP addresses, and phishing email addresses or spoofed sender domains. These elements enable the adversary to deliver capabilities and maintain control. Malware and exploits are Capability, victim assets are Victim, and adversary personas are Adversary, so those options do not belong to Infrastructure.

Answer

The adversary's social media profile used for reconnaissance

Answer

The victim organization's internal file server hostname

Answer

The specific malware family and exploit code used in the attack

Question 7

A threat intelligence analyst is processing a new feed that contains indicators of compromise (IOCs) in STIX 2.1 format. Before ingesting the data into the internal platform, the analyst must validate that the STIX objects conform to the specification. Which two of the following are required properties for a STIX 2.1 'Indicator' object? (Choose two.)

Accepted Answer

pattern_type. In STIX 2.1, an Indicator object must include the 'pattern' and 'pattern_type' properties. The 'pattern' contains the detection logic, and 'pattern_type' specifies the language of that pattern. Other properties like 'name', 'description', and 'valid_from' are optional and provide context but are not required for the object to be valid.

Answer

name

Answer

description

Answer

valid_from

Question 8

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Accepted Answer

T1572: Protocol Tunneling. This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.

Answer

T1204: User Execution

Answer

T1133: External Remote Services

Answer

T1053: Scheduled Task

Question 9

Your organization's SOC is drowning in alerts, and the CISO wants to reduce noise using threat intelligence. Which approach best applies TI to prioritize alerts during triage?

Accepted Answer

Enrich alerts with TI and use match results plus asset criticality to score and prioritize them for analysts. The most effective way to apply threat intelligence to alert triage is enrichment combined with asset criticality scoring. This produces a ranked queue where alerts tied to known malicious infrastructure and high-value assets rise to the top. Analysts work the highest-risk items first, which reduces effective noise without deleting detections or flooding senior staff with undifferentiated alerts.

Answer

Enrich every alert with all available TI feeds and route all enriched alerts to Tier 3

Answer

Suppress all alerts that contain any indicator appearing in any TI feed

Answer

Disable low-severity detection rules until the alert volume returns to a manageable level

Question 10

Which of the following best describes an Advanced Persistent Threat (APT)?

Accepted Answer

Sophisticated, long-term, targeted attacks. APTs are characterized by their long-term, targeted, and sophisticated nature, often backed by nation-states.

Answer

Automated script kiddies

Answer

Uncoordinated network scanning

Answer

Short-term ransomware campaigns

Question 11

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Accepted Answer

T1018. The 'net view' command is used to enumerate shared resources on a network, such as computers and shared folders. In MITRE ATT&CK, this activity is classified under T1018: Remote System Discovery, which covers techniques used to identify remote systems and shares. Therefore, T1018 is the correct mapping for internal reconnaissance using 'net view'.

Answer

T1071

Answer

T1059

Answer

T1027

Question 12

Which TWO methods are effective for visualizing threat actor TTPs within a CTI report?

Accepted Answer

Flow diagrams illustrating the attack execution sequence.. Option D is correct because flow diagrams (e.g., attack trees or sequence diagrams) map the ordered execution of adversary tactics, techniques, and procedures, making the attack chain and dependencies between steps immediately understandable to analysts and decision-makers. Option E is correct because heat maps aggregate TTP frequency or coverage data into a visual density representation, letting readers quickly spot the most prevalent or least-defended techniques across a campaign or sector. Both visualizations align with CTI reporting goals of conveying behavioral patterns rather than isolated artifacts. Option A does not belong because a bibliography is a reference list, not a visualization of TTPs. Option B does not belong because a photograph of a threat actor provides no technical insight into their tradecraft and is often unavailable or unreliable. Option C does not belong because a raw list of every log entry is unstructured telemetry, not a visualization, and would obscure rather than reveal TTP patterns.

Answer

A bibliography of all external sources.

Answer

A photograph of the threat actor.

Answer

A raw list of every log entry captured.

Question 13

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

Accepted Answer

Executive Summary PDF. An Executive Summary PDF is the most appropriate format for a CISO because it provides a high-level, strategic overview of the threat landscape, tailored for decision-makers who need concise, actionable insights rather than raw data. It typically includes trends, risks, and recommendations, aligning with the audience's need for strategic planning. Other formats are too technical or granular for an executive audience.

Answer

Full TAXII object dump

Answer

Raw STIX JSON feed

Answer

CSV list of IOCs

Question 14

Which of the following is an example of 'structured' threat intelligence data?

Accepted Answer

A STIX 2.1 JSON file.. STIX/TAXII provides a machine-readable, structured format for intelligence.

Answer

An email body.

Answer

A handwritten note.

Answer

A PDF report from a vendor.

Question 15

Which of the following is a 'pull-based' method of threat intelligence data collection?

Accepted Answer

TAXII Poll.. TAXII Poll is a pull-based collection method: the client initiates a request to the TAXII server to retrieve available collections or objects. This contrasts with push-based methods where the server or sender proactively delivers data to the consumer. TAXII 2.1 supports both collection endpoints and object endpoints that clients poll on demand.

Answer

Webhook notifications.

Answer

Email distribution lists.

Answer

RSS feeds.

Question 16

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Accepted Answer

Confidence Score. A Confidence Score directly quantifies the reliability and certainty of the intelligence, which is essential for the SOC team to assess whether the intelligence is actionable. It indicates how much trust can be placed in the data, enabling prioritization and response. Without a confidence score, the team cannot effectively determine the risk or the appropriate action, making it the most critical metric for proving actionability.

Answer

The total number of threat actors identified

Answer

The date the report was created

Answer

The TLP level

Question 17

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Accepted Answer

The interval between the occurrence of a threat and the availability of intelligence. Timeliness in threat intelligence measures the latency between when a threat event occurs and when intelligence about it becomes available to defenders. It is a core quality dimension alongside relevance, accuracy, and completeness, and it directly affects how actionable intelligence is — stale intel may describe threats that have already been mitigated or evolved.

Answer

The length of the intelligence report

Answer

The number of IOCs provided per month

Answer

The accuracy of the threat actor attribution

Question 18

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Accepted Answer

Triage, validate, and prioritize the RFI against established intelligence priorities. In the direction phase of the intelligence lifecycle, RFIs submitted by operational teams must go through a structured management process. The correct next step is to triage the RFI (assess its urgency and scope), validate it (confirm it aligns with collection capabilities and is a legitimate intelligence requirement), and prioritize it against established Priority Intelligence Requirements (PIRs). This ensures collection and analysis resources are directed toward the most mission-critical questions rather than ad-hoc operational noise.

Answer

Immediately publish the raw telemetry to the corporate intranet without validation

Answer

Archive the RFI immediately as operational queries fall outside the scope of CTI

Answer

Initiate an immediate red-team attack campaign against the external supplier

Question 19

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Accepted Answer

Systematically testing evidence against every hypothesis.. Option A is correct because ACH requires evaluating each piece of evidence against all competing hypotheses in a matrix, which exposes inconsistencies and prevents premature anchoring on a favored theory. Option D is correct because ACH emphasizes disconfirmation—actively seeking evidence that refutes a hypothesis—since a single credible disconfirming item can eliminate a hypothesis more decisively than confirming evidence can support it. Options B, C, and E are incorrect: weighting by personal intuition reintroduces the very bias ACH is designed to counter, focusing only on supporting evidence is confirmation bias, and limiting analysis to a single hypothesis defeats the comparative purpose of ACH.

Answer

Assigning weights based on personal intuition.

Answer

Focusing only on the evidence that supports your primary theory.

Answer

Limiting the number of hypotheses to one.

Question 20

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Accepted Answer

The vendor's track record for providing accurate, validated intelligence. Option A is correct because a vendor's historical accuracy and validation of intelligence directly determine whether its feeds can be trusted for detection and response decisions. Option B is correct because consistent reporting over time demonstrates reliability, reduces gaps in coverage, and shows the vendor is not sporadic or reactive. Option E is correct because transparency about methodology allows analysts to assess data provenance, collection sources, and analytical rigor, which is essential for trusting the intelligence. Option C is not correct because raw indicator volume without context is a poor reliability metric and can increase false positives. Option D is not correct because social media follower counts reflect popularity, not the technical quality or accuracy of threat intelligence.

Answer

The volume of indicators provided without context

Answer

The number of social media followers the vendor has