312-85 Hard Questions — 25 Difficult Questions

Question 1

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence (D) is the ATT&CK tactic explicitly defined as techniques adversaries use to keep access to systems across restarts, changed credentials, or other interruptions, making it the core answer for maintaining a presence. Privilege Escalation (E) is commonly involved because adversaries need higher-level permissions (e.g., SYSTEM or root) to install durable persistence mechanisms such as services, scheduled tasks, or registry Run keys that survive reboots. Defense Evasion (C) is also involved because maintaining a foothold requires hiding artifacts and activity from security tools, for example by disabling logging, obfuscating scripts, or masquerading as legitimate processes. Exfiltration (A) is about stealing data out of the environment and does not itself maintain access, and Reconnaissance (B) is information gathering before compromise, so neither belongs to the persistence-focused tactics.

Answer

Exfiltration

Answer

Reconnaissance

Question 2

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

Accepted Answer

Map the adversary's behavior to specific techniques and sub-techniques, such as Spearphishing Attachment or Exploit Public-Facing Application.. The MITRE ATT&CK framework is most useful when adversary behavior is mapped to specific techniques and sub-techniques, which describe concrete actions like Exploit Public-Facing Application or Spearphishing Attachment. This level of detail enables defenders to identify relevant detection strategies and mitigations, whereas higher-level tactics or atomic indicators provide less actionable context.

Answer

Map the adversary to a known threat group profile, such as APT29, based on the use of a novel exploit.

Answer

Map the adversary's actions to the highest-level tactics, such as initial access and execution, without detailing techniques.

Answer

Map the specific malware hashes and exploit file names directly to ATT&CK technique IDs.

Question 3

A hunter is reviewing Zeek conn.log and notices long-lived, low-volume TLS sessions from several internal workstations to the same external IP on port 443 where the server certificate is self-signed, the JA3S value is identical across all sessions, and the byte counts are almost symmetric over hours. The workstations show no matching DNS queries for that IP and no proxy logs because the traffic bypasses the proxy. Which hypothesis best fits this evidence?

Accepted Answer

The pattern is consistent with beaconing to hard-coded C2 infrastructure using a custom TLS profile, and the hunter should pivot on the JA3S value and destination IP.. Direct-to-IP TLS with a self-signed certificate, a uniform JA3S fingerprint, and steady low-volume symmetric sessions indicates a beacon using a custom TLS profile. Pivoting on the server fingerprint and destination IP lets the hunter find other affected hosts and confirm the campaign before remediation.

Answer

The traffic represents normal HTTPS browsing because port 443 is used and the sessions are encrypted end to end.

Answer

A sanctioned software update service is being reached over a direct TLS channel that bypasses the proxy by design.

Answer

The sessions indicate a misconfigured internal service because self-signed certificates are only used inside an organization's own address space.

Question 4

A hunter is investigating anomalous DNS activity on an internal resolver. Several endpoints are issuing high volumes of queries for long, random-looking subdomains under a single registered domain, with responses that are mostly NXDOMAIN but occasionally resolve. Which TWO detection approaches would most effectively confirm whether this is DNS tunneling or domain generation algorithm activity? (Choose two.)

Accepted Answer

Correlate the timing and volume of queries with the process that initiated them using endpoint DNS client event telemetry.. Confirming DNS tunneling or DGA activity requires both statistical characterization of the query names and attribution to the originating process. Measuring query length and entropy against a per-endpoint baseline exposes algorithmically generated or encoded names, while endpoint DNS client telemetry ties those queries to the specific binary responsible. Together these methods produce defensible evidence rather than relying on blocklists.

Answer

Review the resolver's cache hit ratio and increase the TTL on all cached records to reduce query volume.

Answer

Search the SIEM for the registered domain across historical proxy logs and add it to a watchlist if it appears in any HTTP request.

Answer

Block all outbound DNS at the perimeter and force every endpoint to use DNS over HTTPS to a public resolver.

Question 5

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Accepted Answer

Information on exploit frameworks, payload construction tools, and customized delivery mechanisms used by target threat groups. Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.

Answer

Phishing email headers received by internal mail servers from external domains

Answer

File hashes and indicators associated with credential dumping tools like Mimikatz

Answer

Network traffic logs showing data exfiltration over encrypted channels

Question 6

A threat hunter is investigating possible data staging prior to exfiltration on a file server. The hunter has full Windows Security auditing, Sysmon, and PowerShell logging available. Which TWO telemetry patterns most directly indicate that an adversary is staging and compressing collected data on the host? (Choose two.)

Accepted Answer

A single process creating a large number of file read operations across many directories within a short window, followed by writes to one new archive file.. Staging is characterized by broad collection followed by consolidation into a single archive, and by archiving that deviates from normal administrative patterns. Reading many directories then writing one archive, and creating an encrypted archive with a non-standard extension from a web server parent, both directly evidence that behavior.

Answer

Repeated DNS queries from the server to a single external domain at irregular intervals with varying query types.

Answer

A high volume of failed authentication attempts against the file server from multiple internal workstations.

Answer

Scheduled tasks created by the built-in backup service account to copy files to a known backup share each night.

Question 7

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Accepted Answer

Logon Type 3 occurring from a workstation to a workstation. Option A is correct because Pass-the-Hash (PtH) abuses NTLM authentication to move laterally, and a Logon Type 3 (network logon) from one workstation to another is abnormal in most environments and is a classic signature of PtH lateral movement using stolen NTLM hashes. Option B is correct because a successful logon originating from an unexpected or unusual source IP indicates an attacker is authenticating with compromised credentials/hashes from a host that should not be initiating such access, which is a strong PtH indicator. Option D is correct because PtH relies on NTLM authentication (the hash is replayed directly), so observing NTLM authentication where Kerberos would normally be expected (e.g., in a domain environment that supports Kerberos) is a strong indicator of hash-based authentication abuse. Option C is not a PtH indicator because successful local service startup is normal system behavior and unrelated to credential theft or replay. Option E is not a PtH indicator because a high volume of Kerberos TGS requests suggests Kerberos ticket activity (e.g., Kerberoasting or normal service ticket requests), not NTLM hash replay.

Answer

Success of local service startup

Answer

High volume of Kerberos TGS requests

Question 8

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Accepted Answer

Pivot to identify the Capability or Adversary. After identifying infrastructure, the next step is to pivot to identify the associated Capability or Adversary, creating a chain of evidence.

Answer

Update the firewall blacklist only

Answer

Change all user passwords

Answer

Close the incident ticket

Question 9

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

Accepted Answer

Standard deviation on interval deltas. Beaconing is characterized by regular, periodic callbacks from an infected host to C2 infrastructure. To detect periodicity, you must analyze the intervals between successive connections from the same source to the same destination. Computing the standard deviation of those interval deltas reveals how consistent the timing is — a low standard deviation indicates highly regular beaconing (e.g., every 60 seconds ± 2s), which is a strong indicator of automated C2.

Answer

Sum aggregation on connection counts

Answer

Min/Max aggregation on bytes

Answer

Cardinality count on source IPs

Question 10

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Accepted Answer

Application of NLP techniques to extract entities.. NLP (Natural Language Processing) is the standard technique for converting unstructured text into structured, normalized intelligence.

Answer

Hashing the entire document.

Answer

Direct ingestion into the SIEM.

Answer

Manual entry into a spreadsheet.

Question 11

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Accepted Answer

Downloading remote payloads. certutil.exe is a legitimate Windows utility for managing certificates, but attackers abuse its -urlcache and -split flags to download files from remote URLs, effectively turning it into a LOLBin downloader. This allows payload retrieval without introducing custom malware, evading application whitelisting.

Answer

Extracting browser passwords

Answer

Clearing event logs

Answer

Modifying system registry keys

Question 12

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

Accepted Answer

Map to 'ip-src'.. IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.

Answer

Map to 'text' attribute type.

Answer

Map to 'domain'.

Answer

Map to 'comment'.

Question 13

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

Accepted Answer

The adversary's phishing email address and spoofed sender domain. Infrastructure in the Diamond Model comprises the physical and logical communication structures the adversary uses, such as command-and-control domains, IP addresses, and phishing email addresses or spoofed sender domains. These elements enable the adversary to deliver capabilities and maintain control. Malware and exploits are Capability, victim assets are Victim, and adversary personas are Adversary, so those options do not belong to Infrastructure.

Answer

The adversary's social media profile used for reconnaissance

Answer

The victim organization's internal file server hostname

Answer

The specific malware family and exploit code used in the attack

Question 14

Which THREE of the following are valid reasons to use the STIX 'Sighting' object?

Accepted Answer

To indicate the source of the observation. The Sighting object is used to indicate that an indicator was seen, provide context on the target, and show where it was detected.

Answer

To define the threat actor profile

Answer

To provide the remediation steps

Question 15

While hunting for hidden network traffic, you identify anomalous 'Beacon' activity in the proxy logs. Which metric is the most effective way to filter out normal traffic noise?

Accepted Answer

Response size variance. By filtering on low-entropy and uniform intervals, analysts can isolate beacons from human-generated web traffic.

Answer

HTTP User-Agent strings

Answer

DNS lookup failure counts

Answer

Source IP addresses

Question 16

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Accepted Answer

T1572: Protocol Tunneling. This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.

Answer

T1204: User Execution

Answer

T1133: External Remote Services

Answer

T1053: Scheduled Task

Question 17

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. ALE is calculated as SLE × ARO, where SLE = Asset Value × Exposure Factor. Here, the impact I = $500,000 is the SLE, and the probability P = 0.2 is the ARO. Original ALE = 0.2 × $500,000 = $100,000. Reducing probability by 50% gives a new ARO of 0.1, so new ALE = 0.1 × $500,000 = $50,000.

Answer

$75,000

Answer

$100,000

Answer

$25,000

Question 18

Which THREE of the following are considered 'Tactical' intelligence products? (Choose three)

Accepted Answer

Malicious IP address blacklists. Tactical intelligence is specific, actionable data used for immediate defense.

Answer

Long-term industry threat trend analysis

Answer

Executive risk assessment reports

Question 19

You have noticed high-frequency beaconing to a domain that was recently registered. In the context of threat intelligence, how is this categorized?

Accepted Answer

Technical Intelligence. Newly Registered Domains (NRDs) are a common indicator of malicious activity often used for C2 infrastructure.

Answer

Tactical Intelligence

Answer

Operational Intelligence

Answer

Strategic Intelligence

Question 20

When structuring a Threat Intelligence program, a CTI leader must establish structured analytic techniques to overcome cognitive biases during analysis. Which THREE are recognized structured analytic techniques used in intelligence analysis? (Choose THREE)

Accepted Answer

Devil's Advocacy. Analysis of Competing Hypotheses (ACH), Red Hat Analysis, and Devil's Advocacy are standard structured analytic techniques.

Answer

Symmetric Key Cryptographic Padding

Answer

Randomized MAC Address Rotation