312-85 Practice Test 3 — 10 Questions

Question 1

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Accepted Answer

Tasking collection assets and monitoring the flow of raw intelligence data. Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.

Answer

Conducting corporate financial payroll audits

Answer

Configuring office building climate control thermostats

Answer

Writing custom assembly code for rootkit deployment

Question 2

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Accepted Answer

Pivot to identify the Capability or Adversary. After identifying infrastructure, the next step is to pivot to identify the associated Capability or Adversary, creating a chain of evidence.

Answer

Update the firewall blacklist only

Answer

Change all user passwords

Answer

Close the incident ticket

Question 3

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

Accepted Answer

Assume TLP:RED.. When TLP is missing, the default safest practice is to assume TLP:RED or the most restrictive category to prevent unauthorized disclosure.

Answer

Publish to public forums.

Answer

Discard the data entirely.

Answer

Assume TLP:CLEAR.

Question 4

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Accepted Answer

An executive summary of the potential business impact of the threat. Strategic intelligence, which focuses on trends and risk impact, is designed for executive audiences.

Answer

A detailed list of firewall rules to block the attacker

Answer

Raw log data from the IDS/IPS

Answer

A breakdown of the malware assembly code

Question 5

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

Accepted Answer

Confirmation Bias. Confirmation bias is the tendency to search for, interpret, favor, and recall information in a way that confirms or supports one's prior beliefs or values.

Answer

Availability Heuristic

Answer

Mirror Imaging

Answer

Bandwagon Effect

Question 6

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Accepted Answer

Percentage of intelligence reports that result in actionable security controls or detection rules. Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.

Answer

Number of threat intelligence blog posts published on the corporate website

Answer

Total gigabytes of threat data ingested from commercial feeds per month

Answer

Total number of security alerts generated by the SIEM

Question 7

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

SHA-256 File Hash. IOCs are typically digital forensic artifacts like file hashes or network connection logs.

Answer

Server rack temperature

Answer

Employee behavior patterns

Answer

Project management timeline

Question 8

You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?

Accepted Answer

Refine the evidence definitions to focus on the contradictory data points to assess if the hypothesis remains viable.. ACH methodology dictates that you should focus on evidence that disproves hypotheses rather than supports them. Finding contradictory evidence is more diagnostic than finding supporting evidence.

Answer

Consolidate the contradictory evidence into the supporting evidence category.

Answer

Discard the hypothesis immediately if any contradictory evidence exists.

Answer

Increase the weight of supporting evidence to balance the matrix.

Question 9

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Accepted Answer

The timeliness of the intelligence.. Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.

Answer

The size of the vendor's marketing department.

Answer

The format of the document (PDF vs CSV).

Question 10

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

Accepted Answer

Sensitive file access and data movement tracking.. Insider threats are detected via access logs, file activity, and network communication patterns.

Answer

Employee cafeteria transaction history.

Answer

Public internet speed test results.