312-85 Data Analysis — Timed 25 Questions

Question 1

You are tasked with evaluating the validity of a threat intelligence report provided by an external vendor. You choose to use ACH. What is the very first step you must take before populating the matrix?

25 minute time limit — choose an answer to begin.

Accepted Answer

Formulate a list of possible hypotheses.. The first step in ACH is defining the research question or the problem statement clearly.

Answer

Identify the primary adversary.

Answer

Gather all relevant evidence logs.

Answer

Clearly define the problem or research question to be answered.

Question 2

You are using the 'Kill Chain' model to analyze an incident. The logs show the adversary successfully gained credentials via phishing. Which phase does this correlate to?

Accepted Answer

Delivery. Weaponization occurs first, but credential harvesting via phishing falls squarely into the Delivery/Exploitation phase of the Kill Chain.

Answer

Reconnaissance

Answer

Weaponization

Answer

Installation

Question 3

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

Accepted Answer

Calculate the Z-score of the timestamp distribution.. Standard deviation or Z-score is used to determine how many standard deviations an observation is from the mean.

Answer

Apply the Mode of the frequency dataset.

Answer

Perform a simple Median split.

Answer

Use the Range calculation.

Question 4

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. ALE = SLE x ARO. Since ALE = Probability x Impact, original ALE = 0.2 x $500,000 = $100,000. New probability is 0.1. 0.1 x $500,000 = $50,000.

Answer

$75,000

Answer

$100,000

Answer

$25,000

Question 5

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Accepted Answer

To ensure data compatibility for correlation and cross-source analysis.. Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.

Answer

To reduce the storage space required for logs.

Answer

To increase the ingestion speed of the SIEM.

Answer

To encrypt the logs for regulatory compliance.

Question 6

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Accepted Answer

Information Disclosure. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Plain text logging of tokens is a classic Information Disclosure vulnerability.

Answer

Elevation of Privilege

Answer

Tampering

Answer

Repudiation

Question 7

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

Accepted Answer

The hypothesis is the least likely to be correct given the current evidence set.. In ACH, lower scores in the matrix often indicate that the evidence strongly contradicts the hypothesis.

Answer

The hypothesis is the most likely scenario.

Answer

The hypothesis is heavily supported by available data.

Answer

The hypothesis lacks enough evidence to be evaluated.

Question 8

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Accepted Answer

Determine the Tactic and map the specific Technique ID.. Mapping involves identifying the Technique ID (T1574.002) and analyzing it within the context of the observed execution flow.

Answer

Perform a Root Cause Analysis on the operating system.

Answer

Use the CVSS score of the DLL to prioritize the threat.

Answer

Calculate the frequency of the DLL calls to determine the actor intent.

Question 9

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

Accepted Answer

It enables the visualization of relationships between the four core components of an intrusion.. The Diamond Model links the Adversary, Capability, Infrastructure, and Victim, providing a holistic view of the event.

Answer

It provides a vulnerability score for every asset.

Answer

It calculates the financial loss expectancy of a breach.

Answer

It replaces the need for SIEM log collection.

Question 10

You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?

Accepted Answer

Refine the evidence definitions to focus on the contradictory data points to assess if the hypothesis remains viable.. ACH methodology dictates that you should focus on evidence that disproves hypotheses rather than supports them. Finding contradictory evidence is more diagnostic than finding supporting evidence.

Answer

Consolidate the contradictory evidence into the supporting evidence category.

Answer

Discard the hypothesis immediately if any contradictory evidence exists.

Answer

Increase the weight of supporting evidence to balance the matrix.

Question 11

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

Accepted Answer

Attack Surface Reduction. Attack Surface reduction through Least Privilege is a foundational technique in threat modeling aimed at minimizing the damage potential of a compromise.

Answer

Threat Vector Analysis

Answer

Risk Likelihood Assessment

Answer

Threat Actor Attribution

Question 12

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

Accepted Answer

The vulnerability has a high severity rating based on its characteristics.. CVSS scores represent the severity of a vulnerability, with higher scores indicating higher severity.

Answer

The vulnerability is currently being exploited in the wild.

Answer

The vulnerability affects only Windows systems.

Answer

The vulnerability is already patched.

Question 13

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

Accepted Answer

How changes in input variables affect the model's output.. Sensitivity analysis determines how changes in individual input variables (like threat probability or asset value) impact the overall final output or risk calculation.

Answer

Whether the threat actor has successfully exfiltrated data.

Answer

The total number of threat actors targeting the organization.

Answer

The cryptographic strength of the data being protected.

Question 14

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

Accepted Answer

It helps filter out random 'noise' to highlight consistent temporal patterns.. Rolling averages help identify underlying trends in noisy data, making periodic beaconing patterns more visible.

Answer

It increases the absolute volume of the data collected.

Answer

It eliminates the need for further traffic inspection.

Answer

It encrypts the log data for safer analysis.

Question 15

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

Accepted Answer

Assuming historical trends will continue indefinitely without accounting for environmental shifts.. Extrapolating short-term patterns into long-term certainties is a common error in trend analysis.

Answer

Ignoring the total volume of data available.

Answer

Collecting too much data from different sources.

Answer

Using visual graphs to display the results.

Question 16

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Accepted Answer

Time-series analysis of IP resolution logs.. Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.

Answer

Vulnerability scanning.

Answer

Qualitative SWOT analysis.

Answer

Static analysis of the malware binary.

Question 17

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

Accepted Answer

Damage. DREAD stands for Damage, Reproducibility, Exploitability, Affected users, and Discoverability.

Answer

Deployment

Answer

Detection

Answer

Data loss

Question 18

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Accepted Answer

A list of identified threats categorized by type.. Documentation must define the scope of the system and the potential threats identified against that scope.

Answer

The budget allocated for the security team.

Answer

The employee handbook for the IT department.

Answer

A list of all employees with admin access.

Question 19

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Accepted Answer

Systematically testing evidence against every hypothesis.. Mitigating bias involves systematically analyzing evidence for all hypotheses and consciously searching for disconfirming information.

Answer

Assigning weights based on personal intuition.

Answer

Focusing only on the evidence that supports your primary theory.

Answer

Limiting the number of hypotheses to one.

Question 20

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Accepted Answer

The timeliness of the intelligence.. Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.

Answer

The size of the vendor's marketing department.

Answer

The format of the document (PDF vs CSV).