312-85 Intelligence Reporting And Dissemination — Timed 20 Questions

Question 1

Your organization is mandated to share threat indicators under the Traffic Light Protocol (TLP). Which TLP marking indicates that the information can be shared with peers within the sector but should not be distributed publicly?

20 minute time limit — choose an answer to begin.

Accepted Answer

TLP:GREEN. TLP:AMBER indicates information that can be shared within the organization and with partners/peers who have a need-to-know, but not released to the general public.

Answer

TLP:CLEAR

Answer

TLP:AMBER

Answer

TLP:RED

Question 2

Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?

Accepted Answer

The TIP requires a schema transformation for STIX 1.x to 2.x. STIX 2.x is not backward compatible with STIX 1.x due to significant changes in the JSON structure and object models.

Answer

The feed is missing the mandatory TAXII headers

Answer

The feed contains invalid XML tags

Answer

STIX 1.2 does not support JSON format

Question 3

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

Accepted Answer

Validate the JSON bundle against the STIX 2.1 schema. Validating the JSON schema against the STIX 2.1 specification is the definitive way to identify structural inconsistencies in the received bundle.

Answer

Restart the TAXII server service

Answer

Check the TLS certificate expiration date

Answer

Check the firewall rules for port 443

Question 4

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Accepted Answer

Relationship. In STIX 2.1, the 'Relationship' object is specifically used to connect two SDOs (Domain Objects) with a defined relationship type such as 'uses'.

Answer

Indicator

Answer

Sighting

Answer

Observed-Data

Question 5

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

Accepted Answer

TLP:RED. TLP:RED is used for information that cannot be shared outside of the specific recipients, which is appropriate for sensitive zero-day intelligence.

Answer

TLP:GREEN

Answer

TLP:AMBER

Answer

TLP:CLEAR

Question 6

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

Accepted Answer

To uniquely identify a specific set of intelligence within an API Root. In TAXII 2.1, the Collection ID is a unique UUID that enables clients to request specific datasets from a server that may host multiple collections.

Answer

To verify the integrity of the STIX bundle

Answer

To define the retention period for the objects

Answer

To encrypt the data payload during transit

Question 7

You are configuring a TAXII 2.1 server to share threat indicators with a government partner. You need to ensure the connection enforces the transport-level security requirements for sensitive data exchange. Which setting must you verify in the TAXII configuration?

Accepted Answer

Enable mutual TLS (mTLS) authentication for the client-server connection. The TAXII 2.1 protocol relies on HTTPS. Ensuring the TLS configuration is set to 1.2 or higher is a security requirement for encrypted transport.

Answer

Configure the TAXII discovery root to use port 443 only

Answer

Disable the API Root discovery service to prevent unauthorized enumeration

Answer

Set the Content-Encoding header to GZIP for all payloads

Question 8

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

Accepted Answer

To provide actionable remediation steps to defend against a threat. The STIX CoA object is designed to provide automated or manual recommendations to mitigate the threat described in the intelligence.

Answer

To verify the identity of the threat actor

Answer

To map the threat actor's TTPs

Answer

To store forensic artifacts

Question 9

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

Accepted Answer

Executive Summary PDF. Strategic reports focus on trends, business risk, and high-level summaries, which are best presented in an executive PDF or dashboard format.

Answer

Full TAXII object dump

Answer

Raw STIX JSON feed

Answer

CSV list of IOCs

Question 10

An organization wants to contribute intelligence to an ISAC (Information Sharing and Analysis Center). They need to ensure their sharing mechanism supports automated, near-real-time updates. Which standard should they adopt?

Accepted Answer

TAXII 2.1. TAXII is the transport protocol specifically designed for automated exchange of threat intelligence in real-time.

Answer

PDF report uploads

Answer

Email distribution lists

Answer

SFTP file drops

Question 11

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Accepted Answer

Confidence Score. The 'False Positive' rate or 'Confidence Score' helps SOC analysts prioritize which indicators to block versus which to monitor.

Answer

The total number of threat actors identified

Answer

The date the report was created

Answer

The TLP level

Question 12

Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?

Accepted Answer

GDPR. GDPR (General Data Protection Regulation) has strict requirements regarding the export and sharing of personal data, which often includes logs or artifacts linked to individuals.

Answer

HIPAA

Answer

SOX

Answer

PCI-DSS

Question 13

A threat intelligence report uses the Diamond Model for Intrusion Analysis. You are adding a new 'Victim' node. What information should you include to align with this model?

Accepted Answer

The specific organization or target being attacked. The Diamond Model focuses on the relationship between Adversary, Capability, Infrastructure, and Victim. The Victim node represents the organization or individual being targeted.

Answer

The malware hash used in the attack

Answer

The TTPs used by the attacker

Answer

The IP addresses of the attacker's C2

Question 14

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Accepted Answer

To represent the organization or individual performing or being targeted by an activity. The Identity object identifies the victim or the perpetrator, providing context on who is being targeted or who is performing the action.

Answer

To list the malware families used

Answer

To define the technical infrastructure of the attacker

Answer

To provide the IP addresses of the C2

Question 15

You are implementing a TIP and want to prioritize intelligence based on the source's reputation. Where should you configure this logic?

Accepted Answer

In the Source Reliability or Feed Weighting module. Most enterprise TIPs have a 'Source Reliability' or 'Feed Weighting' configuration module to assign trust scores to different contributors.

Answer

In the TAXII discovery root

Answer

In the User Access Control settings

Answer

In the STIX parser settings

Question 16

You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?

Accepted Answer

Execution. MITRE ATT&CK maps techniques like PowerShell under 'Execution' as it is used to run malicious code.

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 17

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

Accepted Answer

Apply the TLP marking to the document. The TLP (Traffic Light Protocol) is the globally accepted standard for communicating intelligence sensitivity and sharing boundaries.

Answer

Send the report via an encrypted channel

Answer

Password protect the document

Answer

Use a disclaimer at the bottom of the email

Question 18

Which THREE of the following are valid Traffic Light Protocol (TLP) labels?

Accepted Answer

TLP:AMBER. The current TLP standards are RED, AMBER, GREEN, and CLEAR.

Answer

TLP:INTERNAL

Answer

TLP:PRIVATE

Question 19

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

Accepted Answer

Malware Hashes. Tactical intelligence is focused on immediate, technical indicators that can be used to stop an attack, such as IOCs and malware hashes.

Answer

Geopolitical threat assessments

Answer

Executive risk summaries

Answer

Industry trend analysis

Question 20

Which THREE of the following are security best practices for managing a TAXII server?

Accepted Answer

Enforce TLS 1.2 or higher. Securing a TAXII server involves access control, TLS, and monitoring logs.

Answer

Use plain text HTTP for better performance

Answer

Disable all authentication