312-85 Introduction TO Threat Intelligence — 25 Questions

Question 1

You have noticed high-frequency beaconing to a domain that was recently registered. In the context of threat intelligence, how is this categorized?

Accepted Answer

Technical Intelligence. Newly Registered Domains (NRDs) are a common indicator of malicious activity often used for C2 infrastructure.

Answer

Tactical Intelligence

Answer

Operational Intelligence

Answer

Strategic Intelligence

Question 2

Which THREE of the following are considered 'Tactical' intelligence products? (Choose three)

Accepted Answer

Malicious IP address blacklists. Tactical intelligence is specific, actionable data used for immediate defense.

Answer

Long-term industry threat trend analysis

Answer

Executive risk assessment reports

Question 3

Which THREE of the following are examples of 'Operational' intelligence? (Choose three)

Accepted Answer

Knowledge of the adversary's staging infrastructure setup. Operational intelligence focuses on the 'how' of an attack, such as TTPs and campaign patterns.

Answer

A 5-year forecast of the global cyber-insurance market

Answer

A list of specific server ports to block

Answer

Analysis of an adversary's preferred lateral movement techniques

Question 4

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

Accepted Answer

The IP addresses of the Command and Control servers used. The Infrastructure node in the Diamond Model describes the physical or logical communication channels used by the adversary, such as C2 servers or IP addresses.

Answer

The time of day the attack occurred

Answer

The specific malware hash used in the attack

Answer

The adversary's primary motivation

Question 5

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

Accepted Answer

Create a custom CSV mapping template in the 'Import' module. The MISP 'Import' functionality allows for template-based mapping to ensure CSV columns map to specific MISP attributes and categories correctly.

Answer

Change the file extension to .misp

Answer

Manually edit each indicator after the import is complete

Answer

Use the MISP API to overwrite the database schema

Question 6

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail provides the audit logs of all API calls made in the account, which is essential for identifying unauthorized usage.

Answer

AWS GuardDuty

Answer

AWS WAF

Answer

AWS Inspector

Answer

AWS Config

Question 7

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Accepted Answer

Define specific PIRs regarding third-party software vendors and update frequency. Refining requirements involves transforming abstract topics into measurable intelligence needs (Priority Intelligence Requirements).

Answer

Ignore the request until more data is available

Answer

Purchase all available supply chain threat reports

Answer

Automate the collection of all supply chain news

Question 8

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

Accepted Answer

Check if the API Key has the 'Read' permission for the specific Collection ID requested. The 403 error specifically indicates that the client is authenticated but lacks the necessary permissions to access the requested Collection ID.

Answer

Verify the Discovery Service URL in the client configuration

Answer

Change the polling interval from 60 seconds to 300 seconds

Answer

Validate the TLS handshake certificate chain

Question 9

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Accepted Answer

Processing. Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.

Answer

Collection

Answer

Dissemination

Answer

Analysis

Question 10

You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?

Accepted Answer

targets. In STIX 2.1, the 'targets' relationship is used to indicate that a malware object is designed to exploit a specific vulnerability object.

Answer

attributed-to

Answer

uses

Answer

indicates

Question 11

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

Accepted Answer

Command and Control. Establishing persistence via a C2 channel is the definition of the Command and Control phase in the Cyber Kill Chain.

Answer

Exploitation

Answer

Installation

Answer

Actions on Objectives

Question 12

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Accepted Answer

The interval between the occurrence of a threat and the availability of intelligence. Timeliness refers to the gap between when an event occurs and when the intelligence regarding that event is received by the analyst.

Answer

The length of the intelligence report

Answer

The number of IOCs provided per month

Answer

The accuracy of the threat actor attribution

Question 13

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Accepted Answer

A list of known malicious file hashes. An IOC is a piece of forensic evidence that indicates a system has been compromised.

Answer

A description of an adversary's motivation

Answer

A whitepaper on general cybersecurity trends

Answer

An organization's security policy document

Question 14

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

Accepted Answer

To prevent false positives from blocking legitimate traffic. Vetting prevents false positives by verifying the validity and current relevance of indicators before they affect production traffic.

Answer

To reduce the volume of indicators for storage

Answer

To increase the threat score of each IP

Answer

To format the IP addresses into CIDR blocks

Question 15

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Accepted Answer

The use of a custom remote access trojan (RAT) with specific DGA algorithms. Capability refers to the specific tools, malware, or techniques an adversary uses to achieve their objectives.

Answer

The target organization's industry sector

Answer

The frequency of the adversary's campaigns

Answer

The adversary's base of operations in a specific country

Question 16

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

Accepted Answer

It allows for hierarchical and logical grouping of indicators. OpenIOC allows for the expression of complex logical relationships between indicators, rather than just simple flat lists.

Answer

It is faster to parse for simple IP addresses

Answer

It is the only format supported by most SIEMs

Answer

It automatically updates the firewall rules

Question 17

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Accepted Answer

Execution. Execution is the tactic used to run malicious code on a target system; PowerShell is a common technique within that tactic.

Answer

Persistence

Answer

Exfiltration

Answer

Privilege Escalation

Question 18

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Accepted Answer

An executive summary of the potential business impact of the threat. Strategic intelligence, which focuses on trends and risk impact, is designed for executive audiences.

Answer

A detailed list of firewall rules to block the attacker

Answer

Raw log data from the IDS/IPS

Answer

A breakdown of the malware assembly code

Question 19

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

Accepted Answer

Internal IDS/IPS and firewall logs. Technical intelligence typically comes from logs, network traffic, and malware analysis.

Answer

Legislative changes in cybersecurity law

Answer

Interviews with industry peers

Answer

Geopolitical risk analysis reports

Question 20

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

Accepted Answer

Intrusion Set / Threat Actor identity. The Adversary node includes the actors behind the threat and their intent.

Answer

Network infrastructure

Answer

Target organization's industry

Answer

Malware capabilities