312-85 Practice Questions 1 — 50 Questions

Question 1

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Execution. While PowerShell can be used for execution, the act of running the script to download the payload is categorized under Execution. The Tactic is the 'why' of the action, and Execution covers running malicious code.

Answer

Discovery

Answer

Persistence

Answer

Command and Control

Question 2

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Accepted Answer

To ensure data compatibility for correlation and cross-source analysis.. Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.

Answer

To reduce the storage space required for logs.

Answer

To increase the ingestion speed of the SIEM.

Answer

To encrypt the logs for regulatory compliance.

Question 3

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Accepted Answer

Infrastructure. In the Diamond Model, Infrastructure represents the physical and logical communication paths and services, such as IPs and domains, used by the adversary.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 4

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Accepted Answer

Weaponization. The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.

Answer

Exploitation

Answer

Delivery

Answer

Installation

Question 5

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

Accepted Answer

The vulnerability has a high severity rating based on its characteristics.. CVSS scores represent the severity of a vulnerability, with higher scores indicating higher severity.

Answer

The vulnerability is currently being exploited in the wild.

Answer

The vulnerability affects only Windows systems.

Answer

The vulnerability is already patched.

Question 6

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Accepted Answer

Application of NLP techniques to extract entities.. NLP (Natural Language Processing) is the standard technique for converting unstructured text into structured, normalized intelligence.

Answer

Hashing the entire document.

Answer

Direct ingestion into the SIEM.

Answer

Manual entry into a spreadsheet.

Question 7

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Accepted Answer

T1572: Protocol Tunneling. This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.

Answer

T1204: User Execution

Answer

T1133: External Remote Services

Answer

T1053: Scheduled Task

Question 8

When hunting for malicious DLL side-loading, which file property is most critical to verify?

Accepted Answer

Code signing certificate. Side-loading relies on a legitimate binary loading a malicious DLL with the same name as a required dependency from a different directory.

Answer

File extension

Answer

Creation timestamp

Answer

File size

Question 9

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Accepted Answer

Command and Control. Beaconing is a primary method for establishing and maintaining Command and Control.

Answer

Exfiltration

Answer

Privilege Escalation

Answer

Collection

Question 10

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Accepted Answer

valid_from. The Indicator object in STIX 2.1 contains specific properties including the pattern, validity period, and confidence score.

Answer

firewall_acl_rule

Answer

user_password_hash

Question 11

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 12

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Accepted Answer

Data Exfiltration. This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.

Answer

Reconnaissance of the target

Answer

Establishing a backdoor

Answer

Sending phishing emails

Question 13

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Accepted Answer

Monitor for anomalous process execution patterns. Because they use legitimate tools, you must focus on behavioral detection (Tactic-Technique-Procedure analysis) rather than signature-based file detection.

Answer

Scan for known malware signatures

Answer

Update firewall rules for all known ports

Answer

Focus on file hash blacklisting

Question 14

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Accepted Answer

Endpoint Detection and Response (EDR). The Installation phase involves the malware establishing a persistent foothold on the host, which is best detected by host-based security tools like EDR.

Answer

DNS sinkholing

Answer

Email gateway filtering

Answer

Social engineering training

Question 15

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

Accepted Answer

Assuming historical trends will continue indefinitely without accounting for environmental shifts.. Extrapolating short-term patterns into long-term certainties is a common error in trend analysis.

Answer

Ignoring the total volume of data available.

Answer

Collecting too much data from different sources.

Answer

Using visual graphs to display the results.

Question 16

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Accepted Answer

number_observed. Observed data objects record the 'first_observed', 'last_observed', and 'number_observed' properties to provide context to the sighting.

Answer

vulnerability_scanner_id

Answer

root_password

Question 17

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

Accepted Answer

JSON Schema Validator.. JSON Schema validation is the standard method for verifying the structure and types of JSON data.

Answer

Netstat.

Answer

Nmap.

Answer

Wireshark.

Question 18

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

Accepted Answer

Delivery. Social engineering and phishing attacks occur during the Delivery phase, which is best addressed by human-centric training.

Answer

Weaponization

Answer

Installation

Answer

Actions on Objectives

Question 19

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence, Defense Evasion, and Privilege Escalation are essential for staying on a system and remaining undetected.

Answer

Exfiltration

Answer

Reconnaissance

Question 20

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

Accepted Answer

TLP:RED. TLP:RED is used for information that cannot be shared outside of the specific recipients, which is appropriate for sensitive zero-day intelligence.

Answer

TLP:GREEN

Answer

TLP:AMBER

Answer

TLP:CLEAR