312-85 Practice Test 3 — 30 Questions

Question 1

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Accepted Answer

Data Exfiltration. This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.

Answer

Reconnaissance of the target

Answer

Establishing a backdoor

Answer

Sending phishing emails

Question 2

You are reviewing a threat intelligence report that includes a list of indicators. You notice that one indicator is an IP address with a low confidence score. According to best practices, what should you do before using this indicator for detection?

Accepted Answer

Correlate the indicator with other sources to increase confidence.. Before using a low-confidence indicator, analysts should correlate it with other sources to validate its maliciousness and increase confidence. This step reduces false positives and ensures that any subsequent actions, such as blocking, are justified. It is a core practice in threat intelligence to avoid acting on unverified data.

Answer

Discard the indicator because it is not reliable.

Answer

Immediately block the IP address at the firewall.

Answer

Add the indicator to a watchlist for manual review only.

Question 3

A security operations center analyst is mapping an intrusion to the MITRE ATT&CK framework. The analyst observes that after gaining initial access, the adversary used Windows Management Instrumentation (WMI) to remotely create processes on other hosts in the domain. Under which ATT&CK tactic does this activity fall?

Accepted Answer

Lateral Movement. Using WMI to create processes on remote hosts allows an adversary to pivot from one compromised system to others within the domain, which is the definition of Lateral Movement in MITRE ATT&CK. The technique is catalogued as Windows Management Instrumentation (T1047) and is frequently observed because it abuses a legitimate administrative feature, making it harder to distinguish from normal management activity.

Answer

Privilege Escalation

Answer

Execution

Answer

Persistence

Question 4

A threat intelligence team is correlating indicators from multiple feeds. They observe that a set of domain names resolves to fast-flux IP addresses, the domains were registered within the last 48 hours, and the same SSL certificate serial number appears across several unrelated domains. Which analytic conclusion is best supported by this evidence?

Accepted Answer

The infrastructure is likely adversary-controlled and may be used for malware command-and-control or phishing.. The convergence of fast-flux DNS, newly registered domains, and shared certificate serials across unrelated domains is a recognized pattern of adversary-controlled infrastructure. Each indicator alone can have benign explanations, but together they strongly suggest malicious intent. The analyst should treat these domains as suspicious, enrich them with passive DNS and WHOIS data, and consider blocking or monitoring while continuing to validate the assessment.

Answer

The domains are part of a legitimate content delivery network with high availability requirements.

Answer

The domains are compromised legitimate sites being used as watering holes.

Answer

The shared certificate serial number proves the domains are owned by a single legitimate organization.

Question 5

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

Accepted Answer

Reconnaissance. Reconnaissance is the correct phase because the adversary is conducting open-source research on employees and technical infrastructure before any exploitation attempt. This phase encompasses all information gathering activities that precede weaponization and delivery. The scenario contains no evidence of payload creation, transmission, or vulnerability exploitation, so the other phases are not applicable.

Answer

Exploitation

Answer

Weaponization

Answer

Delivery

Question 6

A threat intelligence analyst is preparing to analyze a large set of intrusion artifacts collected from multiple sensors. She wants to apply structured analysis techniques to reduce bias and improve the defensibility of her conclusions. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

Analysis of Competing Hypotheses to evaluate alternative explanations against evidence.. Structured analytic techniques such as Analysis of Competing Hypotheses and Key Assumptions Check are designed to reduce cognitive bias and make reasoning transparent. ACH forces consideration of alternative explanations and highlights diagnostic evidence, while a Key Assumptions Check exposes the beliefs that underpin interpretation. Together they provide a defensible, repeatable foundation for analyzing large artifact sets and communicating conclusions to decision-makers.

Answer

Devil's Advocacy to argue the opposite of the prevailing view regardless of evidence.

Answer

Timeline analysis to sequence events chronologically without assessing causality.

Answer

Brainstorming to generate as many ideas as possible without evaluating them.

Question 7

A threat hunter is investigating a suspected data exfiltration channel that uses DNS tunneling. The organization's DNS logs capture query names, query types, response codes, and source hosts, but not full packet payloads. Which TWO characteristics of the DNS queries would most reliably indicate tunneling activity rather than normal DNS behavior? (Choose two.)

Accepted Answer

Unusually long and high-entropy subdomain labels encoded in the query name.. Without payload visibility, tunneling must be inferred from query shape and type: long, high-entropy subdomain labels carry encoded data, and sustained TXT queries from one host exploit a record type and volume that normal endpoints rarely produce. Popular A-record lookups, organization-wide NXDOMAIN noise, and internal PTR queries all match benign baselines and cannot isolate a tunneling channel.

Answer

Frequent NXDOMAIN responses for typo-like domain names across the entire organization.

Answer

Queries that use the A record type for well-known public domains from many different hosts.

Answer

Periodic PTR record queries for internal RFC1918 addresses from a single host.

Question 8

A threat intelligence analyst is examining a malware sample and observes that the binary contains a hardcoded list of domain names that are contacted in a fixed order, with a fallback to a DGA-generated domain if the first three fail. The analyst wants to characterize the command-and-control resilience of this malware. Which statement best describes the resilience of this C2 approach?

Accepted Answer

The C2 is moderately resilient; the hardcoded domains are a weakness, but the DGA fallback provides some redundancy.. The malware's C2 uses a fixed hardcoded list with a DGA fallback. The hardcoded domains are a single point of failure because they can be blocked, seized, or sinkholed. The DGA fallback provides redundancy by generating many potential domains, but DGAs can be predicted and mitigated. Therefore, the design is moderately resilient, offering more redundancy than a single static domain but less than a fully decentralized or domain-fronting approach.

Answer

The C2 is not resilient at all because hardcoded domains are always taken down quickly.

Answer

The C2 is highly resilient because it uses a DGA, which cannot be taken down.

Answer

The C2 resilience cannot be assessed without knowing the encryption algorithm used for communications.

Question 9

A threat intelligence analyst is processing a large set of indicators and needs to enrich them with additional context. The analyst wants to use the MITRE ATT&CK framework to map indicators to adversary tactics, techniques, and procedures (TTPs). Which data processing step should be performed first to ensure accurate mapping?

Accepted Answer

Normalize the indicators to a standard format. Normalizing indicators to a standard format is essential before mapping to MITRE ATT&CK because it ensures that indicators are consistently represented, enabling accurate matching to techniques. Without normalization, variations in data can cause mismatches and reduce the effectiveness of enrichment. Other steps like WHOIS enrichment, SIEM correlation, or clustering are valuable but should follow normalization to maintain data integrity.

Answer

Apply machine learning clustering to group similar indicators

Answer

Correlate indicators with existing events in the SIEM

Answer

Enrich indicators with WHOIS data

Question 10

A threat intelligence analyst is collecting data from a TAXII 2.1 server. The analyst needs to retrieve only the indicators that have been added or modified since the last collection. Which TAXII 2.1 feature should be used to achieve this?

Accepted Answer

Use the 'added_after' query parameter. The 'added_after' query parameter in TAXII 2.1 is specifically designed for incremental collection, allowing clients to request objects added after a given timestamp. This efficiently retrieves only new or modified indicators, reducing bandwidth and processing. Other parameters like 'match[version]' or 'limit' serve different purposes and do not support time-based filtering for incremental updates.

Answer

Use the 'limit' query parameter to paginate results

Answer

Use the 'filter' query parameter with a date range

Answer

Use the 'match[version]' query parameter

Question 11

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

Accepted Answer

To provide actionable remediation steps to defend against a threat. Course of Action (CoA) objects in STIX are intended to provide actionable remediation steps to defend against a threat. They describe specific measures that can be taken to prevent, mitigate, or respond to an attack, such as applying a patch, blocking a port, or reconfiguring a system. In an automated environment, these can be used to trigger defensive actions or guide incident response.

Answer

To verify the identity of the threat actor

Answer

To map the threat actor's TTPs

Answer

To store forensic artifacts

Question 12

A threat intelligence team ingests a daily feed delivered as a single JSON file. Each record includes an indicator value, a confidence score, and a free-text description. During processing, the team must enrich each indicator with internal asset context and geographic location before loading it into a MISP event. Which action should be performed first to ensure the enrichment stage has clean, normalized records?

Accepted Answer

Parse the JSON, validate required fields, normalize indicator types, and remove duplicate records before enrichment.. Clean data is a precondition for useful enrichment. Parsing and validating the JSON ensures structural integrity, while normalizing indicator types and removing duplicates prevents inconsistent or redundant enrichment results. Enrichment services and MISP should receive only records that are already well-formed and deduplicated, so that asset and geographic context attaches to a single canonical indicator.

Answer

Send each raw JSON record to the enrichment services and then deduplicate the enriched output.

Answer

Load all records into MISP as attributes and use MISP correlation to resolve duplicates and types.

Answer

Convert the JSON to CSV and rely on the CSV import mapping to normalize indicator types automatically.

Question 13

You are a CTI analyst responsible for disseminating a finished intelligence report to multiple stakeholders within your organization, including the SOC, the vulnerability management team, and the CISO. The report contains both tactical indicators and strategic recommendations. What is the most effective way to structure the dissemination to ensure each stakeholder receives the relevant information?

Accepted Answer

Create separate tailored reports for each stakeholder group, emphasizing the aspects most relevant to their roles.. Tailored reports for each stakeholder group ensure that the SOC gets tactical indicators, the vulnerability management team receives relevant vulnerability data, and the CISO gets strategic recommendations. This maximizes the utility of the intelligence and supports timely, role-specific actions. Other approaches risk information overload or omission of critical details for certain audiences.

Answer

Disseminate only the tactical indicators to all stakeholders, as they are the most actionable.

Answer

Send the full report to all stakeholders, allowing them to extract the information pertinent to their roles.

Answer

Hold a single briefing meeting where you present the entire report to all stakeholders simultaneously.

Question 14

A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a TIP. The analyst notices that many indicators are duplicated across feeds but have slightly different metadata, such as confidence scores and timestamps. To ensure efficient processing and accurate analysis, which of the following should the analyst implement to handle these duplicates?

Accepted Answer

Deduplicate indicators by comparing only the indicator value and type, ignoring metadata differences. The most effective deduplication strategy is to identify indicators by their value and type, as these define the indicator itself. Metadata such as confidence and timestamps should be aggregated or reconciled during deduplication. This reduces noise, improves performance, and allows analysts to work with a clean, consolidated dataset. Maintaining provenance is still possible by recording all sources in the indicator's metadata, but it should not prevent merging identical indicators.

Answer

Keep all duplicates and rely on the TIP's built-in search to filter as needed

Answer

Merge indicators only if all metadata fields are identical, otherwise treat them as distinct

Answer

Use the feed source as part of the deduplication key to maintain provenance

Question 15

A threat intelligence analyst is reviewing the Cyber Kill Chain phases for a recent intrusion. The analyst observes that the adversary successfully exploited a vulnerability in a public-facing web server to gain a foothold. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Exploitation. Exploiting a vulnerability in a public-facing web server to gain a foothold is the Exploitation phase of the Cyber Kill Chain. This phase involves the adversary leveraging a vulnerability to execute code and compromise the target. It is a critical step that follows Delivery and precedes Installation. Recognizing this helps analysts understand where to focus detection and mitigation efforts, such as patching vulnerabilities and monitoring for exploit attempts.

Answer

Installation

Answer

Delivery

Answer

Weaponization

Question 16

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

Accepted Answer

Source reliability and information credibility assessment. The lead is capturing how dependable each feed has proven and how credible its content is, so consumers can weight it correctly. Structured evaluation separates the trustworthiness of the source from the plausibility of the information itself, and observed lateness or uniqueness without corroboration are precisely the attributes that drive those ratings.

Answer

Intelligence dissemination and sharing controls

Answer

Threat hunting hypothesis development

Answer

Collection management and requirements prioritization

Question 17

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Accepted Answer

Technical intelligence containing indicators of compromise and TTPs. When scoping a potential breach, the IR team needs concrete, searchable artifacts. Technical intelligence provides indicators of compromise and TTPs that can be used to query SIEM, EDR, and network logs. This allows the team to identify affected systems quickly. Strategic, operational, and tactical intelligence provide context but lack the specificity required for immediate scoping.

Answer

Operational intelligence about upcoming campaigns in the sector

Answer

Tactical intelligence summarizing recent malware trends

Answer

Strategic intelligence reports on long-term threat actor intentions

Question 18

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

Accepted Answer

Analysis and production. The threat intelligence lifecycle comprises planning and direction, collection, processing and exploitation, analysis and production, dissemination, and feedback. Planning and direction sets requirements, processing standardizes raw data, and analysis and production turns that data into finished intelligence, so those three are the recognized phases among the choices.

Answer

Vulnerability remediation

Answer

Penetration testing

Question 19

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

Accepted Answer

Cybercriminal, because the group's consistent objective is financial gain through monetization of stolen data.. Motivation classification depends on the actor's persistent objective. This group repeatedly takes payment records and converts them to cash through underground carding markets, with no political, ideological, or espionage aim. That pattern defines a financially motivated cybercriminal actor. Tools and targets alone do not determine motivation, so the immediate monetization behavior is the decisive evidence.

Answer

Hacktivist, because the group publicizes its thefts to embarrass the victim.

Answer

Insider threat, because only someone with internal access could exfiltrate customer payment records.

Answer

Nation-state espionage actor, because payment data can be used to fund state operations.

Question 20

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

Accepted Answer

Publicly accessible social media posts and forum discussions about threat actors. OSINT is defined by public availability without restriction, which covers public vulnerability databases, vendor advisories, social media, and open forums. Closed peer-sharing groups, licensed commercial feeds, and classified government briefings all have access controls or legal restrictions that place them outside the open-source category, even when their content is high quality and relevant to the same intelligence requirements.

Answer

A commercial feed purchased under a licensing agreement with restricted redistribution

Answer

A closed peer-sharing group where members exchange indicators under a non-disclosure agreement

Answer

Indicators obtained from a government agency through a classified briefing