312-85 Data Analysis Practice Test 3 — 15 Questions

Question 1

You are an analyst at a financial services firm. Your team has collected a large set of indicators of compromise (IOCs) from an open-source feed. Before integrating them into your SIEM for automated blocking, you need to perform data enrichment. Which of the following best describes the primary goal of enriching these IOCs with contextual data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

To add context such as geolocation, WHOIS, and reputation to assess relevance and priority.. Enrichment adds context such as geolocation, WHOIS, and reputation to raw IOCs. This context allows analysts to assess relevance and priority, which is essential before integrating indicators into automated systems. In a financial services firm, blocking an IOC without understanding its context could disrupt legitimate transactions or customers, so enrichment is a critical step.

Answer

To convert all indicators into a standardized format like STIX.

Answer

To automatically block all indicators without human review.

Answer

To increase the total number of indicators available for detection.

Question 2

You are reviewing a threat intelligence report that includes an indicator of compromise (IoC) in the form of a file hash. The report states that the hash is 'SHA-256: 8f14e45fceea167a5a36dedd4bea2543...'. What is the primary purpose of including this hash in the report?

Accepted Answer

To provide a unique identifier for the malicious file that can be used for detection and blocking. Including a SHA-256 hash in a threat intelligence report provides a unique identifier for the malicious file. Security tools can use this hash to detect and block the file across systems, and it can be shared with other organizations for collaborative defense. Hashes are precise and difficult to forge, making them reliable IoCs.

Answer

To indicate the severity of the threat based on the hash value

Answer

To serve as a password for accessing the file in a sandbox

Answer

To decrypt the malicious file for further analysis

Question 3

You are analyzing a malware sample that communicates with a command-and-control (C2) server. The network traffic shows periodic HTTP GET requests to a domain that resolves to multiple IP addresses, and the User-Agent string is identical across all requests. Which of the following analytical techniques would best help you identify the infrastructure and potential attribution of the threat actor?

Accepted Answer

Passive DNS analysis to map historical domain-to-IP resolutions.. Passive DNS analysis provides historical mappings of domain-to-IP resolutions, which is essential when a domain resolves to multiple IPs. This helps identify infrastructure patterns like fast flux and can link to other domains used by the same actor. It supports attribution by revealing the broader C2 infrastructure, which is more valuable than static or dynamic analysis alone in this scenario.

Answer

Reviewing the User-Agent string against known malware families.

Answer

Sandbox execution to observe the malware's behavior in a controlled environment.

Answer

Static malware analysis to extract embedded strings and configuration.

Question 4

During a malware analysis engagement, you receive a sample whose import table references the Windows API functions VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. Which analytical conclusion is best supported by this evidence?

Accepted Answer

The sample is likely performing process injection into another process.. The three imported functions describe writing code into another process and starting a thread there, which is the definition of remote process injection. Static imports indicate capability rather than confirmed execution, so the analyst should pair this finding with dynamic evidence such as API call traces or memory scans before finalizing attribution or intent.

Answer

The sample is likely exfiltrating data over an encrypted channel.

Answer

The sample is likely establishing persistence through a registry Run key.

Answer

The sample is likely encrypting files on the local disk for ransom.

Question 5

You are analyzing a Linux server that is suspected of being compromised. You observe a process named 'kworker' that is consuming high CPU, but when you check the parent process ID (PPID), it is 1 (init). Which of the following is the most likely explanation for this observation?

Accepted Answer

The process is a malicious user-space process masquerading as a kernel thread. A process named 'kworker' with a PPID of 1 and high CPU usage is likely a malicious process masquerading as a kernel thread. Genuine kernel worker threads have a PPID of 2 (kthreadd) and are not user-space processes. Attackers use such names to evade detection, and the high CPU could indicate cryptomining or other malicious activity.

Answer

The process is a legitimate user application that has been reparented to init after its parent terminated

Answer

The process is a result of a kernel module loading incorrectly

Answer

The process is a legitimate kernel worker thread

Question 6

You are a threat intelligence analyst at a healthcare organization. Your team is developing a threat model for a new telemedicine platform. You need to identify potential threat actors and their capabilities. Which two of the following factors are most critical to consider when assessing threat actor intent and capability? (Choose two.)

Accepted Answer

The actor's known tactics, techniques, and procedures (TTPs).. Assessing threat actor intent and capability requires understanding their TTPs and their financial resources and sponsorship. TTPs reveal how they operate and what techniques they might use against the telemedicine platform. Financial resources and sponsorship indicate their ability to sustain campaigns and acquire advanced tools. These factors directly inform the threat model, unlike organizational characteristics such as employee count or revenue.

Answer

The organization's annual revenue.

Answer

The number of employees in the organization.

Answer

The geographic location of the organization's data centers.

Question 7

You are conducting a threat intelligence analysis on a recent cyber espionage campaign. You have collected various data points and need to assess the credibility of the intelligence. Which two of the following factors are most critical in evaluating the reliability of the threat data? (Choose two.)

Accepted Answer

The source of the intelligence and its historical accuracy. The reliability of threat intelligence is primarily evaluated by the credibility of its source and the consistency of the data with other independent sources. Source reliability, including historical accuracy, and information credibility, such as technical depth and corroboration, are core principles of intelligence analysis, as codified in the Admiralty Code.

Answer

The number of times the intelligence has been shared on social media

Answer

The formatting and presentation style of the threat report

Answer

The color scheme used in the report's visualizations

Question 8

You are reviewing a large NetFlow data set and observe an internal workstation sending 40-byte UDP packets to a single external IP address every 60 seconds for several days, with almost no return traffic. Which analytic interpretation is most appropriate?

Accepted Answer

This pattern is consistent with command-and-control beaconing and warrants endpoint and DNS investigation.. Fixed-interval, low-volume, unidirectional traffic to a single external host is a textbook beaconing indicator in network flow analysis. The analyst should pivot to DNS logs, endpoint process data, and destination reputation to determine whether the traffic is authorized software or an implanted controller channel before escalating or closing the lead.

Answer

This pattern is consistent with a distributed denial-of-service attack originating from the workstation.

Answer

This pattern is consistent with a misconfigured NTP client and requires no further action.

Answer

This pattern is consistent with normal software update polling and can be dismissed as benign.

Question 9

A SOC analyst is building a hypothesis set to explain a suspected data exfiltration event. She creates five mutually exclusive hypotheses and then scores each piece of evidence for consistency with every hypothesis. After scoring, she notices that one hypothesis has the highest total consistency score, but the evidence is sparse and several items are ambiguous. What should she do before finalizing her assessment?

Accepted Answer

Evaluate the diagnosticity and weight of each evidence item, and document uncertainty before finalizing the assessment.. Analysis of Competing Hypotheses requires more than summing consistency scores. The analyst must judge how diagnostic each piece of evidence is, meaning how well it discriminates among the hypotheses. Evidence consistent with nearly all hypotheses carries little weight. By evaluating diagnosticity, weighting evidence, and documenting uncertainty, the analyst produces a defensible conclusion that reflects the actual strength of the intelligence rather than a misleading total.

Answer

Add more hypotheses until the highest-scoring one has a clearly dominant score.

Answer

Immediately select the highest-scoring hypothesis as the conclusion and write the report.

Answer

Discard the matrix and rely on the analyst's intuition because the evidence is incomplete.

Question 10

You are reviewing a threat intelligence report that includes a list of indicators. You notice that one indicator is an IP address with a low confidence score. According to best practices, what should you do before using this indicator for detection?

Accepted Answer

Correlate the indicator with other sources to increase confidence.. Before using a low-confidence indicator, analysts should correlate it with other sources to validate its maliciousness and increase confidence. This step reduces false positives and ensures that any subsequent actions, such as blocking, are justified. It is a core practice in threat intelligence to avoid acting on unverified data.

Answer

Discard the indicator because it is not reliable.

Answer

Immediately block the IP address at the firewall.

Answer

Add the indicator to a watchlist for manual review only.

Question 11

An analyst is enriching indicators of compromise before publishing them for detection engineering. Which action best reflects sound intelligence preparation for an IP address indicator?

Accepted Answer

Record the IP with a confidence rating, a first-seen and last-seen timestamp, and context describing the associated campaign.. Indicators are perishable and only useful when accompanied by confidence, observation windows, and campaign context, which allow consumers to assess relevance and lifetime. Recording first-seen and last-seen times in particular enables retrospective hunting and prevents stale blocking rules from persisting long after the adversary has moved infrastructure.

Answer

Convert the IP address into a hash so it can be matched against endpoint detection rules.

Answer

Publish the raw IP address alone so consumers can block it immediately without further processing.

Answer

Escalate the IP directly to the incident response team as a confirmed compromise indicator.

Question 12

A threat intelligence team is correlating indicators from multiple feeds. They observe that a set of domain names resolves to fast-flux IP addresses, the domains were registered within the last 48 hours, and the same SSL certificate serial number appears across several unrelated domains. Which analytic conclusion is best supported by this evidence?

Accepted Answer

The infrastructure is likely adversary-controlled and may be used for malware command-and-control or phishing.. The convergence of fast-flux DNS, newly registered domains, and shared certificate serials across unrelated domains is a recognized pattern of adversary-controlled infrastructure. Each indicator alone can have benign explanations, but together they strongly suggest malicious intent. The analyst should treat these domains as suspicious, enrich them with passive DNS and WHOIS data, and consider blocking or monitoring while continuing to validate the assessment.

Answer

The domains are part of a legitimate content delivery network with high availability requirements.

Answer

The domains are compromised legitimate sites being used as watering holes.

Answer

The shared certificate serial number proves the domains are owned by a single legitimate organization.

Question 13

You are analyzing a large set of security events to identify patterns of malicious activity. You decide to use a pivot table to summarize the data by source IP and event type. Which of the following is the primary benefit of using pivot tables in threat data analysis?

Accepted Answer

They allow quick summarization and cross-tabulation of large datasets to reveal patterns.. Pivot tables allow analysts to quickly summarize and cross-tabulate large datasets, revealing patterns and relationships between variables such as source IP and event type. This helps in threat hunting by making it easier to spot anomalies and prioritize investigations. They are a fundamental tool for exploratory data analysis in threat intelligence.

Answer

They encrypt sensitive data to ensure compliance.

Answer

They automatically detect and block malicious IP addresses.

Answer

They provide real-time streaming analytics for continuous monitoring.

Question 14

You are correlating host and network telemetry after an intrusion and need to establish which account was used to move laterally between servers. Which two data sources are most directly useful for this determination? (Choose two.)

Accepted Answer

Authentication logs from the centralized directory service showing which accounts authenticated and from which hosts.. Establishing which account moved laterally requires authentication records from both endpoints and the directory service, because each captures the account-to-source relationship from a different vantage point. Correlating endpoint logon events with centralized authentication logs lets the analyst reconstruct the sequence of hosts and confirm the credential involved.

Answer

Full packet captures of encrypted administrative sessions retained for the entire incident window.

Answer

Vulnerability scan results for the affected servers collected during the previous quarter.

Answer

Asset inventory records listing the operating system and owner of each server.

Question 15

A threat intelligence analyst is preparing to analyze a large set of intrusion artifacts collected from multiple sensors. She wants to apply structured analysis techniques to reduce bias and improve the defensibility of her conclusions. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

Analysis of Competing Hypotheses to evaluate alternative explanations against evidence.. Structured analytic techniques such as Analysis of Competing Hypotheses and Key Assumptions Check are designed to reduce cognitive bias and make reasoning transparent. ACH forces consideration of alternative explanations and highlights diagnostic evidence, while a Key Assumptions Check exposes the beliefs that underpin interpretation. Together they provide a defensible, repeatable foundation for analyzing large artifact sets and communicating conclusions to decision-makers.

Answer

Devil's Advocacy to argue the opposite of the prevailing view regardless of evidence.

Answer

Timeline analysis to sequence events chronologically without assessing causality.

Answer

Brainstorming to generate as many ideas as possible without evaluating them.