312-85 Introduction TO Threat Intelligence Practice Test 3 — 15 Questions

Question 1

A newly formed CTI team is defining the requirements for its intelligence program. The team lead wants to ensure the program produces intelligence that is both actionable and aligned with business risk. Which TWO characteristics should the program prioritize? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Timeliness so that intelligence arrives before the adversary's window of opportunity closes. Actionable, risk-aligned intelligence must be relevant to the organization's assets and adversaries and timely enough to inform defensive action before harm occurs. Raw volume, an exclusive focus on exotic threats, and mandatory nation-state attribution all divert resources from decisions that actually reduce risk. Relevance and timeliness are the two characteristics that most directly connect a new program's output to business value.

Answer

Maximum volume of raw indicators collected from every available feed

Answer

Exclusive focus on zero-day exploits and advanced persistent threats

Answer

Complete attribution of every incident to a named nation-state actor

Question 2

A threat intelligence analyst is collecting data from various sources to understand a new malware campaign. The analyst uses both internal telemetry from the organization's SIEM and external reports from commercial threat feeds. Which term best describes the combination of these sources?

Accepted Answer

All-source intelligence. All-source intelligence integrates information from diverse sources, including internal telemetry and external feeds, to create a comprehensive understanding. This approach reduces bias and fills gaps by corroborating data across sources. The other terms refer to specific collection disciplines, not the integration of multiple source types.

Answer

Human intelligence

Answer

Open-source intelligence

Answer

Data fusion

Question 3

A manufacturing firm's CTI analyst receives a report describing a new malware loader used by a financially motivated group. The report lists file hashes but no context on targeting or exploitation. The analyst must decide how to classify and route this intelligence internally. Which action best reflects sound intelligence practice?

Accepted Answer

Enrich the report with targeting and TTP context, assess relevance to the firm, then disseminate to detection and leadership as appropriate. Intelligence gains value when analysts add context and tailor it to the consumer. Enriching the report with targeting and TTP information, judging its relevance to a manufacturing environment, and disseminating appropriately to technical and business audiences turns raw indicators into actionable intelligence. Blocking blindly, forwarding raw data upward, or discarding incomplete reports all skip essential analysis steps.

Answer

Forward the full report unchanged to the executive team and await direction

Answer

Immediately block the hashes at the perimeter and close the ticket as handled

Answer

Discard the report because it lacks targeting information and therefore has no intelligence value

Question 4

A retail company's SOC manager wants to shift from reactive alert triage to a proactive posture. The CISO has approved budget for a program that will produce finished assessments about which adversaries are most likely to target the company's new contactless payment platform, why they would do so, and what business impact an intrusion would create. Which type of intelligence best matches this deliverable?

Accepted Answer

Strategic threat intelligence. The requirement is a decision-support product for leadership that explains adversary intent, likely targeting of a new payment platform, and resulting business impact. That combination of audience, abstraction, and planning horizon defines strategic threat intelligence, which converts intelligence into risk and prioritization guidance rather than detection content or atomic indicators.

Answer

Operational threat intelligence

Answer

Technical threat intelligence

Answer

Tactical threat intelligence

Question 5

A financial institution's threat intelligence team is evaluating a new commercial feed. The team needs to determine if the feed provides 'actionable' intelligence. Which characteristic of the feed is most critical to this determination?

Accepted Answer

The feed provides context and recommended actions for each indicator.. Actionable intelligence requires context and recommended actions so that defenders can respond effectively. For a financial institution, this means the feed should explain why an indicator is malicious and suggest mitigations. Real-time updates, broad coverage, and long expiration periods are useful but insufficient without actionable guidance.

Answer

The feed covers a wide range of threat actors.

Answer

The feed is updated in real-time.

Answer

The feed includes indicators with long expiration periods.

Question 6

A junior analyst at a managed security services provider receives a feed of IP addresses and file hashes from a vendor and is told to push them to the firewall and endpoint platform for automatic blocking. What type of threat intelligence is the analyst handling?

Accepted Answer

Technical threat intelligence. Atomic, machine-readable artifacts such as IP addresses and file hashes that are loaded into blocking and detection controls constitute technical threat intelligence. It is the most perishable and lowest-context form of intelligence, valuable for immediate prevention but requiring frequent refresh and enrichment with higher-level context to remain useful.

Answer

Operational threat intelligence

Answer

Strategic threat intelligence

Answer

Tactical threat intelligence

Question 7

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

Accepted Answer

Source reliability and information credibility assessment. The lead is capturing how dependable each feed has proven and how credible its content is, so consumers can weight it correctly. Structured evaluation separates the trustworthiness of the source from the plausibility of the information itself, and observed lateness or uniqueness without corroboration are precisely the attributes that drive those ratings.

Answer

Intelligence dissemination and sharing controls

Answer

Threat hunting hypothesis development

Answer

Collection management and requirements prioritization

Question 8

A newly hired SOC analyst is asked to explain the fundamental difference between data, information, and intelligence to a group of interns. The analyst wants to describe what specifically distinguishes finished threat intelligence from raw collected data. Which statement best describes this distinction?

Accepted Answer

Intelligence is data that has been collected, processed, and analyzed to provide context and support a specific decision.. Finished threat intelligence is the product of applying analysis and context to collected data so it can support a specific decision. Raw logs, packets, and feed indicators are inputs, not intelligence. The hierarchy of data to information to intelligence is a core concept in the Introduction to Threat Intelligence domain, and it explains why skilled analysts, not just collection tools, are required.

Answer

Intelligence is the total volume of threat data an organization collects, measured by the number of feeds ingested daily.

Answer

Intelligence is any indicator of compromise that has been assigned a confidence score by an automated feed.

Answer

Intelligence is raw logs and packet captures collected from sensors, while data is the final report delivered to stakeholders.

Question 9

A newly hired CTI analyst at a regional bank is asked to define the organization's intelligence requirements before any feeds are purchased. The CISO wants to ensure collection efforts remain focused and measurable. Which activity should the analyst perform FIRST?

Accepted Answer

Identify the key intelligence questions that align with the bank's critical assets and business risks.. The Planning and Direction phase begins with defining what the organization needs to know, expressed as key intelligence questions tied to critical assets and business risk. Only after those requirements exist can the analyst sensibly choose sources, tools, and sharing mechanisms. Purchasing feeds, standing up TAXII infrastructure, or scanning the estate may all happen later, but none of them establish the focus and measurability the CISO requested.

Answer

Subscribe to as many open-source and commercial feeds as the budget allows to maximize coverage.

Answer

Run a full vulnerability scan of the bank's internet-facing estate to enumerate what attackers could target.

Answer

Deploy a TAXII 2.1 server so external partners can push indicators directly into the bank's SIEM.

Question 10

An analyst receives a raw log export from a partner organization containing firewall records, proxy logs, and endpoint telemetry related to a suspected intrusion. Before any conclusions can be drawn, the analyst normalizes timestamps to UTC, deduplicates records, decodes obfuscated URLs, and translates the field names into the team's common schema. Which phase of the threat intelligence lifecycle is the analyst performing?

Accepted Answer

Processing. The threat intelligence lifecycle moves from direction and planning through collection, processing, analysis, dissemination, and feedback. The activities described, normalizing, deduplicating, decoding, and schema mapping, are the mechanical transformations that turn raw collected data into a form suitable for analysis, which is precisely the processing phase.

Answer

Analysis

Answer

Collection

Answer

Dissemination

Question 11

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

Accepted Answer

Analysis and production. The threat intelligence lifecycle comprises planning and direction, collection, processing and exploitation, analysis and production, dissemination, and feedback. Planning and direction sets requirements, processing standardizes raw data, and analysis and production turns that data into finished intelligence, so those three are the recognized phases among the choices.

Answer

Vulnerability remediation

Answer

Penetration testing

Question 12

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

Accepted Answer

Cybercriminal, because the group's consistent objective is financial gain through monetization of stolen data.. Motivation classification depends on the actor's persistent objective. This group repeatedly takes payment records and converts them to cash through underground carding markets, with no political, ideological, or espionage aim. That pattern defines a financially motivated cybercriminal actor. Tools and targets alone do not determine motivation, so the immediate monetization behavior is the decisive evidence.

Answer

Hacktivist, because the group publicizes its thefts to embarrass the victim.

Answer

Insider threat, because only someone with internal access could exfiltrate customer payment records.

Answer

Nation-state espionage actor, because payment data can be used to fund state operations.

Question 13

A junior analyst receives a raw log export and a set of unstructured vendor advisories. Before analysis can begin, the team lead asks the analyst to normalize timestamps, deduplicate records, translate foreign-language advisories, and enrich IP addresses with geolocation. Which phase of the threat intelligence lifecycle is the analyst performing?

Accepted Answer

Processing. The Processing phase sits between Collection and Analysis and Production, and its purpose is to convert raw, heterogeneous data into a normalized, deduplicated, enriched format that analysts can reason over. Timestamp normalization, translation, and geolocation enrichment are textbook processing operations. Dissemination and Analysis and Production occur later, after the data has been made consistent and comparable.

Answer

Collection

Answer

Dissemination

Answer

Analysis and Production

Question 14

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

Accepted Answer

Publicly accessible social media posts and forum discussions about threat actors. OSINT is defined by public availability without restriction, which covers public vulnerability databases, vendor advisories, social media, and open forums. Closed peer-sharing groups, licensed commercial feeds, and classified government briefings all have access controls or legal restrictions that place them outside the open-source category, even when their content is high quality and relevant to the same intelligence requirements.

Answer

A commercial feed purchased under a licensing agreement with restricted redistribution

Answer

A closed peer-sharing group where members exchange indicators under a non-disclosure agreement

Answer

Indicators obtained from a government agency through a classified briefing

Question 15

A threat intelligence manager is briefing new analysts on the differences between strategic, operational, and tactical intelligence. Which TWO of the following products are best characterized as strategic intelligence? (Choose two.)

Accepted Answer

A board-level brief on how a new data residency regulation could change the organization's exposure and intelligence priorities.. Strategic intelligence serves executive decision-making over long horizons, connecting threat trends to policy, regulation, budget, and risk appetite. The year-ahead geopolitical assessment and the board-level regulatory brief both operate at that altitude. Campaign infrastructure mapping, tactical indicator feeds, and weekly sector exploitation summaries support near-term defensive action, which places them in the operational or tactical tiers rather than the strategic one.

Answer

A report mapping a specific adversary's current campaign infrastructure to help the SOC tune detection rules this quarter.

Answer

A weekly summary of exploited vulnerabilities observed in the organization's industry sector.

Answer

A daily feed of newly observed malware hashes and command-and-control domains pushed to the SIEM.