312-85 Practice Test 9 — 10 Questions

Question 1

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Accepted Answer

Clearing Windows Event Logs. Defense Evasion covers any method used to hide from security tools, such as clearing logs or disabling antivirus.

Answer

Brute-forcing RDP

Answer

Setting up a VPN

Answer

Running a port scan

Question 2

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

Accepted Answer

Calculate the Z-score of the timestamp distribution.. Standard deviation or Z-score is used to determine how many standard deviations an observation is from the mean.

Answer

Apply the Mode of the frequency dataset.

Answer

Perform a simple Median split.

Answer

Use the Range calculation.

Question 3

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Accepted Answer

Threat actor aliases. The Adversary vertex tracks the threat actor's identity, including known aliases and their organizational affiliation.

Answer

Targeted industry

Answer

IP address range

Answer

Malware variant

Question 4

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Accepted Answer

Information Disclosure. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Plain text logging of tokens is a classic Information Disclosure vulnerability.

Answer

Elevation of Privilege

Answer

Tampering

Answer

Repudiation

Question 5

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Accepted Answer

A command-line execution sequence. IOCs are static (hashes, IPs), whereas IOAs describe patterns of activity (behavior) that indicate an attack is in progress.

Answer

A known malicious file hash

Answer

A specific registry key for malware persistence

Answer

A blacklisted IP address

Question 6

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Accepted Answer

T1547.001: Registry Run Keys. Modifying Run keys is a standard method for achieving persistence on Windows systems, mapped to T1547.001.

Answer

T1003: OS Credential Dumping

Answer

T1059.001: PowerShell

Answer

T1021: Remote Services

Question 7

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

Accepted Answer

Timeliness. Good IOCs must be accurate, timely, and contextually relevant to the threat environment.

Answer

File Size

Answer

Vendor Popularity

Question 8

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

Accepted Answer

Reconnaissance. Reconnaissance, Weaponization, and Delivery occur before the attacker has a presence on the target host.

Answer

Installation

Answer

Exploitation

Question 9

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Accepted Answer

Determine the Tactic and map the specific Technique ID.. Mapping involves identifying the Technique ID (T1574.002) and analyzing it within the context of the observed execution flow.

Answer

Perform a Root Cause Analysis on the operating system.

Answer

Use the CVSS score of the DLL to prioritize the threat.

Answer

Calculate the frequency of the DLL calls to determine the actor intent.

Question 10

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Accepted Answer

Reconnaissance. Network security controls (firewalls, IDS/IPS, proxies) are most effective at the stages involving external communication and delivery.

Answer

Installation

Answer

Actions on Objectives