312-85 Practice Test 2 — 30 Questions

Question 1

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attack Surface Reduction. Attack Surface reduction through Least Privilege is a foundational technique in threat modeling aimed at minimizing the damage potential of a compromise.

Answer

Threat Vector Analysis

Answer

Risk Likelihood Assessment

Answer

Threat Actor Attribution

Question 2

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

Accepted Answer

Check if the source IP is whitelisted on the threat intelligence provider side.. 403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.

Answer

Update the SSL certificates on the collector.

Answer

Increase the connector memory allocation.

Answer

Restart the OpenCTI RabbitMQ service.

Question 3

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Accepted Answer

Time-series analysis of IP resolution logs.. Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.

Answer

Vulnerability scanning.

Answer

Qualitative SWOT analysis.

Answer

Static analysis of the malware binary.

Question 4

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 5

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Accepted Answer

Decode the content and extract nested indicators.. Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.

Answer

Replace the payload with a static hash.

Answer

Discard the indicator as encrypted.

Answer

Store the raw base64 string as a comment.

Question 6

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Accepted Answer

The ephemeral nature of cloud assets. Cloud environments are dynamic, leading to challenges with visibility and scope.

Answer

Cloud environments are immune to malware

Answer

The total lack of logs in cloud environments

Answer

The inability to use API-based intelligence collection

Question 7

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

Accepted Answer

The client requested an unsupported content-type in the Accept header.. A 406 error typically indicates that the media type requested in the Accept header is not supported by the TAXII server, often due to a mismatch between STIX versioning expectations.

Answer

The connection is blocked by a firewall ACL.

Answer

The API key provided for authentication is expired.

Answer

The TAXII discovery service endpoint is misconfigured.

Question 8

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Accepted Answer

To link two objects together.. The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.

Answer

To define the schema version.

Answer

To encrypt the data transport.

Answer

To set the confidence score.

Question 9

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Accepted Answer

Relationship. In STIX 2.1, the 'Relationship' object is specifically used to connect two SDOs (Domain Objects) with a defined relationship type such as 'uses'.

Answer

Indicator

Answer

Sighting

Answer

Observed-Data

Question 10

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

Accepted Answer

'relationship_type'. The 'relationship_type' property defines the semantic nature of the link; if it does not match the STIX 2.1 controlled vocabulary for that SDO pair, the parser will reject the bundle.

Answer

'source_ref'

Answer

'target_ref'

Answer

'spec_version'

Question 11

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Accepted Answer

Access Control Lists (ACLs). TAXII collections require defined access controls and content selection (filters) to ensure only authorized entities receive specific intelligence.

Answer

Database indexing strategy

Answer

Default STIX versioning

Answer

Server uptime SLA

Question 12

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Accepted Answer

Aggregating and deduplicating indicators from multiple sources. Processing is where data is made usable through normalization, aggregation, and filtering.

Answer

Presenting findings to the board of directors

Answer

Identifying new intelligence requirements

Question 13

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Accepted Answer

Shift intelligence requirements to focus on initial access vectors, third-party supplier dependencies, and forums frequented by Initial Access Brokers (IABs). Refining collection requirements and pivoting focus toward upstream threat indicators (such as supplier dependencies, third-party vendor risks, and initial access brokers) addresses late detection of supply chain intrusions.

Answer

Disable all external threat intelligence feeds to reduce noise in the security operations center

Answer

Reassign all malware reverse engineering tasks to helpdesk support personnel

Answer

Increase the budget for automated SIEM log retention from 30 days to 90 days

Question 14

You are integrating a new threat intelligence platform (TIP). You need to define a 'Custom Object' in STIX 2.1 to track a specific internal project codename associated with threat actors. Which prefix must be used for the custom object name to ensure compatibility and avoid collisions?

Accepted Answer

'x-'. In STIX 2.1, custom objects must be prefixed with 'x-' to identify them as non-standard extensions to the schema.

Answer

'ext-'

Answer

'c-'

Answer

'internal-'

Question 15

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Accepted Answer

Execution. Execution is the tactic used to run malicious code on a target system; PowerShell is a common technique within that tactic.

Answer

Persistence

Answer

Exfiltration

Answer

Privilege Escalation

Question 16

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Accepted Answer

Capability. In the Diamond Model, the four core vertices are Adversary, Capability, Infrastructure, and Victim. Capability represents the tools and techniques (TTPs) used by the adversary.

Answer

Infrastructure

Answer

Adversary

Answer

Victim

Question 17

Which THREE of the following are valid reasons to use the STIX 'Sighting' object?

Accepted Answer

To indicate the source of the observation. The Sighting object is used to indicate that an indicator was seen, provide context on the target, and show where it was detected.

Answer

To define the threat actor profile

Answer

To provide the remediation steps

Question 18

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

Accepted Answer

Check if the API Key has the 'Read' permission for the specific Collection ID requested. The 403 error specifically indicates that the client is authenticated but lacks the necessary permissions to access the requested Collection ID.

Answer

Verify the Discovery Service URL in the client configuration

Answer

Change the polling interval from 60 seconds to 300 seconds

Answer

Validate the TLS handshake certificate chain

Question 19

When disseminating intelligence to C-level executives versus technical SOC analysts, you must adjust your reporting format. Which technique ensures compliance with intelligence cycle requirements for 'Actionable Intelligence'?

Accepted Answer

Use 'Executive Summaries' that highlight business impact and risk, while keeping technical IOCs in an attached appendix.. Actionable intelligence must be tailored to the audience; executives require strategic summaries (impact and risk), while analysts require technical indicators (IOCs).

Answer

Convert all technical reports to PDF only, removing machine-readable STIX.

Answer

Include raw PCAP files in all executive reports.

Answer

Remove TLP markings from executive reports to increase accessibility.

Question 20

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

Accepted Answer

Develop requirements to identify ransomware campaigns, threat actor TTPs, and third-party vendors targeting our critical supply chain ecosystem. Translating executive concerns into formal requirements involves formulating specific, answerable questions regarding supply chain vulnerabilities and active ransomware campaigns targeting third-party vendors.

Answer

Collect all CVEs published daily by the National Vulnerability Database (NVD)

Answer

Deploy endpoint detection and response (EDR) agents to all contractor laptops

Answer

Execute regular phishing simulations for all internal business unit employees