312-85 Data Analysis — 10 Questions

Question 1

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$50,000. ALE is calculated as SLE × ARO, where SLE = Asset Value × Exposure Factor. Here, the impact I = $500,000 is the SLE, and the probability P = 0.2 is the ARO. Original ALE = 0.2 × $500,000 = $100,000. Reducing probability by 50% gives a new ARO of 0.1, so new ALE = 0.1 × $500,000 = $50,000.

Answer

$75,000

Answer

$100,000

Answer

$25,000

Question 2

You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?

Accepted Answer

Refine the evidence definitions to focus on the contradictory data points to assess if the hypothesis remains viable.. ACH methodology dictates that you should focus on evidence that disproves hypotheses rather than supports them. Finding contradictory evidence is more diagnostic than finding supporting evidence.

Answer

Consolidate the contradictory evidence into the supporting evidence category.

Answer

Discard the hypothesis immediately if any contradictory evidence exists.

Answer

Increase the weight of supporting evidence to balance the matrix.

Question 3

You are tasked with evaluating the validity of a threat intelligence report provided by an external vendor. You choose to use ACH. What is the very first step you must take before populating the matrix?

Accepted Answer

Formulate a list of possible hypotheses.. The first step in ACH is defining the research question or the problem statement clearly.

Answer

Identify the primary adversary.

Answer

Gather all relevant evidence logs.

Answer

Clearly define the problem or research question to be answered.

Question 4

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

Accepted Answer

Attack Surface Reduction. Attack Surface reduction through Least Privilege is a foundational technique in threat modeling aimed at minimizing the damage potential of a compromise.

Answer

Threat Vector Analysis

Answer

Risk Likelihood Assessment

Answer

Threat Actor Attribution

Question 5

You are using the 'Kill Chain' model to analyze an incident. The logs show the adversary successfully gained credentials via phishing. Which phase does this correlate to?

Accepted Answer

Delivery. Weaponization occurs first, but credential harvesting via phishing falls squarely into the Delivery/Exploitation phase of the Kill Chain.

Answer

Reconnaissance

Answer

Weaponization

Answer

Installation

Question 6

When performing quantitative analysis, which THREE of the following are necessary to calculate the Annualized Loss Expectancy (ALE)?

Accepted Answer

Single Loss Expectancy (SLE). The ALE formula is ALE = SLE × ARO, so Single Loss Expectancy (A) and Annualized Rate of Occurrence (B) are directly required to compute it. Asset Value (C) is also necessary because SLE itself is derived as Asset Value × Exposure Factor, meaning the asset value is an essential input for the calculation. Employee performance ratings (D) and total office space cost (E) are unrelated to risk quantification and play no role in the ALE formula.

Answer

Employee performance ratings.

Answer

Total cost of the organization's office space.

Question 7

A threat intelligence analyst is reviewing a PCAP file and notices that a compromised host is sending DNS queries for domains that are algorithmically generated, such as 'ajk3n2l4kj.com', 'pq8r7s6t5u.com', and 'zx1c2v3b4n.com'. The queries occur at regular intervals, and the responses are always NXDOMAIN except for one domain that resolves to an IP address. Which type of malware behavior is MOST likely indicated?

Accepted Answer

Domain generation algorithm (DGA) with a rendezvous point. The scenario describes a domain generation algorithm (DGA) where the malware generates many random domain names and queries them until one resolves. The attacker registers only a few of these domains as rendezvous points for command and control. This technique is used to evade domain blacklisting and makes it challenging for defenders to predict and block the C2 infrastructure. The regular intervals and mostly NXDOMAIN responses are characteristic of DGA behavior.

Answer

Domain generation algorithm (DGA) with a domain flux

Answer

Fast flux DNS

Answer

DNS tunneling

Question 8

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

Accepted Answer

Calculate the Z-score of the timestamp distribution.. The Z-score measures how many standard deviations a data point is from the mean, making it the appropriate statistical measure to determine if outliers are significant relative to the normal distribution. A high absolute Z-score (typically >3) indicates a statistically significant outlier that may warrant changes to threat modeling.

Answer

Apply the Mode of the frequency dataset.

Answer

Perform a simple Median split.

Answer

Use the Range calculation.

Question 9

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Accepted Answer

To ensure data compatibility for correlation and cross-source analysis.. Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.

Answer

To reduce the storage space required for logs.

Answer

To increase the ingestion speed of the SIEM.

Answer

To encrypt the logs for regulatory compliance.

Question 10

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Accepted Answer

Information Disclosure. Logging authentication tokens in plain text exposes sensitive credentials to anyone with log access, which is a direct violation of confidentiality — the defining concern of the Information Disclosure category in STRIDE. STRIDE's 'I' maps to confidentiality breaches, and plaintext token logging is a textbook example.

Answer

Elevation of Privilege

Answer

Tampering

Answer

Repudiation