312-85 Practice Questions 1 — 50 Questions

Question 1

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence (D) is the ATT&CK tactic explicitly defined as techniques adversaries use to keep access to systems across restarts, changed credentials, or other interruptions, making it the core answer for maintaining a presence. Privilege Escalation (E) is commonly involved because adversaries need higher-level permissions (e.g., SYSTEM or root) to install durable persistence mechanisms such as services, scheduled tasks, or registry Run keys that survive reboots. Defense Evasion (C) is also involved because maintaining a foothold requires hiding artifacts and activity from security tools, for example by disabling logging, obfuscating scripts, or masquerading as legitimate processes. Exfiltration (A) is about stealing data out of the environment and does not itself maintain access, and Reconnaissance (B) is information gathering before compromise, so neither belongs to the persistence-focused tactics.

Answer

Exfiltration

Answer

Reconnaissance

Question 2

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

Accepted Answer

Map the adversary's behavior to specific techniques and sub-techniques, such as Spearphishing Attachment or Exploit Public-Facing Application.. The MITRE ATT&CK framework is most useful when adversary behavior is mapped to specific techniques and sub-techniques, which describe concrete actions like Exploit Public-Facing Application or Spearphishing Attachment. This level of detail enables defenders to identify relevant detection strategies and mitigations, whereas higher-level tactics or atomic indicators provide less actionable context.

Answer

Map the adversary to a known threat group profile, such as APT29, based on the use of a novel exploit.

Answer

Map the adversary's actions to the highest-level tactics, such as initial access and execution, without detailing techniques.

Answer

Map the specific malware hashes and exploit file names directly to ATT&CK technique IDs.

Question 3

You are a CTI analyst tasked with creating a threat intelligence report for your organization's security operations center (SOC). The SOC team needs to quickly detect and respond to a newly identified adversary campaign. Which two elements are most critical to include in this report? (Choose two.)

Accepted Answer

MITRE ATT&CK techniques and tactics used by the adversary.. IOCs and MITRE ATT&CK techniques are critical for SOC detection and response. IOCs provide specific artifacts to hunt for, while ATT&CK mappings describe adversary behaviors, enabling comprehensive defense. Other elements like geopolitical context or policy recommendations are valuable for different audiences but do not directly support the SOC's operational needs.

Answer

Recommendations for strategic policy changes to the board.

Answer

A detailed narrative of the adversary's geopolitical motivations.

Answer

A comprehensive list of all threat actors known to use similar TTPs.

Question 4

A hunter is reviewing Zeek conn.log and notices long-lived, low-volume TLS sessions from several internal workstations to the same external IP on port 443 where the server certificate is self-signed, the JA3S value is identical across all sessions, and the byte counts are almost symmetric over hours. The workstations show no matching DNS queries for that IP and no proxy logs because the traffic bypasses the proxy. Which hypothesis best fits this evidence?

Accepted Answer

The pattern is consistent with beaconing to hard-coded C2 infrastructure using a custom TLS profile, and the hunter should pivot on the JA3S value and destination IP.. Direct-to-IP TLS with a self-signed certificate, a uniform JA3S fingerprint, and steady low-volume symmetric sessions indicates a beacon using a custom TLS profile. Pivoting on the server fingerprint and destination IP lets the hunter find other affected hosts and confirm the campaign before remediation.

Answer

The traffic represents normal HTTPS browsing because port 443 is used and the sessions are encrypted end to end.

Answer

A sanctioned software update service is being reached over a direct TLS channel that bypasses the proxy by design.

Answer

The sessions indicate a misconfigured internal service because self-signed certificates are only used inside an organization's own address space.

Question 5

A hunter is investigating anomalous DNS activity on an internal resolver. Several endpoints are issuing high volumes of queries for long, random-looking subdomains under a single registered domain, with responses that are mostly NXDOMAIN but occasionally resolve. Which TWO detection approaches would most effectively confirm whether this is DNS tunneling or domain generation algorithm activity? (Choose two.)

Accepted Answer

Correlate the timing and volume of queries with the process that initiated them using endpoint DNS client event telemetry.. Confirming DNS tunneling or DGA activity requires both statistical characterization of the query names and attribution to the originating process. Measuring query length and entropy against a per-endpoint baseline exposes algorithmically generated or encoded names, while endpoint DNS client telemetry ties those queries to the specific binary responsible. Together these methods produce defensible evidence rather than relying on blocklists.

Answer

Review the resolver's cache hit ratio and increase the TTL on all cached records to reduce query volume.

Answer

Search the SIEM for the registered domain across historical proxy logs and add it to a watchlist if it appears in any HTTP request.

Answer

Block all outbound DNS at the perimeter and force every endpoint to use DNS over HTTPS to a public resolver.

Question 6

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

Accepted Answer

root\subscription. The root\subscription namespace is the correct focus because it is the dedicated WMI repository location where permanent event subscriptions are stored. Attackers use this namespace to create __EventFilter, __EventConsumer, and __FilterToConsumerBinding instances that persist across reboots, enabling fileless persistence and code execution. Unlike transient subscriptions that exist only in memory, these permanent subscriptions reside in root\subscription and are automatically reinstated by the WMI service at startup, making them a prime hunting ground for suspicious event consumers.

Answer

root\default

Answer

root\security

Answer

root\cimv2

Question 7

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Accepted Answer

Information on exploit frameworks, payload construction tools, and customized delivery mechanisms used by target threat groups. Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.

Answer

Phishing email headers received by internal mail servers from external domains

Answer

File hashes and indicators associated with credential dumping tools like Mimikatz

Answer

Network traffic logs showing data exfiltration over encrypted channels

Question 8

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

Accepted Answer

The object ID (UUID).. In STIX, every object has a globally unique id in the form -- (e.g., malware--a1b2c3d4-...). When comparing two 'malware' objects, the object ID (UUID) is the canonical unique identifier — if the IDs match, they are the same object; if they differ, they are distinct objects (even if names or hashes overlap). This is the most reliable deduplication key.

Answer

The file size.

Answer

The source name.

Answer

The timestamp of ingestion.

Question 9

A security operations center (SOC) receives an alert about a workstation exhibiting unusual outbound traffic to a known malicious IP address. The analyst suspects the workstation is compromised and communicating with a command-and-control (C2) server. According to the Cyber Kill Chain, which phase does this activity represent?

Accepted Answer

Command and Control. In the Cyber Kill Chain, Command and Control is the phase where the adversary establishes a communication channel with compromised systems. The outbound traffic to a known malicious IP is a beacon, indicating the workstation is checking in with a C2 server. This activity is distinct from earlier phases like Weaponization or Exploitation, and precedes Actions on Objectives.

Answer

Actions on Objectives

Answer

Weaponization

Answer

Exploitation

Question 10

An analyst is reviewing a threat intelligence report that includes a list of IP addresses, domain names, and file hashes associated with a recent campaign. The report states that these indicators were observed on multiple victim networks over the past month. What is the most appropriate first step before using these indicators in detection rules?

Accepted Answer

Validate the indicators against internal telemetry and external reputation sources, and assess their relevance.. Before operationalizing indicators, an analyst should validate them against internal telemetry and external reputation sources. This confirms whether the indicators are present in the environment, whether they remain active, and whether they are relevant to the organization's threat profile. Validation also helps distinguish true positives from false positives and provides context for tuning detection rules, reducing disruption and improving the effectiveness of subsequent controls.

Answer

Add the indicators to a watchlist and take no further action until an alert fires.

Answer

Publish the indicators to an open-source threat feed to help the community.

Answer

Immediately block all listed IP addresses and domains at the perimeter firewall.

Question 11

A threat hunter reviewing Windows Security event logs notices that a service account's credentials were used to authenticate to 14 workstations within a 3-minute window, all successful logons with Logon Type 3. No scheduled tasks or administrative scripts are known to run under this account. Which hypothesis best explains this pattern and should drive the next hunt step?

Accepted Answer

The account is being used for lateral movement via SMB or remote service execution, and the hunter should pivot to Event ID 5140/5145 and service creation telemetry on the target hosts.. A burst of successful Logon Type 3 authentications from one service account across many workstations is a strong lateral movement indicator. Attackers using SMB, remote service creation, or remote execution tools generate exactly this footprint. The productive next step is to pivot to the destination hosts and examine share access, service installation, and process creation events to determine what was executed after authentication.

Answer

The account is being brute-forced by an external attacker, and the hunter should immediately review Event ID 4625 failures on the domain controller.

Answer

The workstations are performing a scheduled vulnerability scan using domain credentials, and the hunter should correlate with the scanner's IP range before escalating.

Answer

The account is experiencing a Kerberos ticket renewal storm, and the hunter should analyze Event ID 4769 service ticket requests on the KDC.

Question 12

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

Accepted Answer

Access to lsass.exe. Mimikatz is a credential-dumping tool that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Its primary target is the Local Security Authority Subsystem Service (lsass.exe), which stores credential material in Windows. Therefore, the most common indicator of credential dumping is a process accessing lsass.exe memory, often via OpenProcess with PROCESS_VM_READ and ReadProcessMemory calls.

Answer

Access to csrss.exe

Answer

Access to svchost.exe

Answer

Access to explorer.exe

Question 13

A threat hunter is investigating possible data staging prior to exfiltration on a file server. The hunter has full Windows Security auditing, Sysmon, and PowerShell logging available. Which TWO telemetry patterns most directly indicate that an adversary is staging and compressing collected data on the host? (Choose two.)

Accepted Answer

A single process creating a large number of file read operations across many directories within a short window, followed by writes to one new archive file.. Staging is characterized by broad collection followed by consolidation into a single archive, and by archiving that deviates from normal administrative patterns. Reading many directories then writing one archive, and creating an encrypted archive with a non-standard extension from a web server parent, both directly evidence that behavior.

Answer

Repeated DNS queries from the server to a single external domain at irregular intervals with varying query types.

Answer

A high volume of failed authentication attempts against the file server from multiple internal workstations.

Answer

Scheduled tasks created by the built-in backup service account to copy files to a known backup share each night.

Question 14

A security analyst is mapping adversary behavior to the MITRE ATT&CK framework. The analyst observes that the adversary is using the 'Spearphishing Attachment' technique. Under which ATT&CK tactic does this technique fall?

Accepted Answer

Initial Access. Spearphishing Attachment is categorized under the Initial Access tactic in MITRE ATT&CK because it is a method adversaries use to gain an initial foothold into a network. The technique involves sending a phishing email with a malicious attachment, which aligns with the goal of initial access. Other tactics like Execution, Persistence, and Privilege Escalation describe different phases of an attack, not the initial entry point.

Answer

Persistence

Answer

Privilege Escalation

Answer

Execution

Question 15

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Accepted Answer

Logon Type 3 occurring from a workstation to a workstation. Option A is correct because Pass-the-Hash (PtH) abuses NTLM authentication to move laterally, and a Logon Type 3 (network logon) from one workstation to another is abnormal in most environments and is a classic signature of PtH lateral movement using stolen NTLM hashes. Option B is correct because a successful logon originating from an unexpected or unusual source IP indicates an attacker is authenticating with compromised credentials/hashes from a host that should not be initiating such access, which is a strong PtH indicator. Option D is correct because PtH relies on NTLM authentication (the hash is replayed directly), so observing NTLM authentication where Kerberos would normally be expected (e.g., in a domain environment that supports Kerberos) is a strong indicator of hash-based authentication abuse. Option C is not a PtH indicator because successful local service startup is normal system behavior and unrelated to credential theft or replay. Option E is not a PtH indicator because a high volume of Kerberos TGS requests suggests Kerberos ticket activity (e.g., Kerberoasting or normal service ticket requests), not NTLM hash replay.

Answer

Success of local service startup

Answer

High volume of Kerberos TGS requests

Question 16

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Accepted Answer

Percentage of intelligence reports that result in actionable security controls or detection rules. Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.

Answer

Number of threat intelligence blog posts published on the corporate website

Answer

Total gigabytes of threat data ingested from commercial feeds per month

Answer

Total number of security alerts generated by the SIEM

Question 17

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 18

A security analyst is reviewing threat intelligence reports and notices that an APT group frequently uses zero-day exploits and custom malware to target government agencies. The group maintains long-term access to victim networks and exfiltrates sensitive data over extended periods. Which characteristic best distinguishes this group as an Advanced Persistent Threat (APT)?

Accepted Answer

Long-term persistence and stealthy exfiltration. Advanced Persistent Threats (APTs) are defined by their persistence, stealth, and long-term focus. They maintain access to victim networks over extended periods, often exfiltrating data slowly to avoid detection. While zero-days, custom malware, and specific targets are common, the core distinguishing feature is the persistent and stealthy nature of the campaign.

Answer

Use of custom malware

Answer

Targeting government agencies

Answer

Use of zero-day exploits

Question 19

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Accepted Answer

Pivot to identify the Capability or Adversary. After identifying infrastructure, the next step is to pivot to identify the associated Capability or Adversary, creating a chain of evidence.

Answer

Update the firewall blacklist only

Answer

Change all user passwords

Answer

Close the incident ticket

Question 20

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Accepted Answer

Reconnaissance. Reconnaissance (A) is effectively defended at the network level because controls such as firewalls, IDS/IPS, and DNS/WHOIS privacy can hide or limit the information an adversary gathers during active scanning and enumeration. Delivery (B) is a network-level phase since malicious payloads arrive via email, web downloads, or exploit kits, and controls like secure email gateways, web proxies, and IPS signatures can block or quarantine them in transit. Command and Control (E) is also network-defensible because C2 traffic relies on protocols such as HTTP/HTTPS, DNS, or custom ports, and egress filtering, DNS sinkholing, and NGFW/IDS detection can disrupt beaconing. Installation (C) typically occurs on the endpoint after code execution, so it is better addressed by host-based controls like EDR, application allowlisting, and patching rather than network controls. Actions on Objectives (D) happen post-compromise on internal systems and data, requiring host, identity, and data-level defenses such as EDR, least privilege, and DLP instead of purely network-level security.

Answer

Installation

Answer

Actions on Objectives