312-85 Practice Test 6 — 10 Questions

Question 1

A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A1. Under the Admiralty Code, A1 represents a reliable source (A) and information that is confirmed by other independent sources (1).

Answer

C3

Answer

F6

Answer

B2

Question 2

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Accepted Answer

A list of known malicious file hashes. An IOC is a piece of forensic evidence that indicates a system has been compromised.

Answer

A description of an adversary's motivation

Answer

A whitepaper on general cybersecurity trends

Answer

An organization's security policy document

Question 3

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Accepted Answer

Processing. Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.

Answer

Collection

Answer

Dissemination

Answer

Analysis

Question 4

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Accepted Answer

The use of a custom remote access trojan (RAT) with specific DGA algorithms. Capability refers to the specific tools, malware, or techniques an adversary uses to achieve their objectives.

Answer

The target organization's industry sector

Answer

The frequency of the adversary's campaigns

Answer

The adversary's base of operations in a specific country

Question 5

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Accepted Answer

Standardization of intelligence processes and a unified view of organizational risk. A centralized team allows for better standardization of intelligence processes, resource pooling, and a unified view of the enterprise threat landscape.

Answer

Elimination of the need for external commercial threat feeds

Answer

Complete elimination of communication silos with local IT helpdesks

Answer

Faster deployment of endpoint agents on localized operational technology networks

Question 6

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Accepted Answer

Information on exploit frameworks, payload construction tools, and customized delivery mechanisms used by target threat groups. Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.

Answer

Phishing email headers received by internal mail servers from external domains

Answer

File hashes and indicators associated with credential dumping tools like Mimikatz

Answer

Network traffic logs showing data exfiltration over encrypted channels

Question 7

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

Accepted Answer

Export Objects. 'Export Objects' allows you to extract HTTP or DNS data, including domain names, from a PCAP file.

Answer

Follow TCP Stream

Answer

Endpoints

Answer

Expert Information

Question 8

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Accepted Answer

Enrichment with context. Data quality is ensured by normalizing formats, removing duplicates, and enriching data with context from other sources.

Answer

Physical media scanning

Answer

Executive sign-off

Question 9

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

Accepted Answer

Intrusion Set / Threat Actor identity. The Adversary node includes the actors behind the threat and their intent.

Answer

Network infrastructure

Answer

Target organization's industry

Answer

Malware capabilities

Question 10

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

Accepted Answer

Centralizing threat data from multiple disparate sources. TIPs centralize and automate the management of threat data.

Answer

Providing the original source code of all malware

Answer

Eliminating all false positives

Answer

Replacing the need for a security analyst team