312-85 Data Analysis — Timed 25 Questions

Question 1

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

25 minute time limit — choose an answer to begin.

Accepted Answer

$50,000. ALE is calculated as SLE × ARO, where SLE = Asset Value × Exposure Factor. Here, the impact I = $500,000 is the SLE, and the probability P = 0.2 is the ARO. Original ALE = 0.2 × $500,000 = $100,000. Reducing probability by 50% gives a new ARO of 0.1, so new ALE = 0.1 × $500,000 = $50,000.

Answer

$75,000

Answer

$100,000

Answer

$25,000

Question 2

You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?

Accepted Answer

Refine the evidence definitions to focus on the contradictory data points to assess if the hypothesis remains viable.. ACH methodology dictates that you should focus on evidence that disproves hypotheses rather than supports them. Finding contradictory evidence is more diagnostic than finding supporting evidence.

Answer

Consolidate the contradictory evidence into the supporting evidence category.

Answer

Discard the hypothesis immediately if any contradictory evidence exists.

Answer

Increase the weight of supporting evidence to balance the matrix.

Question 3

You are tasked with evaluating the validity of a threat intelligence report provided by an external vendor. You choose to use ACH. What is the very first step you must take before populating the matrix?

Accepted Answer

Formulate a list of possible hypotheses.. The first step in ACH is defining the research question or the problem statement clearly.

Answer

Identify the primary adversary.

Answer

Gather all relevant evidence logs.

Answer

Clearly define the problem or research question to be answered.

Question 4

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

Accepted Answer

Attack Surface Reduction. Attack Surface reduction through Least Privilege is a foundational technique in threat modeling aimed at minimizing the damage potential of a compromise.

Answer

Threat Vector Analysis

Answer

Risk Likelihood Assessment

Answer

Threat Actor Attribution

Question 5

You are using the 'Kill Chain' model to analyze an incident. The logs show the adversary successfully gained credentials via phishing. Which phase does this correlate to?

Accepted Answer

Delivery. Weaponization occurs first, but credential harvesting via phishing falls squarely into the Delivery/Exploitation phase of the Kill Chain.

Answer

Reconnaissance

Answer

Weaponization

Answer

Installation

Question 6

When performing quantitative analysis, which THREE of the following are necessary to calculate the Annualized Loss Expectancy (ALE)?

Accepted Answer

Single Loss Expectancy (SLE). The ALE formula is ALE = SLE × ARO, so Single Loss Expectancy (A) and Annualized Rate of Occurrence (B) are directly required to compute it. Asset Value (C) is also necessary because SLE itself is derived as Asset Value × Exposure Factor, meaning the asset value is an essential input for the calculation. Employee performance ratings (D) and total office space cost (E) are unrelated to risk quantification and play no role in the ALE formula.

Answer

Employee performance ratings.

Answer

Total cost of the organization's office space.

Question 7

A threat intelligence analyst is reviewing a PCAP file and notices that a compromised host is sending DNS queries for domains that are algorithmically generated, such as 'ajk3n2l4kj.com', 'pq8r7s6t5u.com', and 'zx1c2v3b4n.com'. The queries occur at regular intervals, and the responses are always NXDOMAIN except for one domain that resolves to an IP address. Which type of malware behavior is MOST likely indicated?

Accepted Answer

Domain generation algorithm (DGA) with a rendezvous point. The scenario describes a domain generation algorithm (DGA) where the malware generates many random domain names and queries them until one resolves. The attacker registers only a few of these domains as rendezvous points for command and control. This technique is used to evade domain blacklisting and makes it challenging for defenders to predict and block the C2 infrastructure. The regular intervals and mostly NXDOMAIN responses are characteristic of DGA behavior.

Answer

Domain generation algorithm (DGA) with a domain flux

Answer

Fast flux DNS

Answer

DNS tunneling

Question 8

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

Accepted Answer

Calculate the Z-score of the timestamp distribution.. The Z-score measures how many standard deviations a data point is from the mean, making it the appropriate statistical measure to determine if outliers are significant relative to the normal distribution. A high absolute Z-score (typically >3) indicates a statistically significant outlier that may warrant changes to threat modeling.

Answer

Apply the Mode of the frequency dataset.

Answer

Perform a simple Median split.

Answer

Use the Range calculation.

Question 9

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Accepted Answer

To ensure data compatibility for correlation and cross-source analysis.. Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.

Answer

To reduce the storage space required for logs.

Answer

To increase the ingestion speed of the SIEM.

Answer

To encrypt the logs for regulatory compliance.

Question 10

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Accepted Answer

Information Disclosure. Logging authentication tokens in plain text exposes sensitive credentials to anyone with log access, which is a direct violation of confidentiality — the defining concern of the Information Disclosure category in STRIDE. STRIDE's 'I' maps to confidentiality breaches, and plaintext token logging is a textbook example.

Answer

Elevation of Privilege

Answer

Tampering

Answer

Repudiation

Question 11

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

Accepted Answer

The hypothesis is the least likely to be correct given the current evidence set.. In an Analysis of Competing Hypotheses (ACH) matrix, each hypothesis is scored against diagnostic evidence. A low score means the hypothesis has more inconsistencies with the evidence (i.e., more evidence items are rated as inconsistent or not supporting it). Therefore, the hypothesis with the lowest score is the least likely to be correct given the current evidence set. This is the core principle of ACH: hypotheses that are most inconsistent with the evidence are rejected.

Answer

The hypothesis is the most likely scenario.

Answer

The hypothesis is heavily supported by available data.

Answer

The hypothesis lacks enough evidence to be evaluated.

Question 12

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Accepted Answer

Determine the Tactic and map the specific Technique ID.. MITRE ATT&CK is organized as a matrix of Tactics (the adversary's goal, e.g., Persistence, Defense Evasion) and Techniques (how the goal is achieved, e.g., T1574.002 DLL Side-Loading). To map an observation like DLL Side-Loading, the analyst identifies the relevant Tactic (Defense Evasion, and often Persistence or Privilege Escalation) and then maps the specific Technique ID. This is the standard analytical workflow for ATT&CK-based threat mapping.

Answer

Perform a Root Cause Analysis on the operating system.

Answer

Use the CVSS score of the DLL to prioritize the threat.

Answer

Calculate the frequency of the DLL calls to determine the actor intent.

Question 13

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

Accepted Answer

It enables the visualization of relationships between the four core components of an intrusion.. The Diamond Model of intrusion analysis organizes an intrusion into four core features: adversary, capability, infrastructure, and victim. Its primary benefit is that it visually maps the relationships among these components, helping analysts understand how an attack is structured and how different events are connected. This relational view supports threat intelligence correlation and hypothesis generation, which is why option A is correct.

Answer

It provides a vulnerability score for every asset.

Answer

It calculates the financial loss expectancy of a breach.

Answer

It replaces the need for SIEM log collection.

Question 14

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

Accepted Answer

The vulnerability has a high severity rating based on its characteristics.. CVSS scores represent the severity of a vulnerability, with higher scores indicating higher severity.

Answer

The vulnerability is currently being exploited in the wild.

Answer

The vulnerability affects only Windows systems.

Answer

The vulnerability is already patched.

Question 15

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

Accepted Answer

How changes in input variables affect the model's output.. Sensitivity Analysis is a modeling technique that determines how variation or uncertainty in input variables affects the model's output. In threat modeling, this means asking questions like: if the likelihood of a given threat increases by 20%, how does the overall risk score change? It identifies which inputs drive the model's conclusions and where uncertainty matters most, helping prioritize which assumptions to validate.

Answer

Whether the threat actor has successfully exfiltrated data.

Answer

The total number of threat actors targeting the organization.

Answer

The cryptographic strength of the data being protected.

Question 16

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

Accepted Answer

It helps filter out random 'noise' to highlight consistent temporal patterns.. A rolling average smooths short-term fluctuations in a time series, making underlying trends and periodic patterns more visible. In C2 beaconing detection, the signal is a consistent periodic callback (e.g., every 60 seconds) buried in noisy traffic, so smoothing highlights that regularity. This is a standard statistical technique for anomaly and pattern detection in security analytics.

Answer

It increases the absolute volume of the data collected.

Answer

It eliminates the need for further traffic inspection.

Answer

It encrypts the log data for safer analysis.

Question 17

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

Accepted Answer

Assuming historical trends will continue indefinitely without accounting for environmental shifts.. Extrapolating short-term patterns into long-term certainties is a common error in trend analysis.

Answer

Ignoring the total volume of data available.

Answer

Collecting too much data from different sources.

Answer

Using visual graphs to display the results.

Question 18

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Accepted Answer

Time-series analysis of IP resolution logs.. Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.

Answer

Vulnerability scanning.

Answer

Qualitative SWOT analysis.

Answer

Static analysis of the malware binary.

Question 19

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

Accepted Answer

Damage. DREAD is a risk assessment model with five factors: Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. The 'D' stands for Damage, which rates how severe the impact would be if the threat were realized.

Answer

Deployment

Answer

Detection

Answer

Data loss

Question 20

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Accepted Answer

A list of identified threats categorized by type.. Option A is correct because a threat model must document the identified threats themselves, typically categorized by type (for example STRIDE categories such as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege), so that each threat can be assessed and mitigated. Option B is correct because a detailed system architecture diagram (data flow diagrams, trust boundaries, entry points, and components) is a foundational artifact of threat modeling, providing the context needed to identify where threats apply. The remaining options are not essential components of a threat model: the security team's budget (C) is a financial/management detail, the IT employee handbook (D) is a policy document unrelated to modeling threats against a system, and a list of admin-access employees (E) is an access-control inventory rather than a threat model component.

Answer

The budget allocated for the security team.

Answer

The employee handbook for the IT department.

Answer

A list of all employees with admin access.