312-85 Practice Test 4 — 25 Questions

Question 1

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Source reliability and information credibility assessment. The lead is capturing how dependable each feed has proven and how credible its content is, so consumers can weight it correctly. Structured evaluation separates the trustworthiness of the source from the plausibility of the information itself, and observed lateness or uniqueness without corroboration are precisely the attributes that drive those ratings.

Answer

Intelligence dissemination and sharing controls

Answer

Threat hunting hypothesis development

Answer

Collection management and requirements prioritization

Question 2

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Accepted Answer

Technical intelligence containing indicators of compromise and TTPs. When scoping a potential breach, the IR team needs concrete, searchable artifacts. Technical intelligence provides indicators of compromise and TTPs that can be used to query SIEM, EDR, and network logs. This allows the team to identify affected systems quickly. Strategic, operational, and tactical intelligence provide context but lack the specificity required for immediate scoping.

Answer

Operational intelligence about upcoming campaigns in the sector

Answer

Tactical intelligence summarizing recent malware trends

Answer

Strategic intelligence reports on long-term threat actor intentions

Question 3

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

Accepted Answer

Analysis and production. The threat intelligence lifecycle comprises planning and direction, collection, processing and exploitation, analysis and production, dissemination, and feedback. Planning and direction sets requirements, processing standardizes raw data, and analysis and production turns that data into finished intelligence, so those three are the recognized phases among the choices.

Answer

Vulnerability remediation

Answer

Penetration testing

Question 4

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

Accepted Answer

Cybercriminal, because the group's consistent objective is financial gain through monetization of stolen data.. Motivation classification depends on the actor's persistent objective. This group repeatedly takes payment records and converts them to cash through underground carding markets, with no political, ideological, or espionage aim. That pattern defines a financially motivated cybercriminal actor. Tools and targets alone do not determine motivation, so the immediate monetization behavior is the decisive evidence.

Answer

Hacktivist, because the group publicizes its thefts to embarrass the victim.

Answer

Insider threat, because only someone with internal access could exfiltrate customer payment records.

Answer

Nation-state espionage actor, because payment data can be used to fund state operations.

Question 5

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

Accepted Answer

Publicly accessible social media posts and forum discussions about threat actors. OSINT is defined by public availability without restriction, which covers public vulnerability databases, vendor advisories, social media, and open forums. Closed peer-sharing groups, licensed commercial feeds, and classified government briefings all have access controls or legal restrictions that place them outside the open-source category, even when their content is high quality and relevant to the same intelligence requirements.

Answer

A commercial feed purchased under a licensing agreement with restricted redistribution

Answer

A closed peer-sharing group where members exchange indicators under a non-disclosure agreement

Answer

Indicators obtained from a government agency through a classified briefing

Question 6

A junior analyst receives a raw log export and a set of unstructured vendor advisories. Before analysis can begin, the team lead asks the analyst to normalize timestamps, deduplicate records, translate foreign-language advisories, and enrich IP addresses with geolocation. Which phase of the threat intelligence lifecycle is the analyst performing?

Accepted Answer

Processing. The Processing phase sits between Collection and Analysis and Production, and its purpose is to convert raw, heterogeneous data into a normalized, deduplicated, enriched format that analysts can reason over. Timestamp normalization, translation, and geolocation enrichment are textbook processing operations. Dissemination and Analysis and Production occur later, after the data has been made consistent and comparable.

Answer

Collection

Answer

Dissemination

Answer

Analysis and Production

Question 7

A retail company's newly appointed CTI lead is defining the direction phase for the coming year. The Chief Information Security Officer asks her to document how intelligence requirements will be gathered from the business and turned into a prioritized set of questions the team must answer. Which deliverable best represents the output of the direction phase?

Accepted Answer

A prioritized set of intelligence requirements derived from stakeholder decision needs and approved by leadership. Direction is about deciding what the organization needs to know. By interviewing stakeholders and translating their decision needs into an approved, prioritized set of intelligence requirements, the CTI lead produces the artifact that steers collection and analysis. Platform deployment, finished reports, and response contracts are enabling, downstream, or unrelated activities rather than the direction deliverable.

Answer

A finished malware analysis report with indicators of compromise for a recent intrusion

Answer

A signed incident response retainer contract with an external forensic provider

Answer

A completed threat intelligence platform deployment with normalized feeds and dashboards

Question 8

A retail company's threat intelligence team is asked by the board to explain how the team's work reduces business risk. The analysts want to describe the primary purpose of threat intelligence within an organization. Which statement best captures that purpose?

Accepted Answer

To provide decision advantage by reducing uncertainty about threats so the organization can act more effectively.. The core purpose of threat intelligence is to support decisions by reducing uncertainty about threats, giving the organization an advantage in prioritizing and responding. It is not defined by collection volume, replacement of detection tools, or public attribution. Framing the program around decision advantage helps justify it to leadership in business risk terms and keeps analysts focused on relevance and actionability.

Answer

To replace the security operations center's detection tools with analyst-written reports about threat actors.

Answer

To collect the maximum number of indicators from as many feeds as possible to populate blocking controls.

Answer

To attribute every intrusion to a named threat actor so the organization can publicly name and shame adversaries.

Question 9

A threat hunter is investigating a suspected Kerberoasting attack. Which Windows event ID should the hunter analyze to identify service tickets being requested for accounts with Service Principal Names (SPNs)?

Accepted Answer

Event ID 4769. Kerberoasting involves requesting Kerberos service tickets for accounts with SPNs and then cracking them offline. Event ID 4769 is generated for each service ticket request. Hunters should look for a high volume of 4769 events, especially with encryption type 0x17 (RC4) and for services that are not normally accessed. This pattern indicates an attacker attempting to extract and crack service account credentials.

Answer

Event ID 4771

Answer

Event ID 4624

Answer

Event ID 4768

Question 10

During a peer review, an analyst is challenged on a finished intelligence assessment that states with high confidence that a specific actor is responsible for an intrusion. The analyst's evidence consists of a single reused malware sample hash and a shared hosting provider. Which criticism is most valid under sound analytic standards?

Accepted Answer

The assessment relies on weak, easily spoofed artifacts and therefore overstates confidence in attribution.. Analytic confidence must be proportionate to the strength and corroboration of evidence. A single reused hash and a shared hosting provider are low-fidelity, easily replicated artifacts, so they cannot support a high-confidence attribution without independent corroboration such as unique tradecraft, infrastructure patterns, or victimology. The peer review correctly focuses on the mismatch between claimed confidence and available evidence.

Answer

The assessment should have been classified as strategic intelligence rather than operational.

Answer

The assessment should have used the Traffic Light Protocol marking TLP:RED.

Answer

The analyst failed to include the MITRE ATT&CK technique identifiers for the malware.

Question 11

Your SOC has just onboarded a new premium threat intelligence feed that delivers atomic indicators with a confidence score of 85. During the first week, analysts notice that 40% of the IP addresses in the feed are sinkholed by the vendor but still resolve to live infrastructure in your environment. You need to configure your SIEM to ingest these indicators while minimizing false positives from sinkholed addresses. What should you do first?

Accepted Answer

Enrich the feed indicators with a 'sinkholed' attribute from the vendor's metadata, then create a SIEM correlation rule that lowers the risk score or excludes those indicators from alerting when the attribute is present.. Sinkholed indicators represent infrastructure controlled by researchers or vendors, not active adversary command-and-control. The proper handling is to enrich indicators with the sinkholed attribute and adjust detection logic so those indicators do not generate false positives, while retaining them for historical analysis and correlation. This balances detection fidelity with operational efficiency and avoids both blind spots and alert fatigue.

Answer

Drop the entire feed and request a new one from the vendor that contains only non-sinkholed indicators.

Answer

Set all indicators from this feed to a confidence score of zero in the SIEM so they never generate alerts.

Answer

Create a whitelist in the SIEM for all sinkholed IP ranges provided by the feed vendor and tag them as 'benign infrastructure'.

Question 12

A threat hunter is examining Sysmon telemetry on a workstation and sees an svchost.exe process whose image path is C:\Users\Public\svchost.exe, whose parent is explorer.exe, and which has an unsigned binary with no version information. Which hunting assessment is most appropriate?

Accepted Answer

The process is likely a masquerading binary executing from an unusual path with a user-mode parent, and the hunter should triage it as a probable malicious implant.. Legitimate svchost.exe must run from System32, carry a Microsoft signature, and be parented by services.exe. A signed-absent copy in a user-writable directory with explorer.exe as parent violates all three invariants, making masquerading the strongest hypothesis and warranting immediate triage.

Answer

The process is a legitimate third-party application because explorer.exe is the standard parent for all user-launched programs.

Answer

The process indicates a Windows service misconfiguration that requires only a registry repair on the host.

Answer

This is a benign service host because svchost.exe is a legitimate Windows component and its presence alone is not suspicious.

Question 13

A CTI manager is conducting a review of the intelligence requirements after a major merger. The organization's priorities have shifted, and the manager must ensure that the collection efforts remain aligned with the new business objectives. Which of the following actions best ensures that the intelligence requirements continue to meet the evolving needs?

Accepted Answer

Reassess the Priority Intelligence Requirements (PIRs) with stakeholders from both merging entities.. The merger introduces new business objectives and risks, so the intelligence requirements must be revisited collaboratively. Reassessing PIRs with stakeholders from both entities ensures that the requirements capture the combined priorities and that collection efforts are directed toward what matters most. This approach aligns intelligence with decision-making needs and prevents wasted resources on irrelevant data.

Answer

Implement a new threat intelligence platform (TIP) to centralize all data.

Answer

Increase the frequency of automated threat feed ingestion to capture more data.

Answer

Delegate the review to the SOC manager to update tactical detection rules.

Question 14

You are building a threat intelligence program for a SOC and must define processes for the 'Direction' phase of the intelligence lifecycle. Which two activities belong to this phase? (Choose two.)

Accepted Answer

Translating stakeholder feedback into revised intelligence requirements. The Direction phase involves defining intelligence requirements and continuously refining them based on stakeholder feedback. Identifying PIRs and translating feedback into revised requirements are both about setting and adjusting the focus of the intelligence program. Collection, production, and dissemination are separate lifecycle phases that occur after Direction has established what is needed.

Answer

Collecting raw data from open source and commercial feeds based on the defined requirements

Answer

Disseminating finished intelligence reports to SOC analysts and executives

Answer

Producing finished intelligence reports with recommendations for decision makers

Question 15

You are the CTI lead at a hospital network. Your SOC receives a vendor report stating that a ransomware group is actively targeting healthcare providers in your region with a new encryptor. Your CISO asks what the FIRST action should be to convert this intelligence into operational value for the SOC. What do you do?

Accepted Answer

Map the reported TTPs to MITRE ATT&CK and check whether existing detections and controls cover them. Because the report describes adversary behavior rather than static indicators, the highest-value first move is to map those behaviors to ATT&CK and evaluate detection and control coverage. This converts strategic reporting into an actionable gap list, letting the SOC prioritize engineering work where the hospital is genuinely exposed. Blocking broad protocols or stale hashes does not address the described targeting pattern.

Answer

Immediately block all outbound SMB traffic at the perimeter firewall

Answer

Add every file hash mentioned in the report to the EDR blocklist and close the ticket

Answer

Escalate the report to the legal department and wait for their guidance before informing the SOC

Question 16

An analyst at a financial services firm receives a threat feed where each entry contains a 'confidence' field set to 85. The feed vendor's documentation states that confidence values are expressed as a percentage. The analyst needs to normalize this data before loading it into the internal threat intelligence platform, which accepts confidence on a 0-100 integer scale. Which action should the analyst take during processing?

Accepted Answer

Map the value directly as an integer without modification.. The vendor's confidence is already expressed as a percentage on a 0-100 scale, and the destination platform accepts the same scale. Therefore, the analyst should map the value directly without transformation. This preserves the original meaning and avoids introducing errors that would occur with unnecessary scaling or field removal.

Answer

Convert the value to a decimal between 0 and 1 by dividing by 100.

Answer

Multiply the value by 10 to expand the scale to 0-1000 for finer granularity.

Answer

Discard the confidence field and rely solely on the indicator type for prioritization.

Question 17

Your SOC is building a threat intelligence program and the CISO asks which outputs should be delivered to the risk management team to support enterprise risk decisions. (Choose two.)

Accepted Answer

A heat map of control gaps mapped to the ATT&CK techniques used by those prioritized actors. Risk management consumes intelligence that expresses threat in likelihood and impact terms. A sector-relevant actor assessment tells the organization who is likely to attack and how damaging that would be, while a control gap heat map tied to those actors' ATT&CK techniques shows where exposure is concentrated. Together they support risk treatment, control investment, and residual risk acceptance decisions.

Answer

A log of every SIEM alert triggered in the past quarter, including false positives

Answer

Raw packet captures from the SOC's network sensors for the past 90 days

Answer

The full, unfiltered indicator feed from every commercial TI vendor under contract

Question 18

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Accepted Answer

Processing. Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.

Answer

Collection

Answer

Dissemination

Answer

Analysis

Question 19

A threat hunter is reviewing DNS query logs from a corporate recursive resolver to identify hosts that may be beaconing to a domain generation algorithm (DGA) family. The hunter notices that one workstation generates many queries for short, random-looking domains that all fail with NXDOMAIN, while another workstation generates far fewer queries but with a consistent subdomain string appended to a long-lived domain. Which observation most strongly indicates an active DGA-based beacon rather than normal application behavior?

Accepted Answer

A high volume of NXDOMAIN responses for algorithmically generated names from a single internal host.. DGA malware must try many generated domains before finding one the attacker registered, so the resolver sees a burst of NXDOMAIN answers for random-looking names from one host. Stable subdomains, private-space lookups, and popular resolving domains all occur in benign traffic, making them poor DGA indicators. Volume, randomness, and failure ratio together distinguish DGA beaconing.

Answer

Queries for popular public domains that resolve successfully and are repeated across many workstations.

Answer

A consistent subdomain string appended to a single long-lived domain queried at regular intervals.

Answer

Queries for domains that resolve to private RFC1918 address space from an internal host.

Question 20

A CTI team is developing a collection plan for a new intelligence requirement focused on ransomware groups targeting the healthcare sector. The team must select the most relevant sources to gather information on these groups' tactics, techniques, and procedures (TTPs). Which of the following sources would provide the most direct and actionable intelligence for this requirement?

Accepted Answer

Dark web forums and marketplaces where ransomware groups communicate and advertise.. Dark web forums and marketplaces are where ransomware groups plan and coordinate, making them a direct source for intelligence on their TTPs. Monitoring these hidden channels can yield actionable information such as new ransomware variants, exploit techniques, and targeting preferences. This source aligns closely with the requirement to understand ransomware groups targeting healthcare, enabling proactive defense.

Answer

Industry reports from healthcare associations on cybersecurity best practices.

Answer

Vulnerability databases such as the National Vulnerability Database (NVD).

Answer

Social media platforms like Twitter and LinkedIn for general cybersecurity discussions.