312-85 Practice Questions 2 — 50 Questions

Question 1

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Standardization of intelligence processes and a unified view of organizational risk. A centralized team allows for better standardization of intelligence processes, resource pooling, and a unified view of the enterprise threat landscape.

Answer

Elimination of the need for external commercial threat feeds

Answer

Complete elimination of communication silos with local IT helpdesks

Answer

Faster deployment of endpoint agents on localized operational technology networks

Question 2

During an active incident, your IR team needs to know whether a specific IP address is a known C2 node. Your TI platform returns a confidence score of 95 with a first-seen date of 14 months ago. What is the most appropriate way to use this intelligence in the IR decision-making process?

Accepted Answer

Correlate the IP against current network telemetry and recent TI enrichment before deciding on containment actions. Confidence and freshness are distinct attributes of an indicator. A 95 confidence score reflects the source's certainty at reporting time, but a 14-month-old first-seen date means the infrastructure may have changed hands. During an active incident, the IR team should correlate the IP with current network telemetry and recent enrichment to confirm malicious use before committing to containment that could disrupt business services.

Answer

Discard the indicator entirely because indicators older than 12 months are always worthless

Answer

Immediately notify law enforcement and suspend the affected user account based solely on the indicator

Answer

Treat the IP as definitively malicious and immediately block it at all egress points without further analysis

Question 3

A threat intelligence analyst is creating a weekly report for the security operations center (SOC). The report includes a list of IP addresses associated with a recent phishing campaign. The analyst wants to ensure the report is actionable and prioritized for the SOC team. Which of the following should be included to best support immediate action?

Accepted Answer

The IP addresses with context on their role (e.g., command-and-control, phishing site) and recommended actions (e.g., block, monitor).. For immediate action, the SOC requires tactical intelligence that is specific and prioritized. IP addresses with their role in the campaign and clear recommended actions enable quick decision-making and response. Strategic context or links to external resources, while useful, do not provide the direct, actionable guidance needed for time-sensitive mitigation.

Answer

A link to the full threat intelligence platform (TIP) entry for each IP address for self-service investigation.

Answer

A detailed explanation of the phishing campaign's origin and threat actor motivations.

Answer

A summary of the threat landscape and how this campaign fits into broader trends.

Question 4

A threat intelligence analyst at a financial institution is ingesting a high-volume STIX 2.1 feed from a commercial provider. The feed contains many duplicate and near-duplicate indicators. The analyst needs to programmatically deduplicate the data before storing it in a MISP instance. Which approach is most appropriate for identifying and removing duplicate indicators?

Accepted Answer

Normalize the indicator patterns and compute a hash over the canonicalized pattern and object type, then use that hash as the deduplication key.. Deduplicating threat intelligence requires comparing the semantic content of indicators, not just object IDs or timestamps. Canonicalizing patterns and hashing them yields a stable fingerprint that identifies equivalent indicators across feeds. This method works regardless of source-specific IDs and ensures that only genuinely unique indicators are stored, reducing noise and storage overhead.

Answer

Use the MISP correlation engine to automatically merge all events that share at least one attribute, treating them as duplicates.

Answer

Use the STIX ID field of each object as the unique identifier, since it is guaranteed to be globally unique and persistent across updates.

Answer

Compare the created timestamp of each object and discard any object whose timestamp is older than the newest one with the same name.

Question 5

During a threat intelligence analysis, you are examining a large dataset of network flow records. You notice a significant number of outbound connections from internal hosts to a known malicious IP address on port 443, but the connections are short-lived and occur at regular intervals. Which of the following best describes the adversary behavior you are observing?

Accepted Answer

Command-and-control beaconing. The pattern of regular, short-lived outbound connections to a known malicious IP on port 443 is a strong indicator of command-and-control beaconing. Malware beacons at set intervals to receive commands and maintain communication with the attacker. This behavior is often designed to mimic normal HTTPS traffic to avoid detection, but the periodic nature and short duration are telltale signs.

Answer

Port scanning of external targets

Answer

Data exfiltration over HTTPS

Answer

DNS tunneling for data exfiltration

Question 6

A SOC analyst is building a hypothesis set to explain a suspected data exfiltration event. She creates five mutually exclusive hypotheses and then scores each piece of evidence for consistency with every hypothesis. After scoring, she notices that one hypothesis has the highest total consistency score, but the evidence is sparse and several items are ambiguous. What should she do before finalizing her assessment?

Accepted Answer

Evaluate the diagnosticity and weight of each evidence item, and document uncertainty before finalizing the assessment.. Analysis of Competing Hypotheses requires more than summing consistency scores. The analyst must judge how diagnostic each piece of evidence is, meaning how well it discriminates among the hypotheses. Evidence consistent with nearly all hypotheses carries little weight. By evaluating diagnosticity, weighting evidence, and documenting uncertainty, the analyst produces a defensible conclusion that reflects the actual strength of the intelligence rather than a misleading total.

Answer

Add more hypotheses until the highest-scoring one has a clearly dominant score.

Answer

Immediately select the highest-scoring hypothesis as the conclusion and write the report.

Answer

Discard the matrix and rely on the analyst's intuition because the evidence is incomplete.

Question 7

You are analyzing a Linux server that is suspected of being compromised. You observe a process named 'kworker' that is consuming high CPU, but when you check the parent process ID (PPID), it is 1 (init). Which of the following is the most likely explanation for this observation?

Accepted Answer

The process is a malicious user-space process masquerading as a kernel thread. A process named 'kworker' with a PPID of 1 and high CPU usage is likely a malicious process masquerading as a kernel thread. Genuine kernel worker threads have a PPID of 2 (kthreadd) and are not user-space processes. Attackers use such names to evade detection, and the high CPU could indicate cryptomining or other malicious activity.

Answer

The process is a legitimate user application that has been reparented to init after its parent terminated

Answer

The process is a result of a kernel module loading incorrectly

Answer

The process is a legitimate kernel worker thread

Question 8

During a malware analysis engagement, you receive a sample whose import table references the Windows API functions VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. Which analytical conclusion is best supported by this evidence?

Accepted Answer

The sample is likely performing process injection into another process.. The three imported functions describe writing code into another process and starting a thread there, which is the definition of remote process injection. Static imports indicate capability rather than confirmed execution, so the analyst should pair this finding with dynamic evidence such as API call traces or memory scans before finalizing attribution or intent.

Answer

The sample is likely exfiltrating data over an encrypted channel.

Answer

The sample is likely establishing persistence through a registry Run key.

Answer

The sample is likely encrypting files on the local disk for ransom.

Question 9

A threat intelligence analyst is processing a large dataset of indicators collected from multiple OSINT sources. The analyst notices that many indicators are malformed, such as IP addresses with invalid octets or domain names containing illegal characters. The analyst needs to ensure that only valid indicators are stored in the intelligence platform. Which action should the analyst take during the processing phase?

Accepted Answer

Apply regular expression validation to each indicator type and discard any indicator that does not match the expected pattern.. During processing, validating indicator syntax is essential to maintain data quality. Regular expression validation for each indicator type (e.g., IPv4, domain, URL) efficiently identifies malformed entries. Discarding invalid indicators prevents errors in downstream analysis and storage. Enrichment, normalization, or classification do not replace the need for basic syntactic validation.

Answer

Enrich each indicator with additional context from WHOIS and passive DNS, then store all indicators regardless of format.

Answer

Use a machine learning classifier to predict whether each indicator is malicious, and store only those classified as malicious.

Answer

Normalize all indicators to lowercase and remove any special characters, then store them without further validation.

Question 10

You are a threat intelligence analyst at a financial institution. Your team is preparing to share a report on a recent ransomware campaign with a trusted partner via a TAXII 2.1 collection. To ensure the report is correctly interpreted and the sharing complies with internal policies, which two actions must you take before dissemination? (Choose two.)

Accepted Answer

Apply a TLP marking to the report to indicate sharing restrictions.. Before sharing via TAXII, you must apply the appropriate TLP marking to communicate handling restrictions and verify that the recipient is authorized to receive information at that TLP level. These steps ensure compliance with sharing policies and prevent unauthorized disclosure. Other actions like PGP encryption or PDF conversion are not standard requirements.

Answer

Convert the report to PDF format to preserve formatting.

Answer

Include a disclaimer that the information is provided 'as is' without warranty.

Answer

Encrypt the report using PGP before sending it via TAXII.

Question 11

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Accepted Answer

Data Exfiltration. This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.

Answer

Reconnaissance of the target

Answer

Establishing a backdoor

Answer

Sending phishing emails

Question 12

You are reviewing a threat intelligence report that includes a list of indicators. You notice that one indicator is an IP address with a low confidence score. According to best practices, what should you do before using this indicator for detection?

Accepted Answer

Correlate the indicator with other sources to increase confidence.. Before using a low-confidence indicator, analysts should correlate it with other sources to validate its maliciousness and increase confidence. This step reduces false positives and ensures that any subsequent actions, such as blocking, are justified. It is a core practice in threat intelligence to avoid acting on unverified data.

Answer

Discard the indicator because it is not reliable.

Answer

Immediately block the IP address at the firewall.

Answer

Add the indicator to a watchlist for manual review only.

Question 13

A security operations center analyst is mapping an intrusion to the MITRE ATT&CK framework. The analyst observes that after gaining initial access, the adversary used Windows Management Instrumentation (WMI) to remotely create processes on other hosts in the domain. Under which ATT&CK tactic does this activity fall?

Accepted Answer

Lateral Movement. Using WMI to create processes on remote hosts allows an adversary to pivot from one compromised system to others within the domain, which is the definition of Lateral Movement in MITRE ATT&CK. The technique is catalogued as Windows Management Instrumentation (T1047) and is frequently observed because it abuses a legitimate administrative feature, making it harder to distinguish from normal management activity.

Answer

Privilege Escalation

Answer

Execution

Answer

Persistence

Question 14

A threat intelligence team is correlating indicators from multiple feeds. They observe that a set of domain names resolves to fast-flux IP addresses, the domains were registered within the last 48 hours, and the same SSL certificate serial number appears across several unrelated domains. Which analytic conclusion is best supported by this evidence?

Accepted Answer

The infrastructure is likely adversary-controlled and may be used for malware command-and-control or phishing.. The convergence of fast-flux DNS, newly registered domains, and shared certificate serials across unrelated domains is a recognized pattern of adversary-controlled infrastructure. Each indicator alone can have benign explanations, but together they strongly suggest malicious intent. The analyst should treat these domains as suspicious, enrich them with passive DNS and WHOIS data, and consider blocking or monitoring while continuing to validate the assessment.

Answer

The domains are part of a legitimate content delivery network with high availability requirements.

Answer

The domains are compromised legitimate sites being used as watering holes.

Answer

The shared certificate serial number proves the domains are owned by a single legitimate organization.

Question 15

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

Accepted Answer

Reconnaissance. Reconnaissance is the correct phase because the adversary is conducting open-source research on employees and technical infrastructure before any exploitation attempt. This phase encompasses all information gathering activities that precede weaponization and delivery. The scenario contains no evidence of payload creation, transmission, or vulnerability exploitation, so the other phases are not applicable.

Answer

Exploitation

Answer

Weaponization

Answer

Delivery

Question 16

A threat intelligence analyst is preparing to analyze a large set of intrusion artifacts collected from multiple sensors. She wants to apply structured analysis techniques to reduce bias and improve the defensibility of her conclusions. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

Analysis of Competing Hypotheses to evaluate alternative explanations against evidence.. Structured analytic techniques such as Analysis of Competing Hypotheses and Key Assumptions Check are designed to reduce cognitive bias and make reasoning transparent. ACH forces consideration of alternative explanations and highlights diagnostic evidence, while a Key Assumptions Check exposes the beliefs that underpin interpretation. Together they provide a defensible, repeatable foundation for analyzing large artifact sets and communicating conclusions to decision-makers.

Answer

Devil's Advocacy to argue the opposite of the prevailing view regardless of evidence.

Answer

Timeline analysis to sequence events chronologically without assessing causality.

Answer

Brainstorming to generate as many ideas as possible without evaluating them.

Question 17

A threat hunter is investigating a suspected data exfiltration channel that uses DNS tunneling. The organization's DNS logs capture query names, query types, response codes, and source hosts, but not full packet payloads. Which TWO characteristics of the DNS queries would most reliably indicate tunneling activity rather than normal DNS behavior? (Choose two.)

Accepted Answer

Unusually long and high-entropy subdomain labels encoded in the query name.. Without payload visibility, tunneling must be inferred from query shape and type: long, high-entropy subdomain labels carry encoded data, and sustained TXT queries from one host exploit a record type and volume that normal endpoints rarely produce. Popular A-record lookups, organization-wide NXDOMAIN noise, and internal PTR queries all match benign baselines and cannot isolate a tunneling channel.

Answer

Frequent NXDOMAIN responses for typo-like domain names across the entire organization.

Answer

Queries that use the A record type for well-known public domains from many different hosts.

Answer

Periodic PTR record queries for internal RFC1918 addresses from a single host.

Question 18

A threat intelligence analyst is examining a malware sample and observes that the binary contains a hardcoded list of domain names that are contacted in a fixed order, with a fallback to a DGA-generated domain if the first three fail. The analyst wants to characterize the command-and-control resilience of this malware. Which statement best describes the resilience of this C2 approach?

Accepted Answer

The C2 is moderately resilient; the hardcoded domains are a weakness, but the DGA fallback provides some redundancy.. The malware's C2 uses a fixed hardcoded list with a DGA fallback. The hardcoded domains are a single point of failure because they can be blocked, seized, or sinkholed. The DGA fallback provides redundancy by generating many potential domains, but DGAs can be predicted and mitigated. Therefore, the design is moderately resilient, offering more redundancy than a single static domain but less than a fully decentralized or domain-fronting approach.

Answer

The C2 is not resilient at all because hardcoded domains are always taken down quickly.

Answer

The C2 is highly resilient because it uses a DGA, which cannot be taken down.

Answer

The C2 resilience cannot be assessed without knowing the encryption algorithm used for communications.

Question 19

A threat intelligence analyst is processing a large set of indicators and needs to enrich them with additional context. The analyst wants to use the MITRE ATT&CK framework to map indicators to adversary tactics, techniques, and procedures (TTPs). Which data processing step should be performed first to ensure accurate mapping?

Accepted Answer

Normalize the indicators to a standard format. Normalizing indicators to a standard format is essential before mapping to MITRE ATT&CK because it ensures that indicators are consistently represented, enabling accurate matching to techniques. Without normalization, variations in data can cause mismatches and reduce the effectiveness of enrichment. Other steps like WHOIS enrichment, SIEM correlation, or clustering are valuable but should follow normalization to maintain data integrity.

Answer

Apply machine learning clustering to group similar indicators

Answer

Correlate indicators with existing events in the SIEM

Answer

Enrich indicators with WHOIS data

Question 20

A threat intelligence analyst is collecting data from a TAXII 2.1 server. The analyst needs to retrieve only the indicators that have been added or modified since the last collection. Which TAXII 2.1 feature should be used to achieve this?

Accepted Answer

Use the 'added_after' query parameter. The 'added_after' query parameter in TAXII 2.1 is specifically designed for incremental collection, allowing clients to request objects added after a given timestamp. This efficiently retrieves only new or modified indicators, reducing bandwidth and processing. Other parameters like 'match[version]' or 'limit' serve different purposes and do not support time-based filtering for incremental updates.

Answer

Use the 'limit' query parameter to paginate results

Answer

Use the 'filter' query parameter with a date range

Answer

Use the 'match[version]' query parameter