312-85 Introduction TO Threat Intelligence Practice Test 2 — 15 Questions

Question 1

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Accepted Answer

Define specific PIRs regarding third-party software vendors and update frequency. The Direction phase translates broad stakeholder intent into actionable intelligence requirements. Refining 'Supply Chain threats' into specific Priority Intelligence Requirements (PIRs) — such as which third-party vendors, what indicators, and how often to refresh — makes collection and production measurable and scoped. This is exactly what the Direction phase demands: turning vague asks into defined, answerable questions.

Answer

Ignore the request until more data is available

Answer

Purchase all available supply chain threat reports

Answer

Automate the collection of all supply chain news

Question 2

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Accepted Answer

Processing. Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.

Answer

Collection

Answer

Dissemination

Answer

Analysis

Question 3

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

Accepted Answer

Command and Control. Command and Control (C2) is the Cyber Kill Chain phase where an adversary establishes a persistent communication channel with compromised systems to issue commands and exfiltrate data. Persistent communication with an external host is the defining characteristic of C2, typically using protocols like HTTP/S, DNS, or custom beacons to evade detection. Exploitation and Installation precede C2, while Actions on Objectives follow it.

Answer

Exploitation

Answer

Installation

Answer

Actions on Objectives

Question 4

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Accepted Answer

The interval between the occurrence of a threat and the availability of intelligence. Timeliness in threat intelligence measures the latency between when a threat event occurs and when intelligence about it becomes available to defenders. It is a core quality dimension alongside relevance, accuracy, and completeness, and it directly affects how actionable intelligence is — stale intel may describe threats that have already been mitigated or evolved.

Answer

The length of the intelligence report

Answer

The number of IOCs provided per month

Answer

The accuracy of the threat actor attribution

Question 5

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Accepted Answer

A list of known malicious file hashes. An IOC is a piece of forensic evidence that indicates a system has been compromised.

Answer

A description of an adversary's motivation

Answer

A whitepaper on general cybersecurity trends

Answer

An organization's security policy document

Question 6

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

Accepted Answer

To prevent false positives from blocking legitimate traffic. Vetting is the quality-control step in the threat intelligence lifecycle where raw indicators are checked for accuracy, relevance, and context before operational use. Its primary purpose is to filter out false positives — such as shared IPs from CDNs, cloud providers, or sinkholes — so that blocking them does not disrupt legitimate business traffic. This protects availability while preserving the value of the feed.

Answer

To reduce the volume of indicators for storage

Answer

To increase the threat score of each IP

Answer

To format the IP addresses into CIDR blocks

Question 7

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Accepted Answer

The use of a custom remote access trojan (RAT) with specific DGA algorithms. Capability refers to the specific tools, malware, or techniques an adversary uses to achieve their objectives.

Answer

The target organization's industry sector

Answer

The frequency of the adversary's campaigns

Answer

The adversary's base of operations in a specific country

Question 8

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

Accepted Answer

It allows for hierarchical and logical grouping of indicators. OpenIOC is an XML-based format that supports hierarchical indicator structures with logical operators (AND, OR) and nested IndicatorItem elements, allowing complex conditions like 'process name X AND parent process Y AND registry key Z'. This logical grouping is the primary advantage over flat CSV lists, which can only express one indicator per row with no boolean relationships.

Answer

It is faster to parse for simple IP addresses

Answer

It is the only format supported by most SIEMs

Answer

It automatically updates the firewall rules

Question 9

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Accepted Answer

Execution. Execution is the tactic used to run malicious code on a target system; PowerShell is a common technique within that tactic.

Answer

Persistence

Answer

Exfiltration

Answer

Privilege Escalation

Question 10

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Accepted Answer

An executive summary of the potential business impact of the threat. Strategic intelligence, which focuses on trends and risk impact, is designed for executive audiences.

Answer

A detailed list of firewall rules to block the attacker

Answer

Raw log data from the IDS/IPS

Answer

A breakdown of the malware assembly code

Question 11

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

Accepted Answer

Internal IDS/IPS and firewall logs. Option A (Internal IDS/IPS and firewall logs) is correct because these are machine-generated telemetry from security controls that capture indicators such as source/destination IPs, ports, protocols, and signature matches, which is the essence of technical threat intelligence. Option C (Malware sandbox reports) is correct because sandboxing dynamically executes suspicious files and extracts technical artifacts like hashes, C2 domains/IPs, registry keys, and MITRE ATT&CK techniques. The unmarked options do not belong: legislative changes (B) are legal/policy intelligence, interviews with industry peers (D) are human-source or tactical/strategic context, and geopolitical risk analysis (E) is strategic threat intelligence rather than technical.

Answer

Legislative changes in cybersecurity law

Answer

Interviews with industry peers

Answer

Geopolitical risk analysis reports

Question 12

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Accepted Answer

The vendor's track record for providing accurate, validated intelligence. Option A is correct because a vendor's historical accuracy and validation of intelligence directly determine whether its feeds can be trusted for detection and response decisions. Option B is correct because consistent reporting over time demonstrates reliability, reduces gaps in coverage, and shows the vendor is not sporadic or reactive. Option E is correct because transparency about methodology allows analysts to assess data provenance, collection sources, and analytical rigor, which is essential for trusting the intelligence. Option C is not correct because raw indicator volume without context is a poor reliability metric and can increase false positives. Option D is not correct because social media follower counts reflect popularity, not the technical quality or accuracy of threat intelligence.

Answer

The volume of indicators provided without context

Answer

The number of social media followers the vendor has

Question 13

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

Accepted Answer

Centralizing threat data from multiple disparate sources. Option A is correct because a Threat Intelligence Platform (TIP) aggregates and normalizes threat data from many disparate sources—such as OSINT feeds, commercial vendors, ISACs, and internal telemetry—into a single searchable repository, which is a core function of a TIP. Option B is correct because TIPs integrate with security controls (e.g., firewalls, SIEMs, EDR, and proxies) via APIs and formats like STIX/TAXII to automate the dissemination and ingestion of indicators of compromise (IOCs), enabling faster detection and response. Option C is incorrect because TIPs manage and correlate threat intelligence, not provide malware source code, which is rarely available and not a TIP function. Option D is incorrect because no platform can eliminate all false positives; TIPs can enrich and prioritize indicators to reduce noise, but false positives still occur. Option E is incorrect because a TIP augments, rather than replaces, the security analyst team, which is still needed for interpretation, hunting, and decision-making.

Answer

Providing the original source code of all malware

Answer

Eliminating all false positives

Answer

Replacing the need for a security analyst team

Question 14

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

Accepted Answer

Ensuring the intelligence is delivered effectively to the target audience. Dissemination is the phase of the threat intelligence lifecycle where finished intelligence is delivered to the appropriate consumers — executives, SOC analysts, incident responders — in a format and timeframe that supports their decisions. It ensures the right intelligence reaches the right audience with the right context, whether through reports, feeds, or briefings. Without effective dissemination, even high-quality analysis delivers no value.

Answer

Analyzing the data collected

Answer

Collecting data from the dark web

Answer

Developing new security tools

Question 15

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Accepted Answer

The ephemeral nature of cloud assets. Option C is correct because cloud assets are ephemeral — instances, containers, and serverless functions are created, destroyed, and rescheduled constantly, so indicators of compromise (IOCs) and threat context tied to a specific IP, hostname, or instance ID quickly become stale, making correlation and tracking of threats difficult. Option D is correct because the shared responsibility model splits visibility and control between the cloud provider and the customer, so logs, telemetry, and enforcement points span multiple parties, which complicates attribution of an attack to a specific actor, misconfiguration, or tenant. Option A is incorrect because cloud workloads are fully susceptible to malware, cryptojacking, and ransomware; the cloud changes the attack surface, not immunity. Option B is incorrect because cloud environments generate extensive logs (e.g., AWS CloudTrail, Azure Activity Log, VPC Flow Logs), though access and normalization can be challenging. Option E is incorrect because API-based intelligence collection is widely used and often essential in cloud threat intelligence, not impossible.

Answer

Cloud environments are immune to malware

Answer

The total lack of logs in cloud environments

Answer

The inability to use API-based intelligence collection