312-85 Practice Test 5 — 25 Questions

Question 1

When performing quantitative analysis, which THREE of the following are necessary to calculate the Annualized Loss Expectancy (ALE)?

Accepted Answer

Single Loss Expectancy (SLE). ALE = SLE x ARO. SLE is calculated by Asset Value x Exposure Factor.

Answer

Employee performance ratings.

Answer

Total cost of the organization's office space.

Question 2

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Accepted Answer

A list of identified threats categorized by type.. Documentation must define the scope of the system and the potential threats identified against that scope.

Answer

The budget allocated for the security team.

Answer

The employee handbook for the IT department.

Answer

A list of all employees with admin access.

Question 3

Which TWO of the following are recognized categories of threat intelligence sources?

Accepted Answer

Open Source Intelligence (OSINT).. Threat intelligence sources are generally categorized into open-source (OSINT) and closed/proprietary sources.

Answer

Local User Logs.

Answer

Internal Hardware Inventory.

Answer

Network Topology Maps.

Question 4

Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?

Accepted Answer

The TIP requires a schema transformation for STIX 1.x to 2.x. STIX 2.x is not backward compatible with STIX 1.x due to significant changes in the JSON structure and object models.

Answer

The feed is missing the mandatory TAXII headers

Answer

The feed contains invalid XML tags

Answer

STIX 1.2 does not support JSON format

Question 5

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Accepted Answer

To represent the organization or individual performing or being targeted by an activity. The Identity object identifies the victim or the perpetrator, providing context on who is being targeted or who is performing the action.

Answer

To list the malware families used

Answer

To define the technical infrastructure of the attacker

Answer

To provide the IP addresses of the C2

Question 6

Which of the following is an example of 'structured' threat intelligence data?

Accepted Answer

A STIX 2.1 JSON file.. STIX/TAXII provides a machine-readable, structured format for intelligence.

Answer

An email body.

Answer

A handwritten note.

Answer

A PDF report from a vendor.

Question 7

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Accepted Answer

Define specific PIRs regarding third-party software vendors and update frequency. Refining requirements involves transforming abstract topics into measurable intelligence needs (Priority Intelligence Requirements).

Answer

Ignore the request until more data is available

Answer

Purchase all available supply chain threat reports

Answer

Automate the collection of all supply chain news

Question 8

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

Accepted Answer

TAXII. TAXII (Trusted Automated eXchange of Intelligence Information) is the application-layer protocol designed specifically to transport STIX information.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 9

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

Accepted Answer

Lack of standardized formatting.. Data volume, lack of standardization, and quality/noise are the most significant hurdles in intelligence ingestion.

Answer

Lack of internet access.

Answer

Defaulting to TLP:CLEAR.

Question 10

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

Accepted Answer

The object ID (UUID).. The 'pattern' or 'hash' (if applicable) or a unique 'external_id' are common identifiers, but 'id' in STIX is the unique object identifier.

Answer

The file size.

Answer

The source name.

Answer

The timestamp of ingestion.

Question 11

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Accepted Answer

Standardizing time formats (e.g., UTC).. Normalization involves mapping diverse data to a common schema and standardizing fields like time and identity.

Answer

Deleting all historical data.

Answer

Increasing the firewall throughput.

Answer

Disabling API authentication.

Question 12

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

Accepted Answer

Apply the TLP marking to the document. The TLP (Traffic Light Protocol) is the globally accepted standard for communicating intelligence sensitivity and sharing boundaries.

Answer

Send the report via an encrypted channel

Answer

Password protect the document

Answer

Use a disclaimer at the bottom of the email

Question 13

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

Accepted Answer

Malware Hashes. Tactical intelligence is focused on immediate, technical indicators that can be used to stop an attack, such as IOCs and malware hashes.

Answer

Geopolitical threat assessments

Answer

Executive risk summaries

Answer

Industry trend analysis

Question 14

Which of the following is a 'pull-based' method of threat intelligence data collection?

Accepted Answer

TAXII Poll.. A TAXII client requesting data from a TAXII server (Poll) is a pull-based method.

Answer

Webhook notifications.

Answer

Email distribution lists.

Answer

RSS feeds.

Question 15

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

Accepted Answer

Validate the JSON bundle against the STIX 2.1 schema. Validating the JSON schema against the STIX 2.1 specification is the definitive way to identify structural inconsistencies in the received bundle.

Answer

Restart the TAXII server service

Answer

Check the TLS certificate expiration date

Answer

Check the firewall rules for port 443

Question 16

Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?

Accepted Answer

GDPR. GDPR (General Data Protection Regulation) has strict requirements regarding the export and sharing of personal data, which often includes logs or artifacts linked to individuals.

Answer

HIPAA

Answer

SOX

Answer

PCI-DSS

Question 17

Which THREE of the following are core components of the STIX 2.1 Domain Object (SDO) structure?

Accepted Answer

Threat-Actor. The SDOs are the building blocks of STIX 2.1 intelligence, which include Actors, Malware, and Attack Patterns among others.

Answer

TLP-Level

Answer

TAXII-Server

Question 18

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

Accepted Answer

pattern. A well-formed STIX 2.1 Indicator requires an ID, a type, and the pattern that defines what is being looked for (the indicator logic).

Answer

description

Answer

valid_until

Question 19

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

Accepted Answer

To prevent false positives from blocking legitimate traffic. Vetting prevents false positives by verifying the validity and current relevance of indicators before they affect production traffic.

Answer

To reduce the volume of indicators for storage

Answer

To increase the threat score of each IP

Answer

To format the IP addresses into CIDR blocks

Question 20

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Accepted Answer

Cross-referencing indicators across multiple sources.. Data reliability is improved through source verification and cross-referencing indicators across multiple platforms.

Answer

Removing all metadata.

Answer

Increasing the ingest frequency.

Answer

Automatically trusting all feeds.