312-85 Data Analysis — 10 Questions

Question 1

You are tasked with evaluating the validity of a threat intelligence report provided by an external vendor. You choose to use ACH. What is the very first step you must take before populating the matrix?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Formulate a list of possible hypotheses.. The first step in ACH is defining the research question or the problem statement clearly.

Answer

Identify the primary adversary.

Answer

Gather all relevant evidence logs.

Answer

Clearly define the problem or research question to be answered.

Question 2

You are using the 'Kill Chain' model to analyze an incident. The logs show the adversary successfully gained credentials via phishing. Which phase does this correlate to?

Accepted Answer

Delivery. Weaponization occurs first, but credential harvesting via phishing falls squarely into the Delivery/Exploitation phase of the Kill Chain.

Answer

Reconnaissance

Answer

Weaponization

Answer

Installation

Question 3

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

Accepted Answer

Calculate the Z-score of the timestamp distribution.. Standard deviation or Z-score is used to determine how many standard deviations an observation is from the mean.

Answer

Apply the Mode of the frequency dataset.

Answer

Perform a simple Median split.

Answer

Use the Range calculation.

Question 4

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. ALE = SLE x ARO. Since ALE = Probability x Impact, original ALE = 0.2 x $500,000 = $100,000. New probability is 0.1. 0.1 x $500,000 = $50,000.

Answer

$75,000

Answer

$100,000

Answer

$25,000

Question 5

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Accepted Answer

To ensure data compatibility for correlation and cross-source analysis.. Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.

Answer

To reduce the storage space required for logs.

Answer

To increase the ingestion speed of the SIEM.

Answer

To encrypt the logs for regulatory compliance.

Question 6

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Accepted Answer

Information Disclosure. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Plain text logging of tokens is a classic Information Disclosure vulnerability.

Answer

Elevation of Privilege

Answer

Tampering

Answer

Repudiation

Question 7

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

Accepted Answer

The hypothesis is the least likely to be correct given the current evidence set.. In ACH, lower scores in the matrix often indicate that the evidence strongly contradicts the hypothesis.

Answer

The hypothesis is the most likely scenario.

Answer

The hypothesis is heavily supported by available data.

Answer

The hypothesis lacks enough evidence to be evaluated.

Question 8

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Accepted Answer

Determine the Tactic and map the specific Technique ID.. Mapping involves identifying the Technique ID (T1574.002) and analyzing it within the context of the observed execution flow.

Answer

Perform a Root Cause Analysis on the operating system.

Answer

Use the CVSS score of the DLL to prioritize the threat.

Answer

Calculate the frequency of the DLL calls to determine the actor intent.

Question 9

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

Accepted Answer

It enables the visualization of relationships between the four core components of an intrusion.. The Diamond Model links the Adversary, Capability, Infrastructure, and Victim, providing a holistic view of the event.

Answer

It provides a vulnerability score for every asset.

Answer

It calculates the financial loss expectancy of a breach.

Answer

It replaces the need for SIEM log collection.

Question 10

You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?

Accepted Answer

Refine the evidence definitions to focus on the contradictory data points to assess if the hypothesis remains viable.. ACH methodology dictates that you should focus on evidence that disproves hypotheses rather than supports them. Finding contradictory evidence is more diagnostic than finding supporting evidence.

Answer

Consolidate the contradictory evidence into the supporting evidence category.

Answer

Discard the hypothesis immediately if any contradictory evidence exists.

Answer

Increase the weight of supporting evidence to balance the matrix.