312-85 Intelligence Reporting And Dissemination Practice Test 2 — 15 Questions

Question 1

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

Accepted Answer

To uniquely identify a specific set of intelligence within an API Root. In TAXII 2.1, a Collection is a logical grouping of CTI objects within an API Root, and the Collection ID is a globally unique identifier (typically a UUID) that allows clients to request, poll, or subscribe to that specific set of intelligence. It is the addressing mechanism used in TAXII endpoint URLs such as /{api-root}/collections/{collection-id}/objects/, so without it a consumer cannot target the exact data feed it needs. It does not perform integrity, retention, or encryption functions — those are handled elsewhere in the STIX/TAXII stack.

Answer

To verify the integrity of the STIX bundle

Answer

To define the retention period for the objects

Answer

To encrypt the data payload during transit

Question 2

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

Accepted Answer

To provide actionable remediation steps to defend against a threat. Course of Action (CoA) objects in STIX are intended to provide actionable remediation steps to defend against a threat. They describe specific measures that can be taken to prevent, mitigate, or respond to an attack, such as applying a patch, blocking a port, or reconfiguring a system. In an automated environment, these can be used to trigger defensive actions or guide incident response.

Answer

To verify the identity of the threat actor

Answer

To map the threat actor's TTPs

Answer

To store forensic artifacts

Question 3

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

Accepted Answer

Executive Summary PDF. An Executive Summary PDF is the most appropriate format for a CISO because it provides a high-level, strategic overview of the threat landscape, tailored for decision-makers who need concise, actionable insights rather than raw data. It typically includes trends, risks, and recommendations, aligning with the audience's need for strategic planning. Other formats are too technical or granular for an executive audience.

Answer

Full TAXII object dump

Answer

Raw STIX JSON feed

Answer

CSV list of IOCs

Question 4

An organization wants to contribute intelligence to an ISAC (Information Sharing and Analysis Center). They need to ensure their sharing mechanism supports automated, near-real-time updates. Which standard should they adopt?

Accepted Answer

TAXII 2.1. TAXII 2.1 (Trusted Automated Exchange of Intelligence Information) is the OASIS standard specifically designed for automated, near-real-time exchange of cyber threat intelligence. It defines a RESTful API and a set of services (Collections, Channels, etc.) that allow ISAC members to publish and consume STIX-formatted intelligence programmatically. This enables machine-to-machine sharing without human intervention, which is exactly what the organization needs for near-real-time updates.

Answer

PDF report uploads

Answer

Email distribution lists

Answer

SFTP file drops

Question 5

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Accepted Answer

Confidence Score. A Confidence Score directly quantifies the reliability and certainty of the intelligence, which is essential for the SOC team to assess whether the intelligence is actionable. It indicates how much trust can be placed in the data, enabling prioritization and response. Without a confidence score, the team cannot effectively determine the risk or the appropriate action, making it the most critical metric for proving actionability.

Answer

The total number of threat actors identified

Answer

The date the report was created

Answer

The TLP level

Question 6

Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?

Accepted Answer

GDPR. GDPR (General Data Protection Regulation) governs the processing and cross-border transfer of personal data of individuals in the EU/EEA. When threat intelligence contains PII and is shared with international partners, GDPR's lawful basis, data minimization, and transfer mechanism requirements (such as Standard Contractual Clauses or adequacy decisions) directly apply. This makes it the framework a company must consider in that scenario.

Answer

HIPAA

Answer

SOX

Answer

PCI-DSS

Question 7

A threat intelligence report uses the Diamond Model for Intrusion Analysis. You are adding a new 'Victim' node. What information should you include to align with this model?

Accepted Answer

The specific organization or target being attacked. The Diamond Model of Intrusion Analysis consists of four core features: Adversary, Capability, Infrastructure, and Victim. The Victim node represents the target of the intrusion — the specific organization, system, or asset being attacked — so the correct entry is the targeted organization or entity.

Answer

The malware hash used in the attack

Answer

The TTPs used by the attacker

Answer

The IP addresses of the attacker's C2

Question 8

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Accepted Answer

To represent the organization or individual performing or being targeted by an activity. In STIX 2.x, the Identity object represents an actual individual, organization, or group — it is used to attribute who is performing an activity (e.g., a threat actor group) or who is being targeted (e.g., a victim organization). When you see an Identity object linked to a Campaign via a 'attributed-to' or 'targets' relationship, it identifies the actor or victim, not the malware or infrastructure.

Answer

To list the malware families used

Answer

To define the technical infrastructure of the attacker

Answer

To provide the IP addresses of the C2

Question 9

You are implementing a TIP and want to prioritize intelligence based on the source's reputation. Where should you configure this logic?

Accepted Answer

In the Source Reliability or Feed Weighting module. The Source Reliability or Feed Weighting module is specifically designed to assign trust scores or weights to intelligence sources based on their historical accuracy, credibility, and reputation. This allows the TIP to prioritize or deprioritize intelligence from each feed, ensuring that higher-quality data drives decision-making. Configuring this logic elsewhere, such as in TAXII or STIX settings, does not address source reputation.

Answer

In the TAXII discovery root

Answer

In the User Access Control settings

Answer

In the STIX parser settings

Question 10

You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?

Accepted Answer

Execution. PowerShell is a command-line shell and scripting language used for execution. In MITRE ATT&CK, the use of PowerShell for executing commands is mapped to the Execution tactic, specifically technique T1059.001 (PowerShell).

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 11

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

Accepted Answer

Apply the TLP marking to the document. The Traffic Light Protocol (TLP) is the industry-standard marking system specifically designed to communicate information-sharing sensitivity to recipients. Applying a TLP marking (RED, AMBER, GREEN, CLEAR) directly on the document gives recipients an unambiguous, standardized instruction about how far they may redistribute the content. This is the most effective way to convey sensitivity because it is machine-readable and universally understood in the threat intelligence community.

Answer

Send the report via an encrypted channel

Answer

Password protect the document

Answer

Use a disclaimer at the bottom of the email

Question 12

Which THREE of the following are valid Traffic Light Protocol (TLP) labels?

Accepted Answer

TLP:AMBER. TLP:AMBER (B) is a valid label used when information may be shared only on a need-to-know basis within the recipient's organization and its clients, and it is one of the standard TLP 2.0 designations. TLP:RED (C) is valid for information that must not be disclosed beyond the specific individuals present in the exchange, making it the most restrictive TLP label. TLP:GREEN (D) is valid for information that can be shared within the wider community but not publicly, such as among peers in the same sector. The other options are not part of the TLP standard: TLP:INTERNAL (A) is not a defined TLP label (it resembles internal handling markings used by some organizations), and TLP:PRIVATE (E) is likewise not a recognized TLP designation.

Answer

TLP:INTERNAL

Answer

TLP:PRIVATE

Question 13

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

Accepted Answer

Malware Hashes. Options B and D are correct because tactical intelligence consists of the specific, machine-readable indicators of compromise (IOCs) that security tools consume to detect and block active threats in the short term. Malware hashes (B) are cryptographic fingerprints (e.g., MD5/SHA-256 values) of known malicious files that endpoint and antivirus systems use for immediate signature-based detection. C2 IP addresses (D) are network indicators of command-and-control infrastructure that firewalls, IDS/IPS, and proxies can block to disrupt an ongoing attack. In contrast, geopolitical threat assessments (A) and industry trend analysis (E) are strategic intelligence, focused on long-term, high-level risk context rather than immediate operational indicators, and executive risk summaries (C) are management-level reporting that translates intelligence for business decision-makers rather than tactical detection data.

Answer

Geopolitical threat assessments

Answer

Executive risk summaries

Answer

Industry trend analysis

Question 14

Which THREE of the following are security best practices for managing a TAXII server?

Accepted Answer

Enforce TLS 1.2 or higher. Option A is correct because TAXII (Trusted Automated Exchange of Intelligence Information) transmits threat intelligence over HTTPS, and enforcing TLS 1.2 or higher protects data in transit from eavesdropping and man-in-the-middle attacks while disabling deprecated protocols like TLS 1.0/1.1. Option B is correct because TAXII servers authenticate clients via API keys or similar credentials, so strict API key management—rotation, least privilege, secure storage, and revocation—prevents unauthorized access and key leakage. Option C is correct because regularly auditing server access logs enables detection of anomalous or unauthorized TAXII collection requests, supports incident response, and satisfies compliance monitoring requirements. Option D is not appropriate because plain text HTTP exposes TAXII traffic to interception and tampering, and performance gains do not justify eliminating transport encryption. Option E is not appropriate because disabling all authentication would allow any anonymous client to read or write threat intelligence, violating the core access-control requirements of a TAXII server.

Answer

Use plain text HTTP for better performance

Answer

Disable all authentication

Question 15

Which THREE of the following are core components of the STIX 2.1 Domain Object (SDO) structure?

Accepted Answer

Threat-Actor. Threat-Actor (A) is a core STIX 2.1 Domain Object (SDO) used to represent the individuals, groups, or organizations believed to be conducting malicious activities. Malware (B) is also a core SDO, defined as malicious code or software such as viruses, worms, or ransomware. Attack-Pattern (C) is a core SDO that describes the techniques or tactics adversaries use to compromise targets, aligning with frameworks like MITRE ATT&CK. TLP-Level (D) is not an SDO; TLP is a marking-definition concept applied via the marking-definition object, not a standalone domain object. TAXII-Server (E) is not an SDO either; TAXII is a separate transport protocol for exchanging STIX content, not part of the STIX domain object model.

Answer

TLP-Level

Answer

TAXII-Server