312-85 Practice Test 2 — 30 Questions

Question 1

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The adversary's phishing email address and spoofed sender domain. Infrastructure in the Diamond Model comprises the physical and logical communication structures the adversary uses, such as command-and-control domains, IP addresses, and phishing email addresses or spoofed sender domains. These elements enable the adversary to deliver capabilities and maintain control. Malware and exploits are Capability, victim assets are Victim, and adversary personas are Adversary, so those options do not belong to Infrastructure.

Answer

The adversary's social media profile used for reconnaissance

Answer

The victim organization's internal file server hostname

Answer

The specific malware family and exploit code used in the attack

Question 2

A threat intelligence analyst is processing a new feed that contains indicators of compromise (IOCs) in STIX 2.1 format. Before ingesting the data into the internal platform, the analyst must validate that the STIX objects conform to the specification. Which two of the following are required properties for a STIX 2.1 'Indicator' object? (Choose two.)

Accepted Answer

pattern_type. In STIX 2.1, an Indicator object must include the 'pattern' and 'pattern_type' properties. The 'pattern' contains the detection logic, and 'pattern_type' specifies the language of that pattern. Other properties like 'name', 'description', and 'valid_from' are optional and provide context but are not required for the object to be valid.

Answer

name

Answer

description

Answer

valid_from

Question 3

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Accepted Answer

T1572: Protocol Tunneling. This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.

Answer

T1204: User Execution

Answer

T1133: External Remote Services

Answer

T1053: Scheduled Task

Question 4

Your organization's SOC is drowning in alerts, and the CISO wants to reduce noise using threat intelligence. Which approach best applies TI to prioritize alerts during triage?

Accepted Answer

Enrich alerts with TI and use match results plus asset criticality to score and prioritize them for analysts. The most effective way to apply threat intelligence to alert triage is enrichment combined with asset criticality scoring. This produces a ranked queue where alerts tied to known malicious infrastructure and high-value assets rise to the top. Analysts work the highest-risk items first, which reduces effective noise without deleting detections or flooding senior staff with undifferentiated alerts.

Answer

Enrich every alert with all available TI feeds and route all enriched alerts to Tier 3

Answer

Suppress all alerts that contain any indicator appearing in any TI feed

Answer

Disable low-severity detection rules until the alert volume returns to a manageable level

Question 5

Which of the following best describes an Advanced Persistent Threat (APT)?

Accepted Answer

Sophisticated, long-term, targeted attacks. APTs are characterized by their long-term, targeted, and sophisticated nature, often backed by nation-states.

Answer

Automated script kiddies

Answer

Uncoordinated network scanning

Answer

Short-term ransomware campaigns

Question 6

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Accepted Answer

T1018. The 'net view' command is used to enumerate shared resources on a network, such as computers and shared folders. In MITRE ATT&CK, this activity is classified under T1018: Remote System Discovery, which covers techniques used to identify remote systems and shares. Therefore, T1018 is the correct mapping for internal reconnaissance using 'net view'.

Answer

T1071

Answer

T1059

Answer

T1027

Question 7

Which TWO methods are effective for visualizing threat actor TTPs within a CTI report?

Accepted Answer

Flow diagrams illustrating the attack execution sequence.. Option D is correct because flow diagrams (e.g., attack trees or sequence diagrams) map the ordered execution of adversary tactics, techniques, and procedures, making the attack chain and dependencies between steps immediately understandable to analysts and decision-makers. Option E is correct because heat maps aggregate TTP frequency or coverage data into a visual density representation, letting readers quickly spot the most prevalent or least-defended techniques across a campaign or sector. Both visualizations align with CTI reporting goals of conveying behavioral patterns rather than isolated artifacts. Option A does not belong because a bibliography is a reference list, not a visualization of TTPs. Option B does not belong because a photograph of a threat actor provides no technical insight into their tradecraft and is often unavailable or unreliable. Option C does not belong because a raw list of every log entry is unstructured telemetry, not a visualization, and would obscure rather than reveal TTP patterns.

Answer

A bibliography of all external sources.

Answer

A photograph of the threat actor.

Answer

A raw list of every log entry captured.

Question 8

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

Accepted Answer

Executive Summary PDF. An Executive Summary PDF is the most appropriate format for a CISO because it provides a high-level, strategic overview of the threat landscape, tailored for decision-makers who need concise, actionable insights rather than raw data. It typically includes trends, risks, and recommendations, aligning with the audience's need for strategic planning. Other formats are too technical or granular for an executive audience.

Answer

Full TAXII object dump

Answer

Raw STIX JSON feed

Answer

CSV list of IOCs

Question 9

Which of the following is an example of 'structured' threat intelligence data?

Accepted Answer

A STIX 2.1 JSON file.. STIX/TAXII provides a machine-readable, structured format for intelligence.

Answer

An email body.

Answer

A handwritten note.

Answer

A PDF report from a vendor.

Question 10

Which of the following is a 'pull-based' method of threat intelligence data collection?

Accepted Answer

TAXII Poll.. TAXII Poll is a pull-based collection method: the client initiates a request to the TAXII server to retrieve available collections or objects. This contrasts with push-based methods where the server or sender proactively delivers data to the consumer. TAXII 2.1 supports both collection endpoints and object endpoints that clients poll on demand.

Answer

Webhook notifications.

Answer

Email distribution lists.

Answer

RSS feeds.

Question 11

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Accepted Answer

Confidence Score. A Confidence Score directly quantifies the reliability and certainty of the intelligence, which is essential for the SOC team to assess whether the intelligence is actionable. It indicates how much trust can be placed in the data, enabling prioritization and response. Without a confidence score, the team cannot effectively determine the risk or the appropriate action, making it the most critical metric for proving actionability.

Answer

The total number of threat actors identified

Answer

The date the report was created

Answer

The TLP level

Question 12

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Accepted Answer

The interval between the occurrence of a threat and the availability of intelligence. Timeliness in threat intelligence measures the latency between when a threat event occurs and when intelligence about it becomes available to defenders. It is a core quality dimension alongside relevance, accuracy, and completeness, and it directly affects how actionable intelligence is — stale intel may describe threats that have already been mitigated or evolved.

Answer

The length of the intelligence report

Answer

The number of IOCs provided per month

Answer

The accuracy of the threat actor attribution

Question 13

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Accepted Answer

Triage, validate, and prioritize the RFI against established intelligence priorities. In the direction phase of the intelligence lifecycle, RFIs submitted by operational teams must go through a structured management process. The correct next step is to triage the RFI (assess its urgency and scope), validate it (confirm it aligns with collection capabilities and is a legitimate intelligence requirement), and prioritize it against established Priority Intelligence Requirements (PIRs). This ensures collection and analysis resources are directed toward the most mission-critical questions rather than ad-hoc operational noise.

Answer

Immediately publish the raw telemetry to the corporate intranet without validation

Answer

Archive the RFI immediately as operational queries fall outside the scope of CTI

Answer

Initiate an immediate red-team attack campaign against the external supplier

Question 14

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Accepted Answer

Systematically testing evidence against every hypothesis.. Option A is correct because ACH requires evaluating each piece of evidence against all competing hypotheses in a matrix, which exposes inconsistencies and prevents premature anchoring on a favored theory. Option D is correct because ACH emphasizes disconfirmation—actively seeking evidence that refutes a hypothesis—since a single credible disconfirming item can eliminate a hypothesis more decisively than confirming evidence can support it. Options B, C, and E are incorrect: weighting by personal intuition reintroduces the very bias ACH is designed to counter, focusing only on supporting evidence is confirmation bias, and limiting analysis to a single hypothesis defeats the comparative purpose of ACH.

Answer

Assigning weights based on personal intuition.

Answer

Focusing only on the evidence that supports your primary theory.

Answer

Limiting the number of hypotheses to one.

Question 15

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Accepted Answer

The vendor's track record for providing accurate, validated intelligence. Option A is correct because a vendor's historical accuracy and validation of intelligence directly determine whether its feeds can be trusted for detection and response decisions. Option B is correct because consistent reporting over time demonstrates reliability, reduces gaps in coverage, and shows the vendor is not sporadic or reactive. Option E is correct because transparency about methodology allows analysts to assess data provenance, collection sources, and analytical rigor, which is essential for trusting the intelligence. Option C is not correct because raw indicator volume without context is a poor reliability metric and can increase false positives. Option D is not correct because social media follower counts reflect popularity, not the technical quality or accuracy of threat intelligence.

Answer

The volume of indicators provided without context

Answer

The number of social media followers the vendor has

Question 16

A junior analyst asks how to choose between competing hypotheses about an intrusion. Which approach best reflects structured analytic technique?

Accepted Answer

List each hypothesis, identify evidence that would be inconsistent with it, and weigh how well the evidence distinguishes among them.. Analysis of competing hypotheses evaluates each candidate explanation against evidence and highlights disconfirming indicators, which guards against premature commitment and confirmation bias. The emphasis on diagnostic evidence ensures that conclusions rest on observations that actually distinguish among the alternatives rather than on volume or authority.

Answer

Choose the hypothesis that best matches the first indicator discovered during triage.

Answer

Adopt the hypothesis supported by the greatest number of indicators without examining their diagnostic value.

Answer

Select the hypothesis that the most senior analyst on the team favours and document that reasoning.

Question 17

A threat intelligence analyst is asked to support the incident response team during an active investigation of a suspected compromise. The IR team needs to know whether the observed IP address 203.0.113.45 is associated with any known threat actor. Which action should the analyst take first?

Accepted Answer

Query the IP address in the organization's internal threat intelligence platform and check for any associated campaigns or malware families.. The most efficient and appropriate first step is to query the organization's internal threat intelligence platform, which consolidates multiple sources and historical data. This provides immediate context on whether the IP is linked to known campaigns or malware families, directly supporting the IR team's need for rapid assessment during an active investigation. Other actions like WHOIS, port scanning, or sandbox submission are either irrelevant or inappropriate.

Answer

Run a port scan against the IP address to determine which services are exposed.

Answer

Perform a WHOIS lookup to identify the IP address's registration details and ownership.

Answer

Submit the IP address to a public sandbox for dynamic analysis.

Question 18

A CTI manager is reviewing the team's Priority Intelligence Requirements (PIRs) and notices that they are too broad, making it difficult to focus collection efforts. Which action should the manager take to improve the PIRs?

Accepted Answer

Narrow the scope by specifying the threat actors, tactics, and assets of concern.. The correct action is to narrow the scope by specifying threat actors, tactics, and assets of concern. This makes PIRs more specific and actionable, enabling the CTI team to prioritize collection and analysis effectively. Broad PIRs waste resources and produce intelligence that may not support decision-making. By focusing on the most relevant threats and assets, the manager ensures the PIRs are aligned with organizational risk.

Answer

Replace PIRs with a list of all known vulnerabilities in the environment.

Answer

Increase the number of PIRs to cover more potential threats.

Answer

Delegate the PIR definition to the IT operations team.

Question 19

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

Accepted Answer

pattern. For a STIX 2.1 Indicator SDO to be well-formed, the required common properties are type (C) and id (D), plus the Indicator-specific required property pattern (A). The type field must be present and set to the exact string 'indicator' so parsers can identify the SDO, while id must be a valid STIX identifier of the form indicator--<UUIDv4> that uniquely identifies the object. The pattern field is mandatory because it carries the actual detection logic (e.g., a STIX Patterning expression such as [file:hashes.'SHA-256' = '...']), and without it the Indicator has no content to match. By contrast, description (B) is optional human-readable context, and valid_until (E) is an optional timestamp bounding the indicator's validity, so neither is required for well-formedness.

Answer

description

Answer

valid_until

Question 20

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

Accepted Answer

It allows for hierarchical and logical grouping of indicators. OpenIOC is an XML-based format that supports hierarchical indicator structures with logical operators (AND, OR) and nested IndicatorItem elements, allowing complex conditions like 'process name X AND parent process Y AND registry key Z'. This logical grouping is the primary advantage over flat CSV lists, which can only express one indicator per row with no boolean relationships.

Answer

It is faster to parse for simple IP addresses

Answer

It is the only format supported by most SIEMs

Answer

It automatically updates the firewall rules