312-85 Intelligence Reporting And Dissemination Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 2

Which TWO of the following are common challenges when sharing intelligence between organizations?

Accepted Answer

Lack of trust between organizations. Option D is correct because a lack of trust between organizations is a fundamental obstacle to intelligence sharing: participants must worry about data being leaked, misused, or attributed back to them, which is why frameworks like TLP (Traffic Light Protocol) and legal agreements such as NDAs and ISAC/ISAO trust models exist to govern handling and dissemination. Option E is correct because incompatible data formats are a pervasive technical challenge: different organizations use different schemas, taxonomies, and standards (for example STIX/TAXII versus proprietary CSV or SIEM-specific formats), so indicators and context often must be normalized and mapped before they can be consumed, which is precisely the problem standards like STIX 2.x and MISP aim to solve. Option A is not a typical challenge in this context, since intelligence sharing relies on APIs, feeds, and standardized transports rather than end-user browser rendering. Option B is not a defining challenge, as shared indicator feeds are generally small text-based payloads that do not strain bandwidth. Option C is incorrect because intelligence sharing consumes storage rather than being impeded by having too much disk space.

Answer

Browser compatibility

Answer

Insufficient bandwidth

Answer

Too much disk space usage

Question 3

You are configuring a TAXII 2.1 client to consume feeds from an industry ISAC. You have successfully authenticated but are receiving empty response bodies for your collections. Which configuration setting should you verify in the TAXII client to ensure you are polling the correct resource path?

Accepted Answer

Verify the 'API Root' URL parameter in the client configuration.. In TAXII 2.1, the API Root is the base URL that scopes all collections and objects; if the client is pointed at the wrong API Root, requests to collection endpoints return empty bodies even though authentication succeeds. Verifying the API Root URL ensures the client is polling the correct resource path for the ISAC's collections.

Answer

Toggle the 'Enable TLS 1.3' checkbox.

Answer

Ensure the 'STIX Object Versioning' is set to 'Latest'.

Answer

Check the 'Discovery Service' endpoint path.

Question 4

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

Accepted Answer

'relationship_type'. The 'relationship_type' property defines the semantic nature of the link; if it does not match the STIX 2.1 controlled vocabulary for that SDO pair, the parser will reject the bundle.

Answer

'source_ref'

Answer

'target_ref'

Answer

'spec_version'

Question 5

When disseminating intelligence to C-level executives versus technical SOC analysts, you must adjust your reporting format. Which technique ensures compliance with intelligence cycle requirements for 'Actionable Intelligence'?

Accepted Answer

Use 'Executive Summaries' that highlight business impact and risk, while keeping technical IOCs in an attached appendix.. Actionable intelligence must be tailored to the audience; executives require strategic summaries (impact and risk), while analysts require technical indicators (IOCs).

Answer

Convert all technical reports to PDF only, removing machine-readable STIX.

Answer

Include raw PCAP files in all executive reports.

Answer

Remove TLP markings from executive reports to increase accessibility.

Question 6

A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?

Accepted Answer

A1. Under the Admiralty Code, A1 represents a reliable source (A) and information that is confirmed by other independent sources (1).

Answer

C3

Answer

F6

Answer

B2

Question 7

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

Accepted Answer

pattern. For a STIX 2.1 Indicator SDO to be well-formed, the required common properties are type (C) and id (D), plus the Indicator-specific required property pattern (A). The type field must be present and set to the exact string 'indicator' so parsers can identify the SDO, while id must be a valid STIX identifier of the form indicator--<UUIDv4> that uniquely identifies the object. The pattern field is mandatory because it carries the actual detection logic (e.g., a STIX Patterning expression such as [file:hashes.'SHA-256' = '...']), and without it the Indicator has no content to match. By contrast, description (B) is optional human-readable context, and valid_until (E) is an optional timestamp bounding the indicator's validity, so neither is required for well-formedness.

Answer

description

Answer

valid_until

Question 8

You are selecting a format for sharing intelligence with a heterogeneous group of partners. Which THREE of the following are benefits of choosing STIX/TAXII over unstructured CSV/PDF reporting?

Accepted Answer

Reduction in analyst time spent on manual data entry.. Option C is correct because STIX's structured, machine-readable schema lets partners ingest indicators programmatically instead of re-keying them from CSV/PDF reports, cutting manual data-entry effort. Option D is correct because STIX defines standardized objects, properties, and relationships (e.g., Indicator, Malware, Attack Pattern, and relationship types), so the same intelligence retains consistent meaning across heterogeneous tools and vendors. Option E is correct because TAXII provides a standardized HTTPS/RESTful transport for exchanging STIX content, enabling automated ingestion into SIEM and SOAR platforms via APIs rather than manual parsing. Option A is not correct because STIX/TAXII does not by itself guarantee encryption at rest; TAXII specifies transport (typically TLS in transit), while at-rest protection depends on the storage platform. Option B is not correct because human-readable plain-text commentary is equally achievable in CSV/PDF and is not a distinguishing benefit of STIX/TAXII.

Answer

Guaranteed encryption of all shared data at rest.

Answer

Ability to include human-readable commentary in plain text.

Question 9

You are drafting a threat intelligence report for an internal audience that includes both technical staff and non-technical executives. The report contains actionable indicators and a strategic assessment. Which intelligence reporting approach best serves this mixed audience?

Accepted Answer

Produce a single report with both technical details and an executive summary at the top, using clear language and a TLP marking.. The best approach combines an executive summary with technical details in one report, ensuring both audiences receive relevant information without fragmentation. This maintains consistency, respects the TLP marking, and provides actionable intelligence for all recipients. It balances strategic context with operational specifics, which is essential for effective decision-making across the organization.

Answer

Disseminate only the strategic assessment to all audiences to avoid confusion, omitting technical indicators that could aid defense.

Answer

Create two separate reports: one fully technical for staff and one purely strategic for executives, with no cross-references.

Answer

Write a single technical report with extensive jargon and raw indicators, assuming executives will have analysts explain it to them.

Question 10

You are an intelligence analyst tasked with disseminating a tactical threat report to your organization's security operations center (SOC). The report includes specific indicators of compromise (IOCs) and recommended detection rules. Which dissemination method is most appropriate to ensure the SOC can rapidly ingest and act on the IOCs?

Accepted Answer

Provide the IOCs in a structured format such as STIX/TAXII or a CSV file, and push them directly to the SOC's TIP or SIEM.. Using a structured format like STIX/TAXII or CSV and pushing directly to the SOC's tools ensures rapid, automated ingestion of IOCs. This enables immediate detection and response, which is the goal of tactical intelligence dissemination. Other methods require manual intervention and are slower, increasing the window of exposure.

Answer

Email the report as a PDF attachment to the SOC distribution list.

Answer

Include the IOCs in the body of a plain-text email and request that SOC analysts manually add them to the SIEM.

Answer

Publish the report on a shared wiki page and notify the SOC via chat.

Question 11

You are a CTI analyst preparing a weekly intelligence summary for your organization's executive leadership. The report will include a high-level overview of the current threat landscape, key risks, and recommended strategic actions. To ensure the report is actionable and aligns with the audience's needs, which of the following should be the primary focus of the report?

Accepted Answer

An overview of key threats, their potential business impact, and strategic recommendations for risk mitigation.. Executive reports should focus on strategic intelligence: the threat landscape, business impact, and recommendations. Technical details like IOCs or TTPs are for tactical teams. The goal is to enable executives to make informed decisions about risk management and resource allocation, not to provide operational data.

Answer

A comprehensive list of all vulnerabilities discovered in the organization's infrastructure during the past week.

Answer

A summary of threat actor tactics, techniques, and procedures (TTPs) with mitigation steps for security operations.

Answer

Detailed technical indicators of compromise (IOCs) such as IP addresses and file hashes.

Question 12

You are a threat intelligence analyst at a financial institution. Your team is preparing to share a report on a recent ransomware campaign with a trusted partner via a TAXII 2.1 collection. To ensure the report is correctly interpreted and the sharing complies with internal policies, which two actions must you take before dissemination? (Choose two.)

Accepted Answer

Apply a TLP marking to the report to indicate sharing restrictions.. Before sharing via TAXII, you must apply the appropriate TLP marking to communicate handling restrictions and verify that the recipient is authorized to receive information at that TLP level. These steps ensure compliance with sharing policies and prevent unauthorized disclosure. Other actions like PGP encryption or PDF conversion are not standard requirements.

Answer

Convert the report to PDF format to preserve formatting.

Answer

Include a disclaimer that the information is provided 'as is' without warranty.

Answer

Encrypt the report using PGP before sending it via TAXII.

Question 13

You are the lead CTI analyst at a financial services firm. After a recent breach, you must deliver a threat intelligence report to the board of directors. The board has limited technical background but needs to understand the business impact and make risk-based decisions. Which reporting approach is most appropriate for this audience?

Accepted Answer

Deliver a concise executive summary highlighting business impact, risk posture, and recommended strategic actions.. The board of directors requires strategic intelligence that translates technical threats into business risk. An executive summary should focus on impact, risk, and recommended actions, avoiding technical jargon. This enables informed decision-making on resource allocation and policy. Other options are too technical or raw, failing to meet the audience's needs for concise, actionable insights.

Answer

Share the raw threat feed data and let the board draw their own conclusions.

Answer

Provide a tactical report focusing on adversary TTPs and specific detection signatures.

Answer

Provide a detailed technical report with IOCs, YARA rules, and MITRE ATT&CK technique mappings.

Question 14

You are an intelligence analyst tasked with disseminating a tactical threat intelligence report to your organization's SOC analysts. The report contains specific IOCs and TTPs that need to be acted upon quickly. Which dissemination method is most appropriate for ensuring timely and actionable delivery to the SOC?

Accepted Answer

Integrate the report into the SIEM or TIP so that IOCs are automatically ingested and alerts are generated.. Tactical intelligence requires rapid dissemination and action. Integrating the report into SIEM or TIP allows for automated ingestion and alerting, ensuring IOCs are acted upon immediately. Other methods like intranet posts, newsletters, or meetings introduce delays and are not optimized for time-sensitive operational response.

Answer

Publish the report on the corporate intranet and send a link via email.

Answer

Include the report in a monthly intelligence newsletter distributed to all employees.

Answer

Schedule a meeting with SOC analysts to walk through the report in detail.

Question 15

You are a CTI analyst preparing to share a report with a partner organization. The report contains sensitive technical details about an ongoing investigation. You want to ensure the information is shared only with the intended recipients and that they understand the handling restrictions. Which action best fulfills this requirement?

Accepted Answer

Mark the report with TLP:RED and deliver it only to the designated recipients.. TLP:RED is the most restrictive marking, indicating information should only be shared with designated recipients. It ensures the report is handled appropriately and prevents further dissemination. Other markings like TLP:AMBER or TLP:WHITE are less restrictive and do not meet the requirement to limit access strictly to intended individuals.

Answer

Apply the TLP:AMBER marking to the report and share it via a secure channel.

Answer

Use TLP:WHITE to allow broad sharing and rely on the partner's discretion.

Answer

Encrypt the report and send it via email with a password in a separate message.