312-85 Data Analysis Practice Test 2 — 15 Questions

Question 1

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It helps filter out random 'noise' to highlight consistent temporal patterns.. A rolling average smooths short-term fluctuations in a time series, making underlying trends and periodic patterns more visible. In C2 beaconing detection, the signal is a consistent periodic callback (e.g., every 60 seconds) buried in noisy traffic, so smoothing highlights that regularity. This is a standard statistical technique for anomaly and pattern detection in security analytics.

Answer

It increases the absolute volume of the data collected.

Answer

It eliminates the need for further traffic inspection.

Answer

It encrypts the log data for safer analysis.

Question 2

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

Accepted Answer

Assuming historical trends will continue indefinitely without accounting for environmental shifts.. Extrapolating short-term patterns into long-term certainties is a common error in trend analysis.

Answer

Ignoring the total volume of data available.

Answer

Collecting too much data from different sources.

Answer

Using visual graphs to display the results.

Question 3

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Accepted Answer

Time-series analysis of IP resolution logs.. Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.

Answer

Vulnerability scanning.

Answer

Qualitative SWOT analysis.

Answer

Static analysis of the malware binary.

Question 4

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

Accepted Answer

Damage. DREAD is a risk assessment model with five factors: Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. The 'D' stands for Damage, which rates how severe the impact would be if the threat were realized.

Answer

Deployment

Answer

Detection

Answer

Data loss

Question 5

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Accepted Answer

A list of identified threats categorized by type.. Option A is correct because a threat model must document the identified threats themselves, typically categorized by type (for example STRIDE categories such as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege), so that each threat can be assessed and mitigated. Option B is correct because a detailed system architecture diagram (data flow diagrams, trust boundaries, entry points, and components) is a foundational artifact of threat modeling, providing the context needed to identify where threats apply. The remaining options are not essential components of a threat model: the security team's budget (C) is a financial/management detail, the IT employee handbook (D) is a policy document unrelated to modeling threats against a system, and a list of admin-access employees (E) is an access-control inventory rather than a threat model component.

Answer

The budget allocated for the security team.

Answer

The employee handbook for the IT department.

Answer

A list of all employees with admin access.

Question 6

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Accepted Answer

Systematically testing evidence against every hypothesis.. Option A is correct because ACH requires evaluating each piece of evidence against all competing hypotheses in a matrix, which exposes inconsistencies and prevents premature anchoring on a favored theory. Option D is correct because ACH emphasizes disconfirmation—actively seeking evidence that refutes a hypothesis—since a single credible disconfirming item can eliminate a hypothesis more decisively than confirming evidence can support it. Options B, C, and E are incorrect: weighting by personal intuition reintroduces the very bias ACH is designed to counter, focusing only on supporting evidence is confirmation bias, and limiting analysis to a single hypothesis defeats the comparative purpose of ACH.

Answer

Assigning weights based on personal intuition.

Answer

Focusing only on the evidence that supports your primary theory.

Answer

Limiting the number of hypotheses to one.

Question 7

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Accepted Answer

The timeliness of the intelligence.. Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.

Answer

The size of the vendor's marketing department.

Answer

The format of the document (PDF vs CSV).

Question 8

When analyzing network traffic for C2 communication, which THREE anomalies are common indicators of malicious activity?

Accepted Answer

Unexpected use of common protocols like DNS or HTTP/S for data exfiltration.. Option C is correct because attackers frequently abuse ubiquitous, allowed protocols such as DNS tunneling or HTTP/S POST requests to blend exfiltration into normal traffic, so unexpected use of these protocols for data transfer is a classic C2 anomaly. Option D is correct because malware beacons often call back at fixed, high-frequency intervals (e.g., every 60 seconds) to receive commands, and such regular periodicity is rare in legitimate user-driven traffic. Option E is correct because connections to known malicious infrastructure or newly registered domains are strong threat-intelligence indicators of C2, since legitimate services rarely rely on freshly created domains. Option A does not belong because standard web browsing during working hours is expected baseline activity, not an anomaly. Option B does not belong because high-volume internal server traffic is typically normal east-west data center communication rather than a C2 indicator.

Answer

Standard web browsing traffic during working hours.

Answer

High volume of legitimate internal server traffic.

Question 9

Which TWO methods are effective for visualizing threat actor TTPs within a CTI report?

Accepted Answer

Flow diagrams illustrating the attack execution sequence.. Option D is correct because flow diagrams (e.g., attack trees or sequence diagrams) map the ordered execution of adversary tactics, techniques, and procedures, making the attack chain and dependencies between steps immediately understandable to analysts and decision-makers. Option E is correct because heat maps aggregate TTP frequency or coverage data into a visual density representation, letting readers quickly spot the most prevalent or least-defended techniques across a campaign or sector. Both visualizations align with CTI reporting goals of conveying behavioral patterns rather than isolated artifacts. Option A does not belong because a bibliography is a reference list, not a visualization of TTPs. Option B does not belong because a photograph of a threat actor provides no technical insight into their tradecraft and is often unavailable or unreliable. Option C does not belong because a raw list of every log entry is unstructured telemetry, not a visualization, and would obscure rather than reveal TTP patterns.

Answer

A bibliography of all external sources.

Answer

A photograph of the threat actor.

Answer

A raw list of every log entry captured.

Question 10

Which TWO of the following are primary goals of conducting a threat modeling exercise on a new software application?

Accepted Answer

To define security requirements based on the risk profile.. Option C is correct because threat modeling is performed early in the SDLC to derive and prioritize security requirements (e.g., authentication, authorization, input validation, encryption) directly from the identified threats and the application's risk profile, ensuring controls are proportionate to risk. Option E is correct because the core purpose of threat modeling is to proactively identify potential security flaws, attack vectors, and design weaknesses (using frameworks like STRIDE or attack trees) before code is written or deployed, when remediation is cheapest. Option A is incorrect because a marketing brochure is a promotional artifact unrelated to security analysis. Option B is incorrect because UI standards concern usability and design consistency, not threat identification or risk-based security requirements. Option D is incorrect because threat modeling complements, but never replaces, automated unit testing, which verifies code-level correctness and behavior.

Answer

To provide a complete marketing brochure for the software.

Answer

To ensure the software meets the latest UI standards.

Answer

To replace the need for automated unit testing.

Question 11

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

Accepted Answer

Sensitive file access and data movement tracking.. Insider threats are detected via access logs, file activity, and network communication patterns.

Answer

Employee cafeteria transaction history.

Answer

Public internet speed test results.

Question 12

You are analyzing an intrusion set and need to assess how consistently a specific adversary group has targeted your industry over the past 18 months. You have a feed of 4,200 indicators, but 3,100 of them are domain names that resolve to shared CDN infrastructure used by thousands of legitimate sites. Which structured analytic technique is MOST appropriate to reduce this noise before you draw conclusions about targeting patterns?

Accepted Answer

Apply pivoting on the shared infrastructure to cluster indicators by hosting ASN, then filter clusters that also contain non-targeted victim domains.. The scenario requires separating adversary-specific infrastructure from commodity shared hosting before analyzing targeting patterns. Pivoting on hosting ASN and filtering clusters that contain non-targeted victims directly addresses that requirement by removing indicators with low discriminative value. The other techniques either fail to reduce CDN noise, introduce resolution artifacts, or artificially inflate confidence without improving data quality.

Answer

Convert the domain indicators to IP addresses using current passive DNS and re-run the frequency count.

Answer

Increase the confidence rating on all indicators from the feed because the feed is a commercial source.

Answer

Run all 4,200 indicators through a sandbox and retain only those that trigger a malicious verdict.

Question 13

A junior analyst presents a chart showing that malware detections in your environment dropped 40 percent after a new endpoint agent was deployed. You suspect the chart is misleading because the agent only covers Windows servers, while the previous agent covered servers and workstations. Which analytic step should you take FIRST to validate whether the apparent drop is real?

Accepted Answer

Recalculate the detection rate using only Windows servers for both the pre-deployment and post-deployment periods.. Before drawing conclusions from a trend, the analyst must ensure the compared populations are equivalent. Because the new agent covers only Windows servers while the old agent covered more endpoint types, the raw detection drop is confounded by scope. Normalizing to Windows servers for both periods is the necessary first step to determine whether the decline is real.

Answer

Extend the post-deployment observation window to twelve months to smooth out short-term variance.

Answer

Ask the endpoint agent vendor to confirm that the new agent has a higher detection efficacy than the previous one.

Answer

Apply a statistical significance test to the raw 40 percent drop to determine whether it is meaningful.

Question 14

During a threat intelligence analysis, you are examining a large dataset of network flow records. You notice a significant number of outbound connections from internal hosts to a known malicious IP address on port 443, but the connections are short-lived and occur at regular intervals. Which of the following best describes the adversary behavior you are observing?

Accepted Answer

Command-and-control beaconing. The pattern of regular, short-lived outbound connections to a known malicious IP on port 443 is a strong indicator of command-and-control beaconing. Malware beacons at set intervals to receive commands and maintain communication with the attacker. This behavior is often designed to mimic normal HTTPS traffic to avoid detection, but the periodic nature and short duration are telltale signs.

Answer

Port scanning of external targets

Answer

Data exfiltration over HTTPS

Answer

DNS tunneling for data exfiltration

Question 15

You are building a link analysis chart to map an intrusion set's operational infrastructure. You have collected domain registrations, malware sample hashes, and command-and-control IP addresses, but you need to select additional data elements that will produce meaningful links rather than coincidental ones. (Choose two.)

Accepted Answer

Passive DNS resolution history showing which domains resolved to the same C2 IP within the campaign window.. Meaningful links in infrastructure analysis require artifacts with low base rates and temporal alignment to the campaign. TLS certificate serials and issuer strings are reused by adversaries across C2 servers, and passive DNS history connects domains to C2 IPs within the campaign window. Both produce defensible clusters, unlike shared privacy WHOIS addresses, coarse geolocation, or aggregate detection counts.

Answer

The total number of malware detections reported for each hash across all customers of your antivirus vendor.

Answer

The geographic country of the IP addresses based solely on a commercial geolocation database.

Answer

The registrar's generic WHOIS privacy email address used by thousands of unrelated domains.