312-85 Practice Test 8 — 10 Questions

Question 1

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the industry-standard framework for mapping adversarial techniques and identifying gaps in security controls.

Answer

STRIDE

Answer

OSINT

Answer

CVSS

Question 2

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

Accepted Answer

Initiate threat hunting across endpoints. High-confidence indicators should be validated against internal logs, the firewall/proxy should be updated to block the activity, and the threat should be hunted for historical presence.

Answer

Disable all network interfaces

Answer

Publicly disclose the intelligence

Question 3

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

Accepted Answer

It enables the visualization of relationships between the four core components of an intrusion.. The Diamond Model links the Adversary, Capability, Infrastructure, and Victim, providing a holistic view of the event.

Answer

It provides a vulnerability score for every asset.

Answer

It calculates the financial loss expectancy of a breach.

Answer

It replaces the need for SIEM log collection.

Question 4

Which of the following best describes an Advanced Persistent Threat (APT)?

Accepted Answer

Sophisticated, long-term, targeted attacks. APTs are characterized by their long-term, targeted, and sophisticated nature, often backed by nation-states.

Answer

Automated script kiddies

Answer

Uncoordinated network scanning

Answer

Short-term ransomware campaigns

Question 5

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

Accepted Answer

type. In STIX 2.1, the 'type' field is mandatory for all SDOs and SCOs, and for file objects, it must be set to 'file'.

Answer

name

Answer

spec_version

Answer

hashes

Question 6

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

Accepted Answer

The hypothesis is the least likely to be correct given the current evidence set.. In ACH, lower scores in the matrix often indicate that the evidence strongly contradicts the hypothesis.

Answer

The hypothesis is the most likely scenario.

Answer

The hypothesis is heavily supported by available data.

Answer

The hypothesis lacks enough evidence to be evaluated.

Question 7

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Accepted Answer

Defense Evasion. Process Hollowing is a form of Defense Evasion, as it allows malicious code to hide inside a legitimate process.

Answer

Lateral Movement

Answer

Credential Access

Answer

Persistence

Question 8

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Accepted Answer

T1018. T1087 (Account Discovery) or specifically T1018 (Remote System Discovery) are used for reconnaissance; 'net view' is specifically linked to Remote System Discovery.

Answer

T1071

Answer

T1059

Answer

T1027

Question 9

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Accepted Answer

Registry key modification. A Registry key modification is a change made directly to the infected host system, making it a host-based indicator.

Answer

User-Agent string in HTTP header

Answer

Domain name for C2 beaconing

Answer

Source IP address in firewall logs

Question 10

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Accepted Answer

Capability. The four core vertices of the Diamond Model are Adversary, Capability, Infrastructure, and Victim.

Answer

Network Topology

Answer

Payload