312-85 Practice Test 8 — 10 Questions

Question 1

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

Accepted Answer

To provide actionable remediation steps to defend against a threat. Course of Action (CoA) objects in STIX are intended to provide actionable remediation steps to defend against a threat. They describe specific measures that can be taken to prevent, mitigate, or respond to an attack, such as applying a patch, blocking a port, or reconfiguring a system. In an automated environment, these can be used to trigger defensive actions or guide incident response.

Answer

To verify the identity of the threat actor

Answer

To map the threat actor's TTPs

Answer

To store forensic artifacts

Question 2

A threat intelligence team ingests a daily feed delivered as a single JSON file. Each record includes an indicator value, a confidence score, and a free-text description. During processing, the team must enrich each indicator with internal asset context and geographic location before loading it into a MISP event. Which action should be performed first to ensure the enrichment stage has clean, normalized records?

Accepted Answer

Parse the JSON, validate required fields, normalize indicator types, and remove duplicate records before enrichment.. Clean data is a precondition for useful enrichment. Parsing and validating the JSON ensures structural integrity, while normalizing indicator types and removing duplicates prevents inconsistent or redundant enrichment results. Enrichment services and MISP should receive only records that are already well-formed and deduplicated, so that asset and geographic context attaches to a single canonical indicator.

Answer

Send each raw JSON record to the enrichment services and then deduplicate the enriched output.

Answer

Load all records into MISP as attributes and use MISP correlation to resolve duplicates and types.

Answer

Convert the JSON to CSV and rely on the CSV import mapping to normalize indicator types automatically.

Question 3

You are a CTI analyst responsible for disseminating a finished intelligence report to multiple stakeholders within your organization, including the SOC, the vulnerability management team, and the CISO. The report contains both tactical indicators and strategic recommendations. What is the most effective way to structure the dissemination to ensure each stakeholder receives the relevant information?

Accepted Answer

Create separate tailored reports for each stakeholder group, emphasizing the aspects most relevant to their roles.. Tailored reports for each stakeholder group ensure that the SOC gets tactical indicators, the vulnerability management team receives relevant vulnerability data, and the CISO gets strategic recommendations. This maximizes the utility of the intelligence and supports timely, role-specific actions. Other approaches risk information overload or omission of critical details for certain audiences.

Answer

Disseminate only the tactical indicators to all stakeholders, as they are the most actionable.

Answer

Send the full report to all stakeholders, allowing them to extract the information pertinent to their roles.

Answer

Hold a single briefing meeting where you present the entire report to all stakeholders simultaneously.

Question 4

A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a TIP. The analyst notices that many indicators are duplicated across feeds but have slightly different metadata, such as confidence scores and timestamps. To ensure efficient processing and accurate analysis, which of the following should the analyst implement to handle these duplicates?

Accepted Answer

Deduplicate indicators by comparing only the indicator value and type, ignoring metadata differences. The most effective deduplication strategy is to identify indicators by their value and type, as these define the indicator itself. Metadata such as confidence and timestamps should be aggregated or reconciled during deduplication. This reduces noise, improves performance, and allows analysts to work with a clean, consolidated dataset. Maintaining provenance is still possible by recording all sources in the indicator's metadata, but it should not prevent merging identical indicators.

Answer

Keep all duplicates and rely on the TIP's built-in search to filter as needed

Answer

Merge indicators only if all metadata fields are identical, otherwise treat them as distinct

Answer

Use the feed source as part of the deduplication key to maintain provenance

Question 5

A threat intelligence analyst is reviewing the Cyber Kill Chain phases for a recent intrusion. The analyst observes that the adversary successfully exploited a vulnerability in a public-facing web server to gain a foothold. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Exploitation. Exploiting a vulnerability in a public-facing web server to gain a foothold is the Exploitation phase of the Cyber Kill Chain. This phase involves the adversary leveraging a vulnerability to execute code and compromise the target. It is a critical step that follows Delivery and precedes Installation. Recognizing this helps analysts understand where to focus detection and mitigation efforts, such as patching vulnerabilities and monitoring for exploit attempts.

Answer

Installation

Answer

Delivery

Answer

Weaponization

Question 6

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

Accepted Answer

Source reliability and information credibility assessment. The lead is capturing how dependable each feed has proven and how credible its content is, so consumers can weight it correctly. Structured evaluation separates the trustworthiness of the source from the plausibility of the information itself, and observed lateness or uniqueness without corroboration are precisely the attributes that drive those ratings.

Answer

Intelligence dissemination and sharing controls

Answer

Threat hunting hypothesis development

Answer

Collection management and requirements prioritization

Question 7

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Accepted Answer

Technical intelligence containing indicators of compromise and TTPs. When scoping a potential breach, the IR team needs concrete, searchable artifacts. Technical intelligence provides indicators of compromise and TTPs that can be used to query SIEM, EDR, and network logs. This allows the team to identify affected systems quickly. Strategic, operational, and tactical intelligence provide context but lack the specificity required for immediate scoping.

Answer

Operational intelligence about upcoming campaigns in the sector

Answer

Tactical intelligence summarizing recent malware trends

Answer

Strategic intelligence reports on long-term threat actor intentions

Question 8

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

Accepted Answer

Analysis and production. The threat intelligence lifecycle comprises planning and direction, collection, processing and exploitation, analysis and production, dissemination, and feedback. Planning and direction sets requirements, processing standardizes raw data, and analysis and production turns that data into finished intelligence, so those three are the recognized phases among the choices.

Answer

Vulnerability remediation

Answer

Penetration testing

Question 9

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

Accepted Answer

Cybercriminal, because the group's consistent objective is financial gain through monetization of stolen data.. Motivation classification depends on the actor's persistent objective. This group repeatedly takes payment records and converts them to cash through underground carding markets, with no political, ideological, or espionage aim. That pattern defines a financially motivated cybercriminal actor. Tools and targets alone do not determine motivation, so the immediate monetization behavior is the decisive evidence.

Answer

Hacktivist, because the group publicizes its thefts to embarrass the victim.

Answer

Insider threat, because only someone with internal access could exfiltrate customer payment records.

Answer

Nation-state espionage actor, because payment data can be used to fund state operations.

Question 10

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

Accepted Answer

Publicly accessible social media posts and forum discussions about threat actors. OSINT is defined by public availability without restriction, which covers public vulnerability databases, vendor advisories, social media, and open forums. Closed peer-sharing groups, licensed commercial feeds, and classified government briefings all have access controls or legal restrictions that place them outside the open-source category, even when their content is high quality and relevant to the same intelligence requirements.

Answer

A commercial feed purchased under a licensing agreement with restricted redistribution

Answer

A closed peer-sharing group where members exchange indicators under a non-disclosure agreement

Answer

Indicators obtained from a government agency through a classified briefing