312-85 Practice Test 6 — 10 Questions

Question 1

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Standardization of intelligence processes and a unified view of organizational risk. A centralized team allows for better standardization of intelligence processes, resource pooling, and a unified view of the enterprise threat landscape.

Answer

Elimination of the need for external commercial threat feeds

Answer

Complete elimination of communication silos with local IT helpdesks

Answer

Faster deployment of endpoint agents on localized operational technology networks

Question 2

During an active incident, your IR team needs to know whether a specific IP address is a known C2 node. Your TI platform returns a confidence score of 95 with a first-seen date of 14 months ago. What is the most appropriate way to use this intelligence in the IR decision-making process?

Accepted Answer

Correlate the IP against current network telemetry and recent TI enrichment before deciding on containment actions. Confidence and freshness are distinct attributes of an indicator. A 95 confidence score reflects the source's certainty at reporting time, but a 14-month-old first-seen date means the infrastructure may have changed hands. During an active incident, the IR team should correlate the IP with current network telemetry and recent enrichment to confirm malicious use before committing to containment that could disrupt business services.

Answer

Discard the indicator entirely because indicators older than 12 months are always worthless

Answer

Immediately notify law enforcement and suspend the affected user account based solely on the indicator

Answer

Treat the IP as definitively malicious and immediately block it at all egress points without further analysis

Question 3

A threat intelligence analyst is creating a weekly report for the security operations center (SOC). The report includes a list of IP addresses associated with a recent phishing campaign. The analyst wants to ensure the report is actionable and prioritized for the SOC team. Which of the following should be included to best support immediate action?

Accepted Answer

The IP addresses with context on their role (e.g., command-and-control, phishing site) and recommended actions (e.g., block, monitor).. For immediate action, the SOC requires tactical intelligence that is specific and prioritized. IP addresses with their role in the campaign and clear recommended actions enable quick decision-making and response. Strategic context or links to external resources, while useful, do not provide the direct, actionable guidance needed for time-sensitive mitigation.

Answer

A link to the full threat intelligence platform (TIP) entry for each IP address for self-service investigation.

Answer

A detailed explanation of the phishing campaign's origin and threat actor motivations.

Answer

A summary of the threat landscape and how this campaign fits into broader trends.

Question 4

A threat intelligence analyst at a financial institution is ingesting a high-volume STIX 2.1 feed from a commercial provider. The feed contains many duplicate and near-duplicate indicators. The analyst needs to programmatically deduplicate the data before storing it in a MISP instance. Which approach is most appropriate for identifying and removing duplicate indicators?

Accepted Answer

Normalize the indicator patterns and compute a hash over the canonicalized pattern and object type, then use that hash as the deduplication key.. Deduplicating threat intelligence requires comparing the semantic content of indicators, not just object IDs or timestamps. Canonicalizing patterns and hashing them yields a stable fingerprint that identifies equivalent indicators across feeds. This method works regardless of source-specific IDs and ensures that only genuinely unique indicators are stored, reducing noise and storage overhead.

Answer

Use the MISP correlation engine to automatically merge all events that share at least one attribute, treating them as duplicates.

Answer

Use the STIX ID field of each object as the unique identifier, since it is guaranteed to be globally unique and persistent across updates.

Answer

Compare the created timestamp of each object and discard any object whose timestamp is older than the newest one with the same name.

Question 5

During a threat intelligence analysis, you are examining a large dataset of network flow records. You notice a significant number of outbound connections from internal hosts to a known malicious IP address on port 443, but the connections are short-lived and occur at regular intervals. Which of the following best describes the adversary behavior you are observing?

Accepted Answer

Command-and-control beaconing. The pattern of regular, short-lived outbound connections to a known malicious IP on port 443 is a strong indicator of command-and-control beaconing. Malware beacons at set intervals to receive commands and maintain communication with the attacker. This behavior is often designed to mimic normal HTTPS traffic to avoid detection, but the periodic nature and short duration are telltale signs.

Answer

Port scanning of external targets

Answer

Data exfiltration over HTTPS

Answer

DNS tunneling for data exfiltration

Question 6

A SOC analyst is building a hypothesis set to explain a suspected data exfiltration event. She creates five mutually exclusive hypotheses and then scores each piece of evidence for consistency with every hypothesis. After scoring, she notices that one hypothesis has the highest total consistency score, but the evidence is sparse and several items are ambiguous. What should she do before finalizing her assessment?

Accepted Answer

Evaluate the diagnosticity and weight of each evidence item, and document uncertainty before finalizing the assessment.. Analysis of Competing Hypotheses requires more than summing consistency scores. The analyst must judge how diagnostic each piece of evidence is, meaning how well it discriminates among the hypotheses. Evidence consistent with nearly all hypotheses carries little weight. By evaluating diagnosticity, weighting evidence, and documenting uncertainty, the analyst produces a defensible conclusion that reflects the actual strength of the intelligence rather than a misleading total.

Answer

Add more hypotheses until the highest-scoring one has a clearly dominant score.

Answer

Immediately select the highest-scoring hypothesis as the conclusion and write the report.

Answer

Discard the matrix and rely on the analyst's intuition because the evidence is incomplete.

Question 7

You are analyzing a Linux server that is suspected of being compromised. You observe a process named 'kworker' that is consuming high CPU, but when you check the parent process ID (PPID), it is 1 (init). Which of the following is the most likely explanation for this observation?

Accepted Answer

The process is a malicious user-space process masquerading as a kernel thread. A process named 'kworker' with a PPID of 1 and high CPU usage is likely a malicious process masquerading as a kernel thread. Genuine kernel worker threads have a PPID of 2 (kthreadd) and are not user-space processes. Attackers use such names to evade detection, and the high CPU could indicate cryptomining or other malicious activity.

Answer

The process is a legitimate user application that has been reparented to init after its parent terminated

Answer

The process is a result of a kernel module loading incorrectly

Answer

The process is a legitimate kernel worker thread

Question 8

During a malware analysis engagement, you receive a sample whose import table references the Windows API functions VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. Which analytical conclusion is best supported by this evidence?

Accepted Answer

The sample is likely performing process injection into another process.. The three imported functions describe writing code into another process and starting a thread there, which is the definition of remote process injection. Static imports indicate capability rather than confirmed execution, so the analyst should pair this finding with dynamic evidence such as API call traces or memory scans before finalizing attribution or intent.

Answer

The sample is likely exfiltrating data over an encrypted channel.

Answer

The sample is likely establishing persistence through a registry Run key.

Answer

The sample is likely encrypting files on the local disk for ransom.

Question 9

A threat intelligence analyst is processing a large dataset of indicators collected from multiple OSINT sources. The analyst notices that many indicators are malformed, such as IP addresses with invalid octets or domain names containing illegal characters. The analyst needs to ensure that only valid indicators are stored in the intelligence platform. Which action should the analyst take during the processing phase?

Accepted Answer

Apply regular expression validation to each indicator type and discard any indicator that does not match the expected pattern.. During processing, validating indicator syntax is essential to maintain data quality. Regular expression validation for each indicator type (e.g., IPv4, domain, URL) efficiently identifies malformed entries. Discarding invalid indicators prevents errors in downstream analysis and storage. Enrichment, normalization, or classification do not replace the need for basic syntactic validation.

Answer

Enrich each indicator with additional context from WHOIS and passive DNS, then store all indicators regardless of format.

Answer

Use a machine learning classifier to predict whether each indicator is malicious, and store only those classified as malicious.

Answer

Normalize all indicators to lowercase and remove any special characters, then store them without further validation.

Question 10

You are a threat intelligence analyst at a financial institution. Your team is preparing to share a report on a recent ransomware campaign with a trusted partner via a TAXII 2.1 collection. To ensure the report is correctly interpreted and the sharing complies with internal policies, which two actions must you take before dissemination? (Choose two.)

Accepted Answer

Apply a TLP marking to the report to indicate sharing restrictions.. Before sharing via TAXII, you must apply the appropriate TLP marking to communicate handling restrictions and verify that the recipient is authorized to receive information at that TLP level. These steps ensure compliance with sharing policies and prevent unauthorized disclosure. Other actions like PGP encryption or PDF conversion are not standard requirements.

Answer

Convert the report to PDF format to preserve formatting.

Answer

Include a disclaimer that the information is provided 'as is' without warranty.

Answer

Encrypt the report using PGP before sending it via TAXII.