312-85 Practice Test 4 — 10 Questions

Question 1

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attack Surface Reduction. Attack Surface reduction through Least Privilege is a foundational technique in threat modeling aimed at minimizing the damage potential of a compromise.

Answer

Threat Vector Analysis

Answer

Risk Likelihood Assessment

Answer

Threat Actor Attribution

Question 2

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

Accepted Answer

Check if the source IP is whitelisted on the threat intelligence provider side.. 403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.

Answer

Update the SSL certificates on the collector.

Answer

Increase the connector memory allocation.

Answer

Restart the OpenCTI RabbitMQ service.

Question 3

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Accepted Answer

Time-series analysis of IP resolution logs.. Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.

Answer

Vulnerability scanning.

Answer

Qualitative SWOT analysis.

Answer

Static analysis of the malware binary.

Question 4

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 5

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Accepted Answer

Decode the content and extract nested indicators.. Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.

Answer

Replace the payload with a static hash.

Answer

Discard the indicator as encrypted.

Answer

Store the raw base64 string as a comment.

Question 6

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Accepted Answer

The ephemeral nature of cloud assets. Cloud environments are dynamic, leading to challenges with visibility and scope.

Answer

Cloud environments are immune to malware

Answer

The total lack of logs in cloud environments

Answer

The inability to use API-based intelligence collection

Question 7

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

Accepted Answer

The client requested an unsupported content-type in the Accept header.. A 406 error typically indicates that the media type requested in the Accept header is not supported by the TAXII server, often due to a mismatch between STIX versioning expectations.

Answer

The connection is blocked by a firewall ACL.

Answer

The API key provided for authentication is expired.

Answer

The TAXII discovery service endpoint is misconfigured.

Question 8

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Accepted Answer

To link two objects together.. The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.

Answer

To define the schema version.

Answer

To encrypt the data transport.

Answer

To set the confidence score.

Question 9

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Accepted Answer

Relationship. In STIX 2.1, the 'Relationship' object is specifically used to connect two SDOs (Domain Objects) with a defined relationship type such as 'uses'.

Answer

Indicator

Answer

Sighting

Answer

Observed-Data

Question 10

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

Accepted Answer

'relationship_type'. The 'relationship_type' property defines the semantic nature of the link; if it does not match the STIX 2.1 controlled vocabulary for that SDO pair, the parser will reject the bundle.

Answer

'source_ref'

Answer

'target_ref'

Answer

'spec_version'