312-85 Practice Test 3 — 10 Questions

Question 1

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

Accepted Answer

Standard deviation on interval deltas. Beaconing is characterized by regular, periodic callbacks from an infected host to C2 infrastructure. To detect periodicity, you must analyze the intervals between successive connections from the same source to the same destination. Computing the standard deviation of those interval deltas reveals how consistent the timing is — a low standard deviation indicates highly regular beaconing (e.g., every 60 seconds ± 2s), which is a strong indicator of automated C2.

Answer

Sum aggregation on connection counts

Answer

Min/Max aggregation on bytes

Answer

Cardinality count on source IPs

Question 2

You are building a link analysis chart to map an intrusion set's operational infrastructure. You have collected domain registrations, malware sample hashes, and command-and-control IP addresses, but you need to select additional data elements that will produce meaningful links rather than coincidental ones. (Choose two.)

Accepted Answer

Passive DNS resolution history showing which domains resolved to the same C2 IP within the campaign window.. Meaningful links in infrastructure analysis require artifacts with low base rates and temporal alignment to the campaign. TLS certificate serials and issuer strings are reused by adversaries across C2 servers, and passive DNS history connects domains to C2 IPs within the campaign window. Both produce defensible clusters, unlike shared privacy WHOIS addresses, coarse geolocation, or aggregate detection counts.

Answer

The total number of malware detections reported for each hash across all customers of your antivirus vendor.

Answer

The geographic country of the IP addresses based solely on a commercial geolocation database.

Answer

The registrar's generic WHOIS privacy email address used by thousands of unrelated domains.

Question 3

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Accepted Answer

join. The `join` operator in KQL is the correct choice because it combines rows from two tables (e.g., a ThreatIntelligenceIndicator table and a DeviceEvents/DeviceLogs table) based on a matching key column such as IP address, file hash, or domain. This is exactly the operation needed to correlate TI indicator data with device telemetry for Living off the Land hunting. `join` supports inner, leftouter, rightouter, fullouter, and anti/leftanti/semi variants, giving analysts flexibility in matching indicators to observed activity.

Answer

merge

Answer

lookup

Answer

union

Question 4

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Accepted Answer

Application of NLP techniques to extract entities.. NLP (Natural Language Processing) is the standard technique for converting unstructured text into structured, normalized intelligence.

Answer

Hashing the entire document.

Answer

Direct ingestion into the SIEM.

Answer

Manual entry into a spreadsheet.

Question 5

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Accepted Answer

Downloading remote payloads. certutil.exe is a legitimate Windows utility for managing certificates, but attackers abuse its -urlcache and -split flags to download files from remote URLs, effectively turning it into a LOLBin downloader. This allows payload retrieval without introducing custom malware, evading application whitelisting.

Answer

Extracting browser passwords

Answer

Clearing event logs

Answer

Modifying system registry keys

Question 6

An analyst is extracting indicators from a large collection of PDF reports. The reports contain IP addresses embedded in narrative text, tables, and footnotes with inconsistent formatting. The analyst needs a repeatable method to extract IPv4 addresses while minimizing false positives from version numbers such as 10.2.3.4. Which approach best supports this requirement?

Accepted Answer

Write regular expressions that match IPv4 octet ranges and require word boundaries, then manually review matches for context.. Unstructured reports require pattern-based extraction with validation and human review. Regular expressions can enforce IPv4 octet ranges and word boundaries, which filters out many version-number-like strings. Manual review then resolves ambiguous matches using context. This balances automation with accuracy and produces a repeatable process suitable for collection and processing workflows.

Answer

Import the PDFs into a SIEM and rely on the SIEM's built-in threat intelligence parser to extract addresses.

Answer

Use a YARA rule with strings matching dotted-decimal notation and scan the PDF files directly.

Answer

Convert the PDFs to plain text and upload them to a commercial sandbox for automated indicator extraction.

Question 7

You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?

Accepted Answer

Execution. PowerShell is a command-line shell and scripting language used for execution. In MITRE ATT&CK, the use of PowerShell for executing commands is mapped to the Execution tactic, specifically technique T1059.001 (PowerShell).

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 8

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 9

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Accepted Answer

Cross-referencing indicators across multiple sources.. Option C (Cross-referencing indicators across multiple sources) is correct because corroborating an indicator such as an IP address, domain, or file hash against independent feeds reduces false positives and increases confidence in its accuracy and relevance. Option D (Validating the source authenticity) is correct because confirming that a feed genuinely originates from a trusted, reputable provider (for example via signed feeds, verified credentials, or established reputation) prevents ingestion of spoofed or poisoned intelligence that would degrade reliability. Option A is wrong because metadata such as timestamps, confidence scores, and provenance is essential for assessing indicator freshness and trustworthiness, so removing it harms reliability. Option B is wrong because increasing ingest frequency only refreshes data faster; it does not improve the accuracy or trustworthiness of the intelligence itself. Option E is wrong because automatically trusting all feeds is the opposite of reliability, as it allows unvetted or malicious data to enter the pipeline unchecked.

Answer

Removing all metadata.

Answer

Increasing the ingest frequency.

Answer

Automatically trusting all feeds.

Question 10

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Accepted Answer

Tasking collection assets and monitoring the flow of raw intelligence data. Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.

Answer

Conducting corporate financial payroll audits

Answer

Configuring office building climate control thermostats

Answer

Writing custom assembly code for rootkit deployment