312-85 Practice Test 4 — 25 Questions

Question 1

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

Accepted Answer

The hypothesis is the least likely to be correct given the current evidence set.. In ACH, lower scores in the matrix often indicate that the evidence strongly contradicts the hypothesis.

Answer

The hypothesis is the most likely scenario.

Answer

The hypothesis is heavily supported by available data.

Answer

The hypothesis lacks enough evidence to be evaluated.

Question 2

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Accepted Answer

Defense Evasion. Process Hollowing is a form of Defense Evasion, as it allows malicious code to hide inside a legitimate process.

Answer

Lateral Movement

Answer

Credential Access

Answer

Persistence

Question 3

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Accepted Answer

T1018. T1087 (Account Discovery) or specifically T1018 (Remote System Discovery) are used for reconnaissance; 'net view' is specifically linked to Remote System Discovery.

Answer

T1071

Answer

T1059

Answer

T1027

Question 4

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Accepted Answer

Registry key modification. A Registry key modification is a change made directly to the infected host system, making it a host-based indicator.

Answer

User-Agent string in HTTP header

Answer

Domain name for C2 beaconing

Answer

Source IP address in firewall logs

Question 5

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Accepted Answer

Capability. The four core vertices of the Diamond Model are Adversary, Capability, Infrastructure, and Victim.

Answer

Network Topology

Answer

Payload

Question 6

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Accepted Answer

Clearing Windows Event Logs. Defense Evasion covers any method used to hide from security tools, such as clearing logs or disabling antivirus.

Answer

Brute-forcing RDP

Answer

Setting up a VPN

Answer

Running a port scan

Question 7

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

Accepted Answer

Calculate the Z-score of the timestamp distribution.. Standard deviation or Z-score is used to determine how many standard deviations an observation is from the mean.

Answer

Apply the Mode of the frequency dataset.

Answer

Perform a simple Median split.

Answer

Use the Range calculation.

Question 8

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Accepted Answer

Threat actor aliases. The Adversary vertex tracks the threat actor's identity, including known aliases and their organizational affiliation.

Answer

Targeted industry

Answer

IP address range

Answer

Malware variant

Question 9

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Accepted Answer

Information Disclosure. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Plain text logging of tokens is a classic Information Disclosure vulnerability.

Answer

Elevation of Privilege

Answer

Tampering

Answer

Repudiation

Question 10

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Accepted Answer

A command-line execution sequence. IOCs are static (hashes, IPs), whereas IOAs describe patterns of activity (behavior) that indicate an attack is in progress.

Answer

A known malicious file hash

Answer

A specific registry key for malware persistence

Answer

A blacklisted IP address

Question 11

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Accepted Answer

T1547.001: Registry Run Keys. Modifying Run keys is a standard method for achieving persistence on Windows systems, mapped to T1547.001.

Answer

T1003: OS Credential Dumping

Answer

T1059.001: PowerShell

Answer

T1021: Remote Services

Question 12

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

Accepted Answer

Timeliness. Good IOCs must be accurate, timely, and contextually relevant to the threat environment.

Answer

File Size

Answer

Vendor Popularity

Question 13

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

Accepted Answer

Reconnaissance. Reconnaissance, Weaponization, and Delivery occur before the attacker has a presence on the target host.

Answer

Installation

Answer

Exploitation

Question 14

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Accepted Answer

Determine the Tactic and map the specific Technique ID.. Mapping involves identifying the Technique ID (T1574.002) and analyzing it within the context of the observed execution flow.

Answer

Perform a Root Cause Analysis on the operating system.

Answer

Use the CVSS score of the DLL to prioritize the threat.

Answer

Calculate the frequency of the DLL calls to determine the actor intent.

Question 15

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Accepted Answer

Reconnaissance. Network security controls (firewalls, IDS/IPS, proxies) are most effective at the stages involving external communication and delivery.

Answer

Installation

Answer

Actions on Objectives

Question 16

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

Accepted Answer

How changes in input variables affect the model's output.. Sensitivity analysis determines how changes in individual input variables (like threat probability or asset value) impact the overall final output or risk calculation.

Answer

Whether the threat actor has successfully exfiltrated data.

Answer

The total number of threat actors targeting the organization.

Answer

The cryptographic strength of the data being protected.

Question 17

Which TWO of the following are primary goals of conducting a threat modeling exercise on a new software application?

Accepted Answer

To define security requirements based on the risk profile.. Goals include identifying risks early and defining security requirements to mitigate those risks.

Answer

To provide a complete marketing brochure for the software.

Answer

To ensure the software meets the latest UI standards.

Answer

To replace the need for automated unit testing.

Question 18

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

Accepted Answer

In the TAXII client configuration settings.. Filtering by confidence levels is typically performed within the TAXII client configuration or via an API parameter defined by the threat feed provider.

Answer

At the firewall level.

Answer

By disabling the feed authentication.

Answer

By modifying the STIX schema.

Question 19

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. ALE = SLE x ARO. Since ALE = Probability x Impact, original ALE = 0.2 x $500,000 = $100,000. New probability is 0.1. 0.1 x $500,000 = $50,000.

Answer

$75,000

Answer

$100,000

Answer

$25,000

Question 20

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

Accepted Answer

It helps filter out random 'noise' to highlight consistent temporal patterns.. Rolling averages help identify underlying trends in noisy data, making periodic beaconing patterns more visible.

Answer

It increases the absolute volume of the data collected.

Answer

It eliminates the need for further traffic inspection.

Answer

It encrypts the log data for safer analysis.