312-85 Data Collection And Processing Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Accepted Answer

Cross-referencing indicators across multiple sources.. Option C (Cross-referencing indicators across multiple sources) is correct because corroborating an indicator such as an IP address, domain, or file hash against independent feeds reduces false positives and increases confidence in its accuracy and relevance. Option D (Validating the source authenticity) is correct because confirming that a feed genuinely originates from a trusted, reputable provider (for example via signed feeds, verified credentials, or established reputation) prevents ingestion of spoofed or poisoned intelligence that would degrade reliability. Option A is wrong because metadata such as timestamps, confidence scores, and provenance is essential for assessing indicator freshness and trustworthiness, so removing it harms reliability. Option B is wrong because increasing ingest frequency only refreshes data faster; it does not improve the accuracy or trustworthiness of the intelligence itself. Option E is wrong because automatically trusting all feeds is the opposite of reliability, as it allows unvetted or malicious data to enter the pipeline unchecked.

Answer

Removing all metadata.

Answer

Increasing the ingest frequency.

Answer

Automatically trusting all feeds.

Question 2

Which TWO of the following are common actions performed during the 'processing' phase of the threat intelligence lifecycle?

Accepted Answer

Normalization to a unified format.. Option A (Normalization to a unified format) is correct because the processing phase converts collected raw intelligence into a consistent, structured format (e.g., STIX/TAXII or a common schema) so that disparate feeds can be correlated, deduplicated, and analyzed. Option B (Parsing of raw data files) is correct because processing involves extracting usable fields and indicators from raw feeds, logs, or files (e.g., JSON, XML, CSV) before enrichment and analysis. Option C is incorrect because physically installing servers is an infrastructure/deployment task, not part of the intelligence lifecycle's processing phase. Option D is incorrect because writing incident response playbooks is a defensive/operational preparation activity, not intelligence processing. Option E is incorrect because final delivery to the CISO corresponds to the dissemination phase, which occurs after processing and analysis.

Answer

Physical installation of servers.

Answer

Writing incident response playbooks.

Answer

Final delivery to the CISO.

Question 3

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Accepted Answer

number_observed. In STIX 2.1, the Observed Data SDO is designed to convey cyber observable information along with the time window and count of observations, so option A (number_observed) is correct because it is a required integer property recording how many times the data was seen. Option D (last_observed) is correct because it is a required timestamp property marking the end of the observation period. Option E (first_observed) is correct because it is a required timestamp property marking the beginning of the observation period. The unmarked options do not belong: vulnerability_scanner_id is not a defined STIX 2.1 Observed Data property, and root_password is not a STIX property at all (and would be inappropriate sensitive data to store in this object).

Answer

vulnerability_scanner_id

Answer

root_password

Question 4

Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?

Accepted Answer

Verify network connectivity (e.g., ping/telnet).. Option B is correct because a failed TAXII 2.1 connection often stems from basic reachability problems, so verifying network connectivity with tools like ping or telnet to the server's host and port (typically 443 for HTTPS) confirms whether the endpoint is reachable before deeper troubleshooting. Option C is correct because TAXII 2.1 servers are accessed over HTTPS, and an invalid, expired, or untrusted TLS certificate chain will cause the client's TLS handshake to fail, so validating the certificate chain (issuer, expiration, and trust anchors) is essential. Option E is correct because TAXII 2.1 servers commonly require authentication via HTTP Basic, Bearer tokens, or similar API credentials, and invalid or expired credentials will result in 401/403 responses that break the connection. Option A is not appropriate because reinstalling the operating system is a drastic, unrelated action that does not address TAXII connectivity issues. Option D is not appropriate because the TAXII protocol specification is a fixed standard and should never be modified during troubleshooting.

Answer

Reinstall the operating system.

Answer

Modify the TAXII protocol specification.

Question 5

A threat intelligence analyst at a financial institution is ingesting a high-volume STIX 2.1 feed from a commercial provider. The feed contains many duplicate and near-duplicate indicators. The analyst needs to programmatically deduplicate the data before storing it in a MISP instance. Which approach is most appropriate for identifying and removing duplicate indicators?

Accepted Answer

Normalize the indicator patterns and compute a hash over the canonicalized pattern and object type, then use that hash as the deduplication key.. Deduplicating threat intelligence requires comparing the semantic content of indicators, not just object IDs or timestamps. Canonicalizing patterns and hashing them yields a stable fingerprint that identifies equivalent indicators across feeds. This method works regardless of source-specific IDs and ensures that only genuinely unique indicators are stored, reducing noise and storage overhead.

Answer

Use the MISP correlation engine to automatically merge all events that share at least one attribute, treating them as duplicates.

Answer

Use the STIX ID field of each object as the unique identifier, since it is guaranteed to be globally unique and persistent across updates.

Answer

Compare the created timestamp of each object and discard any object whose timestamp is older than the newest one with the same name.

Question 6

A threat intelligence analyst is processing a large dataset of indicators collected from multiple OSINT sources. The analyst notices that many indicators are malformed, such as IP addresses with invalid octets or domain names containing illegal characters. The analyst needs to ensure that only valid indicators are stored in the intelligence platform. Which action should the analyst take during the processing phase?

Accepted Answer

Apply regular expression validation to each indicator type and discard any indicator that does not match the expected pattern.. During processing, validating indicator syntax is essential to maintain data quality. Regular expression validation for each indicator type (e.g., IPv4, domain, URL) efficiently identifies malformed entries. Discarding invalid indicators prevents errors in downstream analysis and storage. Enrichment, normalization, or classification do not replace the need for basic syntactic validation.

Answer

Enrich each indicator with additional context from WHOIS and passive DNS, then store all indicators regardless of format.

Answer

Use a machine learning classifier to predict whether each indicator is malicious, and store only those classified as malicious.

Answer

Normalize all indicators to lowercase and remove any special characters, then store them without further validation.

Question 7

An analyst at a financial services firm receives a threat feed where each entry contains a 'confidence' field set to 85. The feed vendor's documentation states that confidence values are expressed as a percentage. The analyst needs to normalize this data before loading it into the internal threat intelligence platform, which accepts confidence on a 0-100 integer scale. Which action should the analyst take during processing?

Accepted Answer

Map the value directly as an integer without modification.. The vendor's confidence is already expressed as a percentage on a 0-100 scale, and the destination platform accepts the same scale. Therefore, the analyst should map the value directly without transformation. This preserves the original meaning and avoids introducing errors that would occur with unnecessary scaling or field removal.

Answer

Convert the value to a decimal between 0 and 1 by dividing by 100.

Answer

Multiply the value by 10 to expand the scale to 0-1000 for finer granularity.

Answer

Discard the confidence field and rely solely on the indicator type for prioritization.

Question 8

An analyst is collecting threat intelligence from a new OSINT source that provides indicators in a structured format. The analyst needs to ensure that the data is ingested into the threat intelligence platform (TIP) without manual reformatting. Which data format is most commonly supported by TIPs for automated ingestion?

Accepted Answer

STIX 2.1. STIX 2.1 is the industry standard for structured threat intelligence, and TIPs commonly support it for automated ingestion. It provides a well-defined schema that allows platforms to parse and ingest data without manual reformatting. Other formats like PDF, CSV, or plain text lack the standardized structure needed for seamless automation, making STIX 2.1 the correct choice.

Answer

PDF reports

Answer

CSV files

Answer

Plain text emails

Question 9

A threat intelligence analyst is processing a large set of indicators and needs to enrich them with additional context. The analyst wants to use the MITRE ATT&CK framework to map indicators to adversary tactics, techniques, and procedures (TTPs). Which data processing step should be performed first to ensure accurate mapping?

Accepted Answer

Normalize the indicators to a standard format. Normalizing indicators to a standard format is essential before mapping to MITRE ATT&CK because it ensures that indicators are consistently represented, enabling accurate matching to techniques. Without normalization, variations in data can cause mismatches and reduce the effectiveness of enrichment. Other steps like WHOIS enrichment, SIEM correlation, or clustering are valuable but should follow normalization to maintain data integrity.

Answer

Apply machine learning clustering to group similar indicators

Answer

Correlate indicators with existing events in the SIEM

Answer

Enrich indicators with WHOIS data

Question 10

A threat intelligence analyst is processing a new feed that contains indicators of compromise (IOCs) in STIX 2.1 format. Before ingesting the data into the internal platform, the analyst must validate that the STIX objects conform to the specification. Which two of the following are required properties for a STIX 2.1 'Indicator' object? (Choose two.)

Accepted Answer

pattern_type. In STIX 2.1, an Indicator object must include the 'pattern' and 'pattern_type' properties. The 'pattern' contains the detection logic, and 'pattern_type' specifies the language of that pattern. Other properties like 'name', 'description', and 'valid_from' are optional and provide context but are not required for the object to be valid.

Answer

name

Answer

description

Answer

valid_from

Question 11

A threat intelligence analyst is collecting data from a TAXII 2.1 server. The analyst needs to retrieve only the indicators that have been added or modified since the last collection. Which TAXII 2.1 feature should be used to achieve this?

Accepted Answer

Use the 'added_after' query parameter. The 'added_after' query parameter in TAXII 2.1 is specifically designed for incremental collection, allowing clients to request objects added after a given timestamp. This efficiently retrieves only new or modified indicators, reducing bandwidth and processing. Other parameters like 'match[version]' or 'limit' serve different purposes and do not support time-based filtering for incremental updates.

Answer

Use the 'limit' query parameter to paginate results

Answer

Use the 'filter' query parameter with a date range

Answer

Use the 'match[version]' query parameter

Question 12

A threat intelligence analyst is collecting data from a dark web forum to identify emerging threats. The analyst uses a web scraping tool that automatically extracts posts and user metadata. After several hours, the tool is blocked and the analyst's IP is banned. Which of the following is the most likely cause of the block, and what should the analyst have implemented to prevent it?

Accepted Answer

The tool triggered rate limiting; the analyst should have used rotating proxies and randomized delays.. The most likely cause of the block is that the scraping tool exceeded the forum's rate limits. To prevent this, the analyst should have implemented rotating proxies and randomized delays to distribute requests and mimic human behavior. Other measures like VPNs, headless browsers, or TLS do not directly address rate limiting.

Answer

The tool did not use a VPN; the analyst should have connected through a Tor exit node.

Answer

The tool did not parse JavaScript; the analyst should have used a headless browser.

Answer

The tool used HTTP instead of HTTPS; the analyst should have enforced TLS.

Question 13

An analyst is extracting indicators from a large collection of PDF reports. The reports contain IP addresses embedded in narrative text, tables, and footnotes with inconsistent formatting. The analyst needs a repeatable method to extract IPv4 addresses while minimizing false positives from version numbers such as 10.2.3.4. Which approach best supports this requirement?

Accepted Answer

Write regular expressions that match IPv4 octet ranges and require word boundaries, then manually review matches for context.. Unstructured reports require pattern-based extraction with validation and human review. Regular expressions can enforce IPv4 octet ranges and word boundaries, which filters out many version-number-like strings. Manual review then resolves ambiguous matches using context. This balances automation with accuracy and produces a repeatable process suitable for collection and processing workflows.

Answer

Import the PDFs into a SIEM and rely on the SIEM's built-in threat intelligence parser to extract addresses.

Answer

Use a YARA rule with strings matching dotted-decimal notation and scan the PDF files directly.

Answer

Convert the PDFs to plain text and upload them to a commercial sandbox for automated indicator extraction.

Question 14

An analyst is processing a set of indicators received in a CSV file. The file contains a column labeled 'ip_address' with values such as '192.168.1.1' and '10.0.0.1'. The analyst needs to import these into a threat intelligence platform that expects indicators to be classified by type. Which of the following actions should the analyst take to ensure proper classification?

Accepted Answer

Import the IP addresses as 'ipv4-addr' objects after validating they are not private or reserved.. The analyst should validate that the IP addresses are not private or reserved, as those are not useful threat indicators, and then import them as 'ipv4-addr' objects. This ensures correct classification and enables proper correlation and detection within the threat intelligence platform.

Answer

Import the IP addresses as 'domain-name' objects since they are alphanumeric strings.

Answer

Import the IP addresses as 'mutex' objects because they can be used to identify malicious processes.

Answer

Import the IP addresses as 'url' objects by prepending 'http://' to each value.

Question 15

A threat intelligence analyst is processing a set of indicators and needs to ensure that the data is properly enriched and contextualized before dissemination. Which TWO of the following actions are appropriate during the processing phase of the threat intelligence lifecycle? (Choose two.)

Accepted Answer

Normalizing indicators to a consistent format. During the processing phase, analysts normalize and enrich indicators to ensure consistency and add context. Normalization standardizes data formats, while enrichment appends valuable information like geolocation or WHOIS. These steps prepare intelligence for analysis and dissemination. Dissemination, collection, and deployment are separate phases and not part of processing.

Answer

Collecting indicators from new OSINT sources

Answer

Disseminating indicators to stakeholders via email

Answer

Deploying indicators to security controls like firewalls