312-85 Practice Test 5 — 10 Questions

Question 1

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Accepted Answer

Confidence Score. A Confidence Score directly quantifies the reliability and certainty of the intelligence, which is essential for the SOC team to assess whether the intelligence is actionable. It indicates how much trust can be placed in the data, enabling prioritization and response. Without a confidence score, the team cannot effectively determine the risk or the appropriate action, making it the most critical metric for proving actionability.

Answer

The total number of threat actors identified

Answer

The date the report was created

Answer

The TLP level

Question 2

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Accepted Answer

The interval between the occurrence of a threat and the availability of intelligence. Timeliness in threat intelligence measures the latency between when a threat event occurs and when intelligence about it becomes available to defenders. It is a core quality dimension alongside relevance, accuracy, and completeness, and it directly affects how actionable intelligence is — stale intel may describe threats that have already been mitigated or evolved.

Answer

The length of the intelligence report

Answer

The number of IOCs provided per month

Answer

The accuracy of the threat actor attribution

Question 3

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Accepted Answer

Triage, validate, and prioritize the RFI against established intelligence priorities. In the direction phase of the intelligence lifecycle, RFIs submitted by operational teams must go through a structured management process. The correct next step is to triage the RFI (assess its urgency and scope), validate it (confirm it aligns with collection capabilities and is a legitimate intelligence requirement), and prioritize it against established Priority Intelligence Requirements (PIRs). This ensures collection and analysis resources are directed toward the most mission-critical questions rather than ad-hoc operational noise.

Answer

Immediately publish the raw telemetry to the corporate intranet without validation

Answer

Archive the RFI immediately as operational queries fall outside the scope of CTI

Answer

Initiate an immediate red-team attack campaign against the external supplier

Question 4

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Accepted Answer

Systematically testing evidence against every hypothesis.. Option A is correct because ACH requires evaluating each piece of evidence against all competing hypotheses in a matrix, which exposes inconsistencies and prevents premature anchoring on a favored theory. Option D is correct because ACH emphasizes disconfirmation—actively seeking evidence that refutes a hypothesis—since a single credible disconfirming item can eliminate a hypothesis more decisively than confirming evidence can support it. Options B, C, and E are incorrect: weighting by personal intuition reintroduces the very bias ACH is designed to counter, focusing only on supporting evidence is confirmation bias, and limiting analysis to a single hypothesis defeats the comparative purpose of ACH.

Answer

Assigning weights based on personal intuition.

Answer

Focusing only on the evidence that supports your primary theory.

Answer

Limiting the number of hypotheses to one.

Question 5

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Accepted Answer

The vendor's track record for providing accurate, validated intelligence. Option A is correct because a vendor's historical accuracy and validation of intelligence directly determine whether its feeds can be trusted for detection and response decisions. Option B is correct because consistent reporting over time demonstrates reliability, reduces gaps in coverage, and shows the vendor is not sporadic or reactive. Option E is correct because transparency about methodology allows analysts to assess data provenance, collection sources, and analytical rigor, which is essential for trusting the intelligence. Option C is not correct because raw indicator volume without context is a poor reliability metric and can increase false positives. Option D is not correct because social media follower counts reflect popularity, not the technical quality or accuracy of threat intelligence.

Answer

The volume of indicators provided without context

Answer

The number of social media followers the vendor has

Question 6

A junior analyst asks how to choose between competing hypotheses about an intrusion. Which approach best reflects structured analytic technique?

Accepted Answer

List each hypothesis, identify evidence that would be inconsistent with it, and weigh how well the evidence distinguishes among them.. Analysis of competing hypotheses evaluates each candidate explanation against evidence and highlights disconfirming indicators, which guards against premature commitment and confirmation bias. The emphasis on diagnostic evidence ensures that conclusions rest on observations that actually distinguish among the alternatives rather than on volume or authority.

Answer

Choose the hypothesis that best matches the first indicator discovered during triage.

Answer

Adopt the hypothesis supported by the greatest number of indicators without examining their diagnostic value.

Answer

Select the hypothesis that the most senior analyst on the team favours and document that reasoning.

Question 7

A threat intelligence analyst is asked to support the incident response team during an active investigation of a suspected compromise. The IR team needs to know whether the observed IP address 203.0.113.45 is associated with any known threat actor. Which action should the analyst take first?

Accepted Answer

Query the IP address in the organization's internal threat intelligence platform and check for any associated campaigns or malware families.. The most efficient and appropriate first step is to query the organization's internal threat intelligence platform, which consolidates multiple sources and historical data. This provides immediate context on whether the IP is linked to known campaigns or malware families, directly supporting the IR team's need for rapid assessment during an active investigation. Other actions like WHOIS, port scanning, or sandbox submission are either irrelevant or inappropriate.

Answer

Run a port scan against the IP address to determine which services are exposed.

Answer

Perform a WHOIS lookup to identify the IP address's registration details and ownership.

Answer

Submit the IP address to a public sandbox for dynamic analysis.

Question 8

A CTI manager is reviewing the team's Priority Intelligence Requirements (PIRs) and notices that they are too broad, making it difficult to focus collection efforts. Which action should the manager take to improve the PIRs?

Accepted Answer

Narrow the scope by specifying the threat actors, tactics, and assets of concern.. The correct action is to narrow the scope by specifying threat actors, tactics, and assets of concern. This makes PIRs more specific and actionable, enabling the CTI team to prioritize collection and analysis effectively. Broad PIRs waste resources and produce intelligence that may not support decision-making. By focusing on the most relevant threats and assets, the manager ensures the PIRs are aligned with organizational risk.

Answer

Replace PIRs with a list of all known vulnerabilities in the environment.

Answer

Increase the number of PIRs to cover more potential threats.

Answer

Delegate the PIR definition to the IT operations team.

Question 9

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

Accepted Answer

pattern. For a STIX 2.1 Indicator SDO to be well-formed, the required common properties are type (C) and id (D), plus the Indicator-specific required property pattern (A). The type field must be present and set to the exact string 'indicator' so parsers can identify the SDO, while id must be a valid STIX identifier of the form indicator--<UUIDv4> that uniquely identifies the object. The pattern field is mandatory because it carries the actual detection logic (e.g., a STIX Patterning expression such as [file:hashes.'SHA-256' = '...']), and without it the Indicator has no content to match. By contrast, description (B) is optional human-readable context, and valid_until (E) is an optional timestamp bounding the indicator's validity, so neither is required for well-formedness.

Answer

description

Answer

valid_until

Question 10

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

Accepted Answer

It allows for hierarchical and logical grouping of indicators. OpenIOC is an XML-based format that supports hierarchical indicator structures with logical operators (AND, OR) and nested IndicatorItem elements, allowing complex conditions like 'process name X AND parent process Y AND registry key Z'. This logical grouping is the primary advantage over flat CSV lists, which can only express one indicator per row with no boolean relationships.

Answer

It is faster to parse for simple IP addresses

Answer

It is the only format supported by most SIEMs

Answer

It automatically updates the firewall rules