312-85 Practice Test 5 — 10 Questions

Question 1

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access Control Lists (ACLs). TAXII collections require defined access controls and content selection (filters) to ensure only authorized entities receive specific intelligence.

Answer

Database indexing strategy

Answer

Default STIX versioning

Answer

Server uptime SLA

Question 2

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Accepted Answer

Aggregating and deduplicating indicators from multiple sources. Processing is where data is made usable through normalization, aggregation, and filtering.

Answer

Presenting findings to the board of directors

Answer

Identifying new intelligence requirements

Question 3

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Accepted Answer

Shift intelligence requirements to focus on initial access vectors, third-party supplier dependencies, and forums frequented by Initial Access Brokers (IABs). Refining collection requirements and pivoting focus toward upstream threat indicators (such as supplier dependencies, third-party vendor risks, and initial access brokers) addresses late detection of supply chain intrusions.

Answer

Disable all external threat intelligence feeds to reduce noise in the security operations center

Answer

Reassign all malware reverse engineering tasks to helpdesk support personnel

Answer

Increase the budget for automated SIEM log retention from 30 days to 90 days

Question 4

You are integrating a new threat intelligence platform (TIP). You need to define a 'Custom Object' in STIX 2.1 to track a specific internal project codename associated with threat actors. Which prefix must be used for the custom object name to ensure compatibility and avoid collisions?

Accepted Answer

'x-'. In STIX 2.1, custom objects must be prefixed with 'x-' to identify them as non-standard extensions to the schema.

Answer

'ext-'

Answer

'c-'

Answer

'internal-'

Question 5

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Accepted Answer

Execution. Execution is the tactic used to run malicious code on a target system; PowerShell is a common technique within that tactic.

Answer

Persistence

Answer

Exfiltration

Answer

Privilege Escalation

Question 6

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Accepted Answer

Capability. In the Diamond Model, the four core vertices are Adversary, Capability, Infrastructure, and Victim. Capability represents the tools and techniques (TTPs) used by the adversary.

Answer

Infrastructure

Answer

Adversary

Answer

Victim

Question 7

Which THREE of the following are valid reasons to use the STIX 'Sighting' object?

Accepted Answer

To indicate the source of the observation. The Sighting object is used to indicate that an indicator was seen, provide context on the target, and show where it was detected.

Answer

To define the threat actor profile

Answer

To provide the remediation steps

Question 8

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

Accepted Answer

Check if the API Key has the 'Read' permission for the specific Collection ID requested. The 403 error specifically indicates that the client is authenticated but lacks the necessary permissions to access the requested Collection ID.

Answer

Verify the Discovery Service URL in the client configuration

Answer

Change the polling interval from 60 seconds to 300 seconds

Answer

Validate the TLS handshake certificate chain

Question 9

When disseminating intelligence to C-level executives versus technical SOC analysts, you must adjust your reporting format. Which technique ensures compliance with intelligence cycle requirements for 'Actionable Intelligence'?

Accepted Answer

Use 'Executive Summaries' that highlight business impact and risk, while keeping technical IOCs in an attached appendix.. Actionable intelligence must be tailored to the audience; executives require strategic summaries (impact and risk), while analysts require technical indicators (IOCs).

Answer

Convert all technical reports to PDF only, removing machine-readable STIX.

Answer

Include raw PCAP files in all executive reports.

Answer

Remove TLP markings from executive reports to increase accessibility.

Question 10

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

Accepted Answer

Develop requirements to identify ransomware campaigns, threat actor TTPs, and third-party vendors targeting our critical supply chain ecosystem. Translating executive concerns into formal requirements involves formulating specific, answerable questions regarding supply chain vulnerabilities and active ransomware campaigns targeting third-party vendors.

Answer

Collect all CVEs published daily by the National Vulnerability Database (NVD)

Answer

Deploy endpoint detection and response (EDR) agents to all contractor laptops

Answer

Execute regular phishing simulations for all internal business unit employees