312-85 Practice Test 26 — 15 Questions

Question 1

A threat intelligence analyst is tasked with enriching indicators of compromise (IOCs) from a recent malware campaign. The analyst has a list of file hashes and wants to gather additional context to support incident response. Which TWO of the following actions would BEST provide actionable intelligence about the malware's capabilities and infrastructure? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Querying the hashes against a threat intelligence platform to identify related campaigns and threat actors.. Submitting hashes to a multi-engine malware analysis service provides detection names, behavioral reports, and additional IOCs. Querying a threat intelligence platform correlates the hashes with known campaigns and threat actors, offering strategic context. Together, these actions enrich the IOCs with actionable intelligence about the malware's capabilities and infrastructure, enabling better incident response and threat hunting.

Answer

Searching the hashes in a public search engine to see if they appear in any reports.

Answer

Performing a WHOIS lookup on the domain names associated with the hashes.

Answer

Running the hashes through a local antivirus scanner to confirm detection.

Question 2

A threat intelligence analyst is examining a malware sample that uses a technique to hide its presence by injecting code into a legitimate process. The analyst observes that the malware creates a new process in a suspended state, unmaps its memory, and replaces it with malicious code. Which technique is being used?

Accepted Answer

Process hollowing. Process hollowing is a technique where a new process is created in a suspended state, its memory is unmapped, and malicious code is written into its address space. The process is then resumed, and the malicious code executes under the guise of the legitimate process. This allows malware to evade detection by hiding within a trusted process and is a common method used by advanced malware.

Answer

Reflective DLL injection

Answer

Thread execution hijacking

Answer

DLL injection

Question 3

A SOC manager is reviewing the incident response process and wants to ensure that threat intelligence is effectively used during an active incident. The manager asks the analyst to provide intelligence that will help the team understand the adversary's likely next steps and prioritize containment efforts. Which type of threat intelligence should the analyst prioritize?

Accepted Answer

Operational intelligence about the adversary's campaign and infrastructure.. Operational intelligence is the correct choice because it provides context about the adversary's campaign, infrastructure, and planned operations, enabling incident responders to anticipate next steps and prioritize containment efforts. Strategic intelligence is too high-level, technical intelligence lacks behavioral context, and tactical intelligence focuses on specific techniques rather than the overall campaign trajectory.

Answer

Tactical intelligence about specific TTPs used in the incident.

Answer

Technical intelligence about new malware hashes.

Answer

Strategic intelligence about the adversary's long-term goals.

Question 4

A newly appointed CTI lead at a financial services firm is asked to align the intelligence program with the business’s strategic risk appetite. The executive team wants to know how CTI will support decisions about mergers and acquisitions. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs) in this context?

Accepted Answer

To articulate the specific intelligence needs of key decision-makers so that collection and analysis remain focused on their requirements.. Priority Intelligence Requirements are the bridge between decision-maker needs and intelligence production. They focus collection and analysis on the specific questions that support strategic, operational, and tactical decisions. In an M&A context, PIRs ensure that CTI addresses threats that could impact deal value, integration, or regulatory approval, rather than pursuing unrelated topics. They are dynamic and reviewed regularly.

Answer

To prioritize intelligence collection assets based on the technical difficulty of obtaining data.

Answer

To document all possible threats to the organization regardless of whether they affect current business decisions.

Answer

To establish a fixed set of intelligence topics that remain unchanged for the life of the program.

Question 5

A threat hunter is examining network flow data to detect potential lateral movement using the SMB protocol. The hunter notices a series of connections from a single workstation to multiple servers on port 445, each followed by a short-lived session. Which analysis technique would best help identify this as malicious lateral movement?

Accepted Answer

Use frequency analysis to identify workstations connecting to an unusually high number of distinct servers on port 445 within a short time window.. Lateral movement using SMB often manifests as a single source connecting to many destinations on port 445 in a short time, indicative of scanning or spreading. Frequency analysis of destination IPs per source can highlight such anomalous patterns. Other techniques like throughput analysis or dialect inspection may not capture the breadth of connections that signal lateral movement.

Answer

Inspect the SMB dialect negotiated in each session and flag sessions using SMBv1, as it is inherently malicious.

Answer

Monitor for SMB sessions that transfer files with extensions like .exe or .dll, as these are always malicious.

Answer

Calculate the average bytes per second for each SMB session and flag sessions with unusually high throughput.

Question 6

A government agency's CTI team produces a finished intelligence product for policymakers. The team wants to apply structured analytic techniques to reduce cognitive bias and communicate uncertainty clearly. Which practice best supports this objective?

Accepted Answer

Apply techniques such as analysis of competing hypotheses and key assumptions check, and express judgments using estimative probability language with explicit confidence levels.. Structured analytic techniques such as analysis of competing hypotheses and key assumptions check, combined with calibrated probability language and explicit confidence levels, directly address cognitive bias and uncertainty communication. The other options either remove uncertainty information, hide alternatives, or substitute authority for method, all of which undermine analytic rigor.

Answer

Defer all judgments to the most senior analyst on the team and publish only that analyst's conclusion to ensure consistency across products.

Answer

State conclusions as definitive facts without confidence levels so that policymakers are not confused by probabilistic language.

Answer

Use only a single analytic method and avoid documenting alternative hypotheses, since documenting them may signal weakness in the assessment.

Question 7

A threat hunter is investigating a suspected data exfiltration over HTTPS. The hunter has full network traffic capture and wants to identify potential exfiltration channels. Which two characteristics are most indicative of malicious exfiltration over HTTPS? (Choose two.)

Accepted Answer

Outbound HTTPS traffic to a domain that was registered recently and has no prior reputation.. Large outbound transfers to new external IPs during off-hours and traffic to recently registered domains with no reputation are both strong indicators of data exfiltration. These characteristics reflect common attacker behaviors: exfiltrating data to infrastructure they control and avoiding detection by using new domains. Other options like secure cipher suites or self-signed certificates are not inherently malicious.

Answer

HTTPS traffic using a self-signed certificate from an internal server.

Answer

Periodic small outbound connections to the same external IP address at regular intervals.

Answer

Sessions using TLS 1.2 with perfect forward secrecy ciphers.

Question 8

A telecommunications provider's CTI team is preparing to share finished intelligence with a trusted industry ISAC. The team must decide what to include and how to protect sensitive content. Which two practices are appropriate for sharing intelligence in this context? (Choose two.)

Accepted Answer

Apply Traffic Light Protocol markings to the product so recipients understand the permitted scope of onward sharing.. Appropriate sharing combines clear handling markings with meaningful context. Applying Traffic Light Protocol communicates permitted dissemination, and including context, assessment, and recommended actions makes the intelligence actionable. Exposing source identities, publishing without access control, and stripping confidence statements all increase risk or reduce utility for recipients.

Answer

Publish the product on a public website so that all ISAC members and the broader community can access it without access controls.

Answer

Remove all confidence statements to avoid disagreements with ISAC members about analytical judgments.

Answer

Include raw source identities and unredacted collection details so ISAC members can independently verify every claim.

Question 9

A SOC analyst is triaging a suspected intrusion and receives a threat intelligence report that contains a list of adversary tactics, techniques, and procedures (TTPs) from a known APT group. The analyst wants to map these TTPs to the MITRE ATT&CK framework to identify gaps in detection coverage. Which type of threat intelligence is the analyst primarily using?

Accepted Answer

Tactical threat intelligence. Tactical threat intelligence is the correct choice because it delivers TTPs that can be directly mapped to frameworks like MITRE ATT&CK, enabling SOC analysts to assess and improve detection coverage. Strategic intelligence is for business leaders, operational intelligence covers campaign-level planning, and technical intelligence focuses on atomic indicators. The analyst's goal of mapping TTPs to ATT&CK aligns with tactical intelligence.

Answer

Strategic threat intelligence

Answer

Operational threat intelligence

Answer

Technical threat intelligence

Question 10

A threat intelligence analyst is integrating a new feed into the SOC's SIEM. The feed provides indicators with a confidence score of 75. The analyst notices that some indicators are six months old and have not been observed recently. According to best practices for threat intelligence in SOC operations, what should the analyst do first to ensure effective alerting?

Accepted Answer

Enrich the indicators with internal telemetry and historical context to assess their current relevance.. Enriching indicators with internal telemetry and historical context is the correct first step because it allows the analyst to assess the current relevance of the indicators before taking enforcement or alerting actions. This process reduces false positives and ensures that SOC resources are focused on genuine threats. Blocking, discarding, or alerting indiscriminately can lead to operational issues or missed detections.

Answer

Discard all indicators older than three months because they are no longer actionable.

Answer

Configure the SIEM to generate alerts for all indicators regardless of age or confidence.

Answer

Immediately block all indicators at the firewall to prevent any potential compromise.

Question 11

A CTI manager is conducting a requirements review with stakeholders from legal, IT, and business units. During the meeting, the legal team requests intelligence on data breach notification laws in all 50 U.S. states. The CTI team currently has no collection sources for legal research. Which action should the CTI manager take FIRST to address this request?

Accepted Answer

Assess the request against the organization’s intelligence requirements and determine if it is a valid CTI requirement or better handled by legal counsel.. The first step in handling a new intelligence request is validation against the program’s requirements and mission. Not every request from a stakeholder is a CTI requirement; some are better handled by other departments. By assessing the legal team’s request, the CTI manager can determine if it supports a decision that threat intelligence should inform. If it is out of scope, the manager can redirect it appropriately, preserving CTI resources.

Answer

Escalate the request to the CISO to decide whether the CTI team should handle legal research.

Answer

Add the request to the collection plan and prioritize it above existing requirements because it comes from legal.

Answer

Immediately task the collection team to acquire legal databases and begin monitoring state legislation.

Question 12

A threat intelligence analyst is tasked with enriching indicators of compromise (IOCs) from a recent malware campaign. The analyst has a list of file hashes and wants to gather additional context to support incident response. Which TWO of the following actions would BEST provide actionable intelligence about the malware's capabilities and infrastructure? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The potential business impact and likelihood of the ransomware affecting the organization.. The correct choice is to emphasize the potential business impact and likelihood of the ransomware affecting the organization. Executives require strategic intelligence that translates technical threats into business risk, enabling them to make informed decisions about mitigation investments and priorities. Technical details like hashes, TTPs, and IOCs are more appropriate for operational teams.

Answer

The specific SHA-256 hashes of the ransomware binaries.

Answer

The TTPs used by the ransomware group, mapped to MITRE ATT&CK.

Answer

The list of indicators of compromise (IOCs) provided by the ISAC.

Question 13

A CTI analyst is drafting intelligence requirements for a new program. The analyst wants to ensure that each requirement is actionable and can be used to guide collection. Which of the following is the most important characteristic of a well-written intelligence requirement?

Accepted Answer

It is tied to a specific decision or action that the intelligence will inform.. Intelligence requirements are most effective when they are directly linked to a decision or action. This linkage ensures that the intelligence produced is relevant and actionable. It also helps prioritize collection and analysis, as requirements tied to high-stakes decisions take precedence. Without this linkage, requirements can become academic exercises that do not serve the organization’s needs.

Answer

It is broad enough to cover all potential threats to the organization.

Answer

It specifies the exact collection source and method to be used.

Answer

It remains unchanged throughout the intelligence cycle to maintain consistency.

Question 14

A CTI team is conducting a periodic review of its intelligence requirements. The team notices that several requirements have not generated any collection or analysis in the past six months. Which of the following is the MOST appropriate action for the team to take?

Accepted Answer

Assess each requirement to determine if it is still relevant to decision-makers and if collection gaps exist, then adjust or retire as needed.. During a requirements review, the team must evaluate whether each requirement still supports a decision and whether collection is adequate. Inactive requirements may be obsolete or may signal collection gaps. The appropriate action is to assess both relevance and collection effectiveness, then adjust or retire accordingly. This keeps the program focused and resource-efficient.

Answer

Leave the requirements unchanged to maintain continuity and avoid disrupting the program.

Answer

Retire the requirements and reallocate resources to more active requirements.

Answer

Increase collection efforts by adding new sources to satisfy the requirements.

Question 15

A CTI manager is developing a collection plan to support a new intelligence requirement on supply chain attacks targeting the organization’s software vendors. The manager needs to identify the types of intelligence sources that should be included. Which THREE of the following are appropriate sources for this collection plan? (Choose three.)

Accepted Answer

Open-source intelligence (OSINT) from vendor security advisories and vulnerability databases.. A collection plan for supply chain attacks should include external sources that provide information on threats to software vendors. Commercial threat intelligence feeds offer indicators and adversary infrastructure. OSINT from vendor advisories and vulnerability databases reveals known weaknesses. HUMINT from peers and ISACs provides trusted, contextual insights. Together, these sources enable comprehensive monitoring of supply chain risks.

Answer

Internal logs from the organization’s own endpoint detection and response (EDR) systems.

Answer

Financial reports from the organization’s software vendors to assess their profitability.