312-85 Practice Questions 2 — 50 Questions

Question 1

A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A1. Under the Admiralty Code, A1 represents a reliable source (A) and information that is confirmed by other independent sources (1).

Answer

C3

Answer

F6

Answer

B2

Question 2

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Accepted Answer

A list of known malicious file hashes. An IOC is a piece of forensic evidence that indicates a system has been compromised.

Answer

A description of an adversary's motivation

Answer

A whitepaper on general cybersecurity trends

Answer

An organization's security policy document

Question 3

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Accepted Answer

Processing. Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.

Answer

Collection

Answer

Dissemination

Answer

Analysis

Question 4

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Accepted Answer

The use of a custom remote access trojan (RAT) with specific DGA algorithms. Capability refers to the specific tools, malware, or techniques an adversary uses to achieve their objectives.

Answer

The target organization's industry sector

Answer

The frequency of the adversary's campaigns

Answer

The adversary's base of operations in a specific country

Question 5

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Accepted Answer

Standardization of intelligence processes and a unified view of organizational risk. A centralized team allows for better standardization of intelligence processes, resource pooling, and a unified view of the enterprise threat landscape.

Answer

Elimination of the need for external commercial threat feeds

Answer

Complete elimination of communication silos with local IT helpdesks

Answer

Faster deployment of endpoint agents on localized operational technology networks

Question 6

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Accepted Answer

Information on exploit frameworks, payload construction tools, and customized delivery mechanisms used by target threat groups. Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.

Answer

Phishing email headers received by internal mail servers from external domains

Answer

File hashes and indicators associated with credential dumping tools like Mimikatz

Answer

Network traffic logs showing data exfiltration over encrypted channels

Question 7

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

Accepted Answer

Export Objects. 'Export Objects' allows you to extract HTTP or DNS data, including domain names, from a PCAP file.

Answer

Follow TCP Stream

Answer

Endpoints

Answer

Expert Information

Question 8

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Accepted Answer

Enrichment with context. Data quality is ensured by normalizing formats, removing duplicates, and enriching data with context from other sources.

Answer

Physical media scanning

Answer

Executive sign-off

Question 9

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

Accepted Answer

Intrusion Set / Threat Actor identity. The Adversary node includes the actors behind the threat and their intent.

Answer

Network infrastructure

Answer

Target organization's industry

Answer

Malware capabilities

Question 10

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

Accepted Answer

Centralizing threat data from multiple disparate sources. TIPs centralize and automate the management of threat data.

Answer

Providing the original source code of all malware

Answer

Eliminating all false positives

Answer

Replacing the need for a security analyst team

Question 11

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Accepted Answer

Strategic Threat Intelligence Analyst. The Threat Intelligence Manager or Strategic Threat Analyst bridges the gap between technical threat indicators and business risk, ensuring executive leadership understands the strategic impact.

Answer

Vulnerability Assessor

Answer

Malware Reverse Engineer

Answer

Incident Responder

Question 12

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

Accepted Answer

Identify (ID). The NIST CSF 'Govern' (GV) and 'Identify' (ID) functions encompass the establishment of policies, procedures, and asset/threat identification, with ID.RA (Risk Assessment) and GV subcategories guiding intelligence requirement definition.

Answer

Recover (RC)

Answer

Respond (RS)

Answer

Protect (PR)

Question 13

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

Accepted Answer

Target-Centric Intelligence Analysis. Target-centric intelligence analysis focuses specifically on the assets, events, or transactions of interest (such as an M&A deal) and maps out all threat actors known to target those specific equities.

Answer

Network Forensic Packet Capture Analysis

Answer

Signature-Based Intrusion Detection Analysis

Answer

Vulnerability Scoring via CVSS v3.1 Base Metrics

Question 14

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

Accepted Answer

Ticket lifetime (e.g., 10 years). The ticket lifetime and the account SID are key indicators; Golden Tickets often use a fake domain admin SID.

Answer

Domain controller name

Answer

Client IP address

Answer

Ticket encryption algorithm

Question 15

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

Accepted Answer

Executive Leadership and Risk Management (CISO, CRO). Engaging Incident Response, Security Operations, and Executive Management ensures that CTI requirements align with operational needs and executive risks.

Answer

Residential landscaping contractors

Answer

External catering service providers

Question 16

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Accepted Answer

Tactical level (SIEM systems, Automated security controls, SOC analysts). Intelligence plans address strategic (executive), operational (managerial/defense), and tactical (technical/SOC) consumers.

Answer

Corporate real estate leasing committees

Answer

External consumer product marketing teams

Question 17

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

Accepted Answer

Analyst professional development, training, and industry certifications. Budget planning for CTI must account for commercial tool subscriptions, personnel training/certifications, and intelligence platform licenses.

Answer

Fleet vehicle insurance policies for corporate delivery trucks

Answer

Commercial cafeteria food and beverage restocking contracts

Question 18

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

Accepted Answer

Event ID 8. Event ID 8 (CreateRemoteThread) is a primary indicator of process hollowing, where a process injects code into another process.

Answer

Event ID 1

Answer

Event ID 11

Answer

Event ID 3

Question 19

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

Accepted Answer

Microsoft-Windows-PowerShell/Operational ID 4104. The Microsoft-Windows-PowerShell/Operational log (Event ID 4104) captures the full script block text, even if obfuscated or encoded.

Answer

System Event ID 7040

Answer

Application Event ID 1000

Answer

Security Event ID 4688

Question 20

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

Accepted Answer

threat_intel_by_str. The 'threat_intel_by_str' lookup table is the primary repository for normalized threat intelligence data that Splunk ES uses for correlation across its dashboards.

Answer

assets_by_cidr

Answer

threat_group_mapping

Answer

notable_events_summary