312-85 Practice Test 2 — 25 Questions

Question 1

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Percentage of intelligence reports that result in actionable security controls or detection rules. Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.

Answer

Number of threat intelligence blog posts published on the corporate website

Answer

Total gigabytes of threat data ingested from commercial feeds per month

Answer

Total number of security alerts generated by the SIEM

Question 2

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

SHA-256 File Hash. IOCs are typically digital forensic artifacts like file hashes or network connection logs.

Answer

Server rack temperature

Answer

Employee behavior patterns

Answer

Project management timeline

Question 3

You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?

Accepted Answer

Refine the evidence definitions to focus on the contradictory data points to assess if the hypothesis remains viable.. ACH methodology dictates that you should focus on evidence that disproves hypotheses rather than supports them. Finding contradictory evidence is more diagnostic than finding supporting evidence.

Answer

Consolidate the contradictory evidence into the supporting evidence category.

Answer

Discard the hypothesis immediately if any contradictory evidence exists.

Answer

Increase the weight of supporting evidence to balance the matrix.

Question 4

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Accepted Answer

The timeliness of the intelligence.. Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.

Answer

The size of the vendor's marketing department.

Answer

The format of the document (PDF vs CSV).

Question 5

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

Accepted Answer

Sensitive file access and data movement tracking.. Insider threats are detected via access logs, file activity, and network communication patterns.

Answer

Employee cafeteria transaction history.

Answer

Public internet speed test results.

Question 6

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

Accepted Answer

Attack Surface Reduction. Attack Surface reduction through Least Privilege is a foundational technique in threat modeling aimed at minimizing the damage potential of a compromise.

Answer

Threat Vector Analysis

Answer

Risk Likelihood Assessment

Answer

Threat Actor Attribution

Question 7

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

Accepted Answer

Check if the source IP is whitelisted on the threat intelligence provider side.. 403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.

Answer

Update the SSL certificates on the collector.

Answer

Increase the connector memory allocation.

Answer

Restart the OpenCTI RabbitMQ service.

Question 8

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Accepted Answer

Time-series analysis of IP resolution logs.. Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.

Answer

Vulnerability scanning.

Answer

Qualitative SWOT analysis.

Answer

Static analysis of the malware binary.

Question 9

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 10

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Accepted Answer

Decode the content and extract nested indicators.. Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.

Answer

Replace the payload with a static hash.

Answer

Discard the indicator as encrypted.

Answer

Store the raw base64 string as a comment.

Question 11

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Accepted Answer

The ephemeral nature of cloud assets. Cloud environments are dynamic, leading to challenges with visibility and scope.

Answer

Cloud environments are immune to malware

Answer

The total lack of logs in cloud environments

Answer

The inability to use API-based intelligence collection

Question 12

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

Accepted Answer

The client requested an unsupported content-type in the Accept header.. A 406 error typically indicates that the media type requested in the Accept header is not supported by the TAXII server, often due to a mismatch between STIX versioning expectations.

Answer

The connection is blocked by a firewall ACL.

Answer

The API key provided for authentication is expired.

Answer

The TAXII discovery service endpoint is misconfigured.

Question 13

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Accepted Answer

To link two objects together.. The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.

Answer

To define the schema version.

Answer

To encrypt the data transport.

Answer

To set the confidence score.

Question 14

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Accepted Answer

Relationship. In STIX 2.1, the 'Relationship' object is specifically used to connect two SDOs (Domain Objects) with a defined relationship type such as 'uses'.

Answer

Indicator

Answer

Sighting

Answer

Observed-Data

Question 15

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

Accepted Answer

'relationship_type'. The 'relationship_type' property defines the semantic nature of the link; if it does not match the STIX 2.1 controlled vocabulary for that SDO pair, the parser will reject the bundle.

Answer

'source_ref'

Answer

'target_ref'

Answer

'spec_version'

Question 16

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Accepted Answer

Access Control Lists (ACLs). TAXII collections require defined access controls and content selection (filters) to ensure only authorized entities receive specific intelligence.

Answer

Database indexing strategy

Answer

Default STIX versioning

Answer

Server uptime SLA

Question 17

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Accepted Answer

Aggregating and deduplicating indicators from multiple sources. Processing is where data is made usable through normalization, aggregation, and filtering.

Answer

Presenting findings to the board of directors

Answer

Identifying new intelligence requirements

Question 18

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Accepted Answer

Shift intelligence requirements to focus on initial access vectors, third-party supplier dependencies, and forums frequented by Initial Access Brokers (IABs). Refining collection requirements and pivoting focus toward upstream threat indicators (such as supplier dependencies, third-party vendor risks, and initial access brokers) addresses late detection of supply chain intrusions.

Answer

Disable all external threat intelligence feeds to reduce noise in the security operations center

Answer

Reassign all malware reverse engineering tasks to helpdesk support personnel

Answer

Increase the budget for automated SIEM log retention from 30 days to 90 days

Question 19

You are integrating a new threat intelligence platform (TIP). You need to define a 'Custom Object' in STIX 2.1 to track a specific internal project codename associated with threat actors. Which prefix must be used for the custom object name to ensure compatibility and avoid collisions?

Accepted Answer

'x-'. In STIX 2.1, custom objects must be prefixed with 'x-' to identify them as non-standard extensions to the schema.

Answer

'ext-'

Answer

'c-'

Answer

'internal-'

Question 20

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Accepted Answer

Execution. Execution is the tactic used to run malicious code on a target system; PowerShell is a common technique within that tactic.

Answer

Persistence

Answer

Exfiltration

Answer

Privilege Escalation