312-85 Data Collection And Processing Practice Test 2 — 15 Questions

Question 1

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 2

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

Accepted Answer

TAXII. TAXII (Trusted Automated Exchange of Intelligence Information) is the OASIS-standardized application-layer protocol designed specifically to transport STIX-formatted threat intelligence over HTTPS. It defines services like Discovery, Collections, and Channels for publishing and subscribing to CTI. TAXII 2.1 is the current version and is the de facto transport for STIX 2.x.

Answer

SNMP

Answer

Syslog

Answer

ICMP

Question 3

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Accepted Answer

Decode the content and extract nested indicators.. Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.

Answer

Replace the payload with a static hash.

Answer

Discard the indicator as encrypted.

Answer

Store the raw base64 string as a comment.

Question 4

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

Accepted Answer

The client requested an unsupported content-type in the Accept header.. A 406 error typically indicates that the media type requested in the Accept header is not supported by the TAXII server, often due to a mismatch between STIX versioning expectations.

Answer

The connection is blocked by a firewall ACL.

Answer

The API key provided for authentication is expired.

Answer

The TAXII discovery service endpoint is misconfigured.

Question 5

Which of the following is a 'pull-based' method of threat intelligence data collection?

Accepted Answer

TAXII Poll.. TAXII Poll is a pull-based collection method: the client initiates a request to the TAXII server to retrieve available collections or objects. This contrasts with push-based methods where the server or sender proactively delivers data to the consumer. TAXII 2.1 supports both collection endpoints and object endpoints that clients poll on demand.

Answer

Webhook notifications.

Answer

Email distribution lists.

Answer

RSS feeds.

Question 6

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

Accepted Answer

To link two objects together.. The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.

Answer

To define the schema version.

Answer

To encrypt the data transport.

Answer

To set the confidence score.

Question 7

Which of the following is an example of 'structured' threat intelligence data?

Accepted Answer

A STIX 2.1 JSON file.. STIX/TAXII provides a machine-readable, structured format for intelligence.

Answer

An email body.

Answer

A handwritten note.

Answer

A PDF report from a vendor.

Question 8

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Accepted Answer

Application of NLP techniques to extract entities.. NLP (Natural Language Processing) is the standard technique for converting unstructured text into structured, normalized intelligence.

Answer

Hashing the entire document.

Answer

Direct ingestion into the SIEM.

Answer

Manual entry into a spreadsheet.

Question 9

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

Accepted Answer

Assume TLP:RED.. When TLP is missing, the default safest practice is to assume TLP:RED or the most restrictive category to prevent unauthorized disclosure.

Answer

Publish to public forums.

Answer

Discard the data entirely.

Answer

Assume TLP:CLEAR.

Question 10

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

Accepted Answer

JSON Schema Validator.. JSON Schema validation is the standard method for verifying the structure and types of JSON data.

Answer

Netstat.

Answer

Nmap.

Answer

Wireshark.

Question 11

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

Accepted Answer

The object ID (UUID).. In STIX, every object has a globally unique id in the form -- (e.g., malware--a1b2c3d4-...). When comparing two 'malware' objects, the object ID (UUID) is the canonical unique identifier — if the IDs match, they are the same object; if they differ, they are distinct objects (even if names or hashes overlap). This is the most reliable deduplication key.

Answer

The file size.

Answer

The source name.

Answer

The timestamp of ingestion.

Question 12

You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?

Accepted Answer

Develop an ETL/transformation script.. The critical step is to develop an ETL/transformation script because STIX (Structured Threat Information Expression) is a JSON-based language for cyber threat intelligence, while CSV is a flat, tabular format. A transformation script extracts relevant fields from STIX objects (e.g., indicators, observed-data), maps them to CSV columns, and handles nested structures. Without this, the SIEM cannot ingest the data. This is a classic ETL (Extract, Transform, Load) requirement when bridging incompatible data formats.

Answer

Ignore the format mismatch.

Answer

Enable automatic STIX parsing in the SIEM engine.

Answer

Increase the SIEM storage capacity.

Question 13

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Accepted Answer

Standardizing time formats (e.g., UTC).. Option B is correct because normalizing threat data requires aligning timestamps across disparate sources, and converting all events to a single reference such as UTC eliminates timezone offsets so that correlation and timeline reconstruction work reliably. Option E is correct because mapping heterogeneous feeds to a common schema such as STIX (Structured Threat Information Expression) gives fields like indicators, observables, and relationships a consistent structure, which is the core of data normalization. The remaining options do not belong: deleting all historical data (A) destroys the evidence needed for analysis rather than normalizing it, increasing firewall throughput (C) is a performance/network change unrelated to data format consistency, and disabling API authentication (D) weakens security and has nothing to do with harmonizing threat data.

Answer

Deleting all historical data.

Answer

Increasing the firewall throughput.

Answer

Disabling API authentication.

Question 14

Which TWO of the following are recognized categories of threat intelligence sources?

Accepted Answer

Open Source Intelligence (OSINT).. OSINT is a formally recognized category of threat intelligence sources, referring to publicly available information such as vendor blogs, CERT advisories, government publications, and social media that is collected, processed, and analyzed for security purposes. Option C (Commercial/Proprietary Feeds) is also correct because commercial threat intelligence feeds from vendors like Recorded Future, Mandiant, or CrowdStrike are a standard recognized source category, providing curated indicators of compromise (IOCs), malware signatures, and adversary tracking data. The remaining options do not belong: Local User Logs (B) are internal telemetry data generated by systems, not a threat intelligence source category; Internal Hardware Inventory (D) is an asset management artifact; and Network Topology Maps (E) are internal documentation of infrastructure, not a recognized threat intelligence source.

Answer

Local User Logs.

Answer

Internal Hardware Inventory.

Answer

Network Topology Maps.

Question 15

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

Accepted Answer

Lack of standardized formatting.. Option A is correct because threat intelligence feeds arrive in many incompatible schemas and formats (for example STIX/TAXII JSON, CSV, MISP events, OpenIOC, and vendor-proprietary layouts), so normalizing and correlating indicators across sources is a genuine ingestion challenge. Option B is correct because feeds can deliver millions of indicators per day, and the sheer data volume can exceed the storage, parsing, and enrichment capacity of SIEM, TIP, or SOAR pipelines, causing latency and dropped records. Option E is correct because many feeds contain stale, low-fidelity, or unverified indicators, so a high false-positive rate creates noise that wastes analyst time and can trigger erroneous blocking. Option C is not a standard ingestion challenge because feeds are inherently network-delivered and organizations consuming them already have connectivity; the real issues are format, scale, and quality. Option D is not a challenge but a handling concern: defaulting to TLP:CLEAR is a sharing/marking policy decision, not an obstacle to ingesting feeds.

Answer

Lack of internet access.

Answer

Defaulting to TLP:CLEAR.