312-85 Data Collection And Processing — 15 Questions

Question 1

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Accepted Answer

valid_from. In STIX 2.1, the Indicator SDO's required properties are 'pattern' (option E), which holds the detection expression such as a STIX Patterning string, and 'valid_from' (option A), a timestamp marking when the indicator is considered valid; both are mandatory fields of the object. 'confidence' (option B) is also a defined property of the Indicator object, expressed as an integer 0-100 (or the Low/Medium/High enum in some contexts) to convey the producer's certainty, making it a key component. The other options do not belong: 'firewall_acl_rule' (option C) is not a STIX 2.1 Indicator property — firewall rules would be represented via other SDOs/SCOs or extensions, and 'user_password_hash' (option D) is not a STIX property at all and would relate to credential objects, not an Indicator.

Answer

firewall_acl_rule

Answer

user_password_hash

Question 2

When using the YARA-L language for detection logic on ingested threat data, which field is primarily used to match against normalized IP addresses?

Accepted Answer

principal.ip. In YARA-L, the 'principal.ip' or 'target.ip' fields are standard placeholders for matching normalized network indicators.

Answer

file.md5

Answer

metadata.event_type

Answer

user.userid

Question 3

A threat intelligence analyst is configuring a TAXII 2.1 client to collect STIX 2.1 data from a new provider. The provider's collection requires authentication and supports filtering by object type. The analyst wants to ensure that only indicators and observed-data objects are retrieved, and that the client can resume collection after a network interruption without missing data. Which TWO configuration steps are necessary to meet these requirements? (Choose two.)

Accepted Answer

Use the added_after query parameter with a timestamp to retrieve only objects added after the last successful poll, enabling resumption.. To filter by object type in TAXII 2.1, the client must use the match[type] query parameter with the desired STIX types. To resume collection after an interruption, the client should track the timestamp of the last retrieved object and use added_after on subsequent requests. These two parameters directly address the requirements of retrieving only indicators and observed-data and ensuring no data is missed after a network failure.

Answer

Configure the client to use HTTP Basic authentication with the provider-issued username and password for every request.

Answer

Set the Accept header to application/taxii+json;version=2.1 to ensure the server returns TAXII 2.1 compliant responses.

Answer

Set the Range header to objects=0-99 to paginate through results and avoid timeouts during large collections.

Question 4

A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a MISP instance. The analyst notices that the same IP address appears with different timestamps and contextual tags from each feed. Which MISP feature should be used to consolidate these duplicate attributes while preserving the earliest sighting date and merging the tags?

Accepted Answer

Use the 'Merge attributes' functionality in the attribute listing to combine duplicates. MISP's 'Merge attributes' functionality is designed to consolidate duplicate attributes, such as the same IP address ingested from different feeds. It preserves the earliest sighting date and merges tags, ensuring that contextual information is retained. This reduces data redundancy and improves the quality of threat intelligence. The other options describe features that either do not exist or do not perform deduplication and merging.

Answer

Use the 'Merge' feature in the feed ingestion configuration to combine attributes

Answer

Use the 'Merge attributes' function in the correlation graph

Answer

Enable the 'Over correlation' setting to automatically deduplicate attributes

Question 5

A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a local MISP instance. The analyst notices that many indicators are duplicates but have different timestamps and slightly different metadata. To reduce noise and improve correlation, the analyst wants to merge these duplicates while preserving the most recent information. Which MISP feature should the analyst use?

Accepted Answer

Use the 'Attribute Deduplication' feature to merge attributes with the same value and type.. MISP provides an attribute deduplication feature that merges attributes sharing the same value and type, keeping the most recent information. This is the appropriate tool for reducing duplicates from multiple feeds while preserving updated metadata. Other options either do not target deduplication or are manual and inefficient.

Answer

Configure a 'Feed' synchronization task with the 'Override' option enabled.

Answer

Use the 'Freetext Import' tool to paste all indicators and let MISP automatically deduplicate.

Answer

Enable the 'Correlation' feature and manually resolve duplicates through the event graph.

Question 6

A threat intelligence analyst is reviewing a newly received STIX 2.1 bundle that contains an Indicator object with a pattern referencing a file hash. The analyst needs to verify the pattern is syntactically correct and can be parsed by the organization's TAXII client. Which of the following should the analyst use to validate the STIX pattern?

Accepted Answer

The STIX pattern validation tool provided by the OASIS Open STIX project. The STIX patterning language has a specific grammar that must be followed for indicators to be interoperable. While JSON schema validation ensures the bundle structure, it does not validate the pattern string itself. The OASIS Open STIX project offers a dedicated pattern validation tool that checks the syntax against the specification. Using this tool gives the analyst confidence that the pattern will be correctly parsed by TAXII clients and other STIX-compliant systems.

Answer

A TAXII server log analysis to see if the pattern was accepted during collection

Answer

A regular expression tester to confirm the pattern matches known malicious files

Answer

A JSON schema validator configured with the STIX 2.1 JSON schemas

Question 7

A threat intelligence analyst is using MISP to correlate events and notices that two separate events contain the same IP address but with different timestamps. The analyst wants to ensure that the IP address is treated as the same attribute across both events for correlation purposes. Which MISP feature should the analyst use to achieve this?

Accepted Answer

Ensure both attributes have the same 'category' and 'type'. MISP correlates attributes automatically when they have the same value and type. The category can also influence correlation in some views, but the fundamental requirement is that the attributes are of the same type. For an IP address, using 'ip-src' or 'ip-dst' consistently across events will cause MISP to link them. This enables analysts to see all events where that IP appears, facilitating threat intelligence analysis and pivoting.

Answer

Create a 'relationship' between the two events manually

Answer

Set the 'to_ids' flag to true on both attributes

Answer

Use the 'correlation' feature by enabling 'correlate' on the attribute

Question 8

A CERT is preparing to share a collection of indicators with partner organizations through a TAXII 2.1 server. The indicators include domain names, file hashes, and IPv4 addresses. The team must ensure that the shared content is interoperable and that partners can filter by indicator type. Which two STIX 2.1 practices should the team apply to meet these requirements? (Choose two.)

Accepted Answer

Represent each indicator as a STIX Indicator object with a valid pattern and a pattern_type of stix.. Interoperable STIX 2.1 sharing requires indicators to be expressed as Indicator objects with valid patterns and pattern_type set to stix. Unique identifiers and object markings ensure partners can reference, update, and handle the data according to sharing rules. Grouping values into reports or free-text descriptions prevents automated filtering, and encoding values breaks pattern matching entirely.

Answer

Create a separate STIX Report object for each indicator type and include the values in the report description.

Answer

Place all indicators in a single Observed Data object with a free-text description listing each value.

Answer

Encode all domain names and hashes as base64 strings inside the Indicator pattern to avoid special characters.

Question 9

A threat intelligence analyst is using the OpenIOC framework to encode indicators of compromise. The analyst wants to create an indicator that detects a specific registry key value that is a string containing 'malware' anywhere in the data. Which OpenIOC element and attribute should the analyst use to achieve this?

Accepted Answer

A 'String' element with the 'contains' attribute set to 'malware'. OpenIOC defines indicators using elements like 'String' with attributes such as 'is', 'contains', and 'matches'. To detect a registry key value that contains 'malware' anywhere, the 'contains' attribute is appropriate because it checks for substring presence. The 'is' attribute would require an exact match, and 'matches' would require a regex pattern. Using 'contains' ensures the indicator triggers on any value that includes the specified substring.

Answer

A 'String' element with the 'matches' attribute set to 'malware'

Answer

A 'Registry' element with the 'value' attribute set to 'malware'

Answer

A 'String' element with the 'is' attribute set to 'malware'

Question 10

A threat intelligence analyst is processing a large set of indicators collected from various sources. The analyst needs to ensure that the data is properly normalized before ingestion into a TIP. Which two actions are essential for normalizing indicator data? (Choose two.)

Accepted Answer

Converting all IP addresses to a consistent format, such as IPv4 dotted decimal or IPv6 canonical representation. Normalizing indicator data involves standardizing formats to enable consistent processing and correlation. Converting IP addresses to a canonical form and ensuring domain names are lowercase are essential steps because they directly affect how indicators are matched and deduplicated. Other actions like translation, encryption, or timestamp conversion are either not normalization or apply to different aspects of data handling.

Answer

Translating all indicator descriptions into a single language, such as English

Answer

Encrypting all indicator data before storage

Answer

Converting all timestamps to a single time zone, such as UTC

Question 11

A threat intelligence analyst is collecting data from a new OSINT source that provides indicators in a JSON format. The analyst needs to extract indicators and map them to a STIX 2.1 format for ingestion into a TIP. The JSON contains a field 'ip_address' with values in CIDR notation, such as '192.168.1.0/24'. Which STIX 2.1 object should the analyst use to represent this network indicator?

Accepted Answer

Network Object. In STIX 2.1, the Network object is used to represent network indicators that are not single IP addresses, such as CIDR blocks. The IPv4 Address object is for individual addresses, and Network Traffic is for observed traffic. Using the Network object with the CIDR value ensures the indicator is accurately represented and can be used for detection and correlation without loss of information.

Answer

Network Traffic Object

Answer

IPv4 Address Object

Answer

IPv4 Address Object with a 'value' property set to the CIDR notation

Question 12

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

Accepted Answer

type. In STIX 2.1, every STIX Object, including the File SCO (Cyber Observable Object), must have a 'type' property that specifies the kind of object it is. For a File object, the value of 'type' is fixed as 'file'. This field is mandatory and serves as the discriminator that tells parsers and tools how to interpret the rest of the object's properties. Without it, the object cannot be validated or processed correctly.

Answer

name

Answer

spec_version

Answer

hashes

Question 13

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

Accepted Answer

Check if the source IP is whitelisted on the threat intelligence provider side.. 403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.

Answer

Update the SSL certificates on the collector.

Answer

Increase the connector memory allocation.

Answer

Restart the OpenCTI RabbitMQ service.

Question 14

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

Accepted Answer

Source IP blacklisting.. Automated scraping tools that ignore rate limits send requests far faster than a site's acceptable-use policy permits, and the target's WAF or IDS will flag the traffic pattern as abusive and block the source IP. Once blacklisted, the collector loses access to that source entirely, which is the primary operational risk of aggressive OSINT harvesting. Encryption, STIX versioning, and normalization are downstream data-handling concerns, not the immediate consequence of ignoring rate limits.

Answer

Lack of data encryption.

Answer

STIX version mismatch.

Answer

Data normalization failure.

Question 15

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

Accepted Answer

In the TAXII client configuration settings.. In a TAXII 2.1 architecture, the TAXII Client is the component that polls or subscribes to a TAXII Server's collections. Filtering for high-confidence indicators is applied on the client side — either in the client configuration (e.g., specifying a confidence threshold in the SIEM's TAXII connector) or in the SIEM's ingestion pipeline after the STIX objects are received. TAXII 2.1 itself does not define a server-side confidence filter parameter, so the client must apply the filter.

Answer

At the firewall level.

Answer

By disabling the feed authentication.

Answer

By modifying the STIX schema.