312-85 Practice Test 9 — 10 Questions

Question 1

A junior analyst receives a raw log export and a set of unstructured vendor advisories. Before analysis can begin, the team lead asks the analyst to normalize timestamps, deduplicate records, translate foreign-language advisories, and enrich IP addresses with geolocation. Which phase of the threat intelligence lifecycle is the analyst performing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Processing. The Processing phase sits between Collection and Analysis and Production, and its purpose is to convert raw, heterogeneous data into a normalized, deduplicated, enriched format that analysts can reason over. Timestamp normalization, translation, and geolocation enrichment are textbook processing operations. Dissemination and Analysis and Production occur later, after the data has been made consistent and comparable.

Answer

Collection

Answer

Dissemination

Answer

Analysis and Production

Question 2

A retail company's newly appointed CTI lead is defining the direction phase for the coming year. The Chief Information Security Officer asks her to document how intelligence requirements will be gathered from the business and turned into a prioritized set of questions the team must answer. Which deliverable best represents the output of the direction phase?

Accepted Answer

A prioritized set of intelligence requirements derived from stakeholder decision needs and approved by leadership. Direction is about deciding what the organization needs to know. By interviewing stakeholders and translating their decision needs into an approved, prioritized set of intelligence requirements, the CTI lead produces the artifact that steers collection and analysis. Platform deployment, finished reports, and response contracts are enabling, downstream, or unrelated activities rather than the direction deliverable.

Answer

A finished malware analysis report with indicators of compromise for a recent intrusion

Answer

A signed incident response retainer contract with an external forensic provider

Answer

A completed threat intelligence platform deployment with normalized feeds and dashboards

Question 3

A retail company's threat intelligence team is asked by the board to explain how the team's work reduces business risk. The analysts want to describe the primary purpose of threat intelligence within an organization. Which statement best captures that purpose?

Accepted Answer

To provide decision advantage by reducing uncertainty about threats so the organization can act more effectively.. The core purpose of threat intelligence is to support decisions by reducing uncertainty about threats, giving the organization an advantage in prioritizing and responding. It is not defined by collection volume, replacement of detection tools, or public attribution. Framing the program around decision advantage helps justify it to leadership in business risk terms and keeps analysts focused on relevance and actionability.

Answer

To replace the security operations center's detection tools with analyst-written reports about threat actors.

Answer

To collect the maximum number of indicators from as many feeds as possible to populate blocking controls.

Answer

To attribute every intrusion to a named threat actor so the organization can publicly name and shame adversaries.

Question 4

A threat hunter is investigating a suspected Kerberoasting attack. Which Windows event ID should the hunter analyze to identify service tickets being requested for accounts with Service Principal Names (SPNs)?

Accepted Answer

Event ID 4769. Kerberoasting involves requesting Kerberos service tickets for accounts with SPNs and then cracking them offline. Event ID 4769 is generated for each service ticket request. Hunters should look for a high volume of 4769 events, especially with encryption type 0x17 (RC4) and for services that are not normally accessed. This pattern indicates an attacker attempting to extract and crack service account credentials.

Answer

Event ID 4771

Answer

Event ID 4624

Answer

Event ID 4768

Question 5

During a peer review, an analyst is challenged on a finished intelligence assessment that states with high confidence that a specific actor is responsible for an intrusion. The analyst's evidence consists of a single reused malware sample hash and a shared hosting provider. Which criticism is most valid under sound analytic standards?

Accepted Answer

The assessment relies on weak, easily spoofed artifacts and therefore overstates confidence in attribution.. Analytic confidence must be proportionate to the strength and corroboration of evidence. A single reused hash and a shared hosting provider are low-fidelity, easily replicated artifacts, so they cannot support a high-confidence attribution without independent corroboration such as unique tradecraft, infrastructure patterns, or victimology. The peer review correctly focuses on the mismatch between claimed confidence and available evidence.

Answer

The assessment should have been classified as strategic intelligence rather than operational.

Answer

The assessment should have used the Traffic Light Protocol marking TLP:RED.

Answer

The analyst failed to include the MITRE ATT&CK technique identifiers for the malware.

Question 6

Your SOC has just onboarded a new premium threat intelligence feed that delivers atomic indicators with a confidence score of 85. During the first week, analysts notice that 40% of the IP addresses in the feed are sinkholed by the vendor but still resolve to live infrastructure in your environment. You need to configure your SIEM to ingest these indicators while minimizing false positives from sinkholed addresses. What should you do first?

Accepted Answer

Enrich the feed indicators with a 'sinkholed' attribute from the vendor's metadata, then create a SIEM correlation rule that lowers the risk score or excludes those indicators from alerting when the attribute is present.. Sinkholed indicators represent infrastructure controlled by researchers or vendors, not active adversary command-and-control. The proper handling is to enrich indicators with the sinkholed attribute and adjust detection logic so those indicators do not generate false positives, while retaining them for historical analysis and correlation. This balances detection fidelity with operational efficiency and avoids both blind spots and alert fatigue.

Answer

Drop the entire feed and request a new one from the vendor that contains only non-sinkholed indicators.

Answer

Set all indicators from this feed to a confidence score of zero in the SIEM so they never generate alerts.

Answer

Create a whitelist in the SIEM for all sinkholed IP ranges provided by the feed vendor and tag them as 'benign infrastructure'.

Question 7

A threat hunter is examining Sysmon telemetry on a workstation and sees an svchost.exe process whose image path is C:\Users\Public\svchost.exe, whose parent is explorer.exe, and which has an unsigned binary with no version information. Which hunting assessment is most appropriate?

Accepted Answer

The process is likely a masquerading binary executing from an unusual path with a user-mode parent, and the hunter should triage it as a probable malicious implant.. Legitimate svchost.exe must run from System32, carry a Microsoft signature, and be parented by services.exe. A signed-absent copy in a user-writable directory with explorer.exe as parent violates all three invariants, making masquerading the strongest hypothesis and warranting immediate triage.

Answer

The process is a legitimate third-party application because explorer.exe is the standard parent for all user-launched programs.

Answer

The process indicates a Windows service misconfiguration that requires only a registry repair on the host.

Answer

This is a benign service host because svchost.exe is a legitimate Windows component and its presence alone is not suspicious.

Question 8

A CTI manager is conducting a review of the intelligence requirements after a major merger. The organization's priorities have shifted, and the manager must ensure that the collection efforts remain aligned with the new business objectives. Which of the following actions best ensures that the intelligence requirements continue to meet the evolving needs?

Accepted Answer

Reassess the Priority Intelligence Requirements (PIRs) with stakeholders from both merging entities.. The merger introduces new business objectives and risks, so the intelligence requirements must be revisited collaboratively. Reassessing PIRs with stakeholders from both entities ensures that the requirements capture the combined priorities and that collection efforts are directed toward what matters most. This approach aligns intelligence with decision-making needs and prevents wasted resources on irrelevant data.

Answer

Implement a new threat intelligence platform (TIP) to centralize all data.

Answer

Increase the frequency of automated threat feed ingestion to capture more data.

Answer

Delegate the review to the SOC manager to update tactical detection rules.

Question 9

You are building a threat intelligence program for a SOC and must define processes for the 'Direction' phase of the intelligence lifecycle. Which two activities belong to this phase? (Choose two.)

Accepted Answer

Translating stakeholder feedback into revised intelligence requirements. The Direction phase involves defining intelligence requirements and continuously refining them based on stakeholder feedback. Identifying PIRs and translating feedback into revised requirements are both about setting and adjusting the focus of the intelligence program. Collection, production, and dissemination are separate lifecycle phases that occur after Direction has established what is needed.

Answer

Collecting raw data from open source and commercial feeds based on the defined requirements

Answer

Disseminating finished intelligence reports to SOC analysts and executives

Answer

Producing finished intelligence reports with recommendations for decision makers

Question 10

You are the CTI lead at a hospital network. Your SOC receives a vendor report stating that a ransomware group is actively targeting healthcare providers in your region with a new encryptor. Your CISO asks what the FIRST action should be to convert this intelligence into operational value for the SOC. What do you do?

Accepted Answer

Map the reported TTPs to MITRE ATT&CK and check whether existing detections and controls cover them. Because the report describes adversary behavior rather than static indicators, the highest-value first move is to map those behaviors to ATT&CK and evaluate detection and control coverage. This converts strategic reporting into an actionable gap list, letting the SOC prioritize engineering work where the hospital is genuinely exposed. Blocking broad protocols or stale hashes does not address the described targeting pattern.

Answer

Immediately block all outbound SMB traffic at the perimeter firewall

Answer

Add every file hash mentioned in the report to the EDR blocklist and close the ticket

Answer

Escalate the report to the legal department and wait for their guidance before informing the SOC