312-85 Introduction TO Threat Intelligence — Timed 20 Questions

Question 1

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

20 minute time limit — choose an answer to begin.

Accepted Answer

Check if the API Key has the 'Read' permission for the specific Collection ID requested. The 403 error specifically indicates that the client is authenticated but lacks the necessary permissions to access the requested Collection ID.

Answer

Verify the Discovery Service URL in the client configuration

Answer

Change the polling interval from 60 seconds to 300 seconds

Answer

Validate the TLS handshake certificate chain

Question 2

You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?

Accepted Answer

targets. In STIX 2.1, the 'targets' relationship type is used to link a Malware object to a Vulnerability object, indicating that the malware exploits or targets that vulnerability. The STIX 2.1 relationship vocabulary explicitly defines 'targets' for this malware-to-vulnerability semantic, making it the correct choice for documenting exploitation intent.

Answer

attributed-to

Answer

uses

Answer

indicates

Question 3

You have noticed high-frequency beaconing to a domain that was recently registered. In the context of threat intelligence, how is this categorized?

Accepted Answer

Technical Intelligence. Newly Registered Domains (NRDs) are a common indicator of malicious activity often used for C2 infrastructure.

Answer

Tactical Intelligence

Answer

Operational Intelligence

Answer

Strategic Intelligence

Question 4

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

Accepted Answer

Intrusion Set / Threat Actor identity. In the Diamond Model of Intrusion Analysis, the Adversary node represents the actor conducting the intrusion, and its two primary components are the adversary's identity (often expressed as an Intrusion Set or Threat Actor) and the adversary's motivation, so options A and D are correct. Option A is right because the Intrusion Set / Threat Actor identity captures who is responsible for the activity, which is the core of the Adversary vertex. Option D is right because motivation explains why the adversary is conducting the operation and is the second defining component of the Adversary node. Option B is incorrect because Network infrastructure belongs to the Infrastructure node, not the Adversary node. Option C is incorrect because the Target organization's industry is part of the Victim node's characterization, not the Adversary. Option E is incorrect because Malware capabilities belong to the Capability node of the Diamond Model.

Answer

Network infrastructure

Answer

Target organization's industry

Answer

Malware capabilities

Question 5

Which THREE of the following are considered 'Tactical' intelligence products? (Choose three)

Accepted Answer

Malicious IP address blacklists. Tactical intelligence is specific, actionable data used for immediate defense.

Answer

Long-term industry threat trend analysis

Answer

Executive risk assessment reports

Question 6

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Accepted Answer

Aggregating and deduplicating indicators from multiple sources. Option A is correct because the Processing phase converts raw collected data into usable intelligence by aggregating indicators from multiple feeds and deduplicating overlapping entries so analysts do not work with redundant IOCs. Option C is correct because encrypted or otherwise obfuscated intelligence feeds must be decrypted during Processing to make their contents readable and machine-parseable before analysis. Option E is correct because Processing includes normalizing data into a standard schema such as STIX/TAXII so that indicators from heterogeneous sources share consistent fields and can be correlated. Option B is not part of Processing; presenting findings to the board belongs to the Dissemination phase, where finished intelligence is delivered to stakeholders. Option D is not part of Processing either; identifying new intelligence requirements occurs in the Direction/Planning phase, which defines what the intelligence effort should collect.

Answer

Presenting findings to the board of directors

Answer

Identifying new intelligence requirements

Question 7

Which THREE of the following are examples of 'Operational' intelligence? (Choose three)

Accepted Answer

Knowledge of the adversary's staging infrastructure setup. Operational intelligence focuses on the 'how' of an attack, such as TTPs and campaign patterns.

Answer

A 5-year forecast of the global cyber-insurance market

Answer

A list of specific server ports to block

Answer

Analysis of an adversary's preferred lateral movement techniques

Question 8

A small retail company has no dedicated security team and only wants to know which ransomware families are actively targeting its industry so it can prioritize patching. Which category of threat intelligence best matches this need?

Accepted Answer

Tactical threat intelligence. Tactical threat intelligence provides the concrete TTPs, malware families, and vulnerabilities that adversaries are actively using, making it directly actionable for a small team deciding which patches to prioritize. Strategic and operational categories describe higher-level trends and campaigns that do not translate into immediate patching priorities, while technical intelligence is limited to atomic machine-readable artifacts.

Answer

Technical threat intelligence

Answer

Strategic threat intelligence

Answer

Operational threat intelligence

Question 9

A multinational retailer's SOC receives a finished intelligence report stating that a known ransomware group is actively targeting the retail sector with a new phishing lure. The report includes the group's name, known TTPs, and recommended mitigations. The CISO asks the threat intelligence analyst to classify this product. Which type of threat intelligence does this report represent?

Accepted Answer

Tactical threat intelligence. The report provides TTPs and mitigations for a specific threat, which are hallmarks of tactical threat intelligence. Tactical intelligence is consumed by SOC analysts and incident responders to enhance detection and response. It differs from strategic intelligence, which informs business strategy, and operational intelligence, which focuses on attack planning and logistics.

Answer

Strategic threat intelligence

Answer

Operational threat intelligence

Answer

Technical threat intelligence

Question 10

A threat intelligence analyst is tasked with creating a threat model for a new web application. The analyst must identify the key components of the threat intelligence process that ensure the model remains relevant and actionable. Which two of the following are essential elements of the threat intelligence lifecycle that directly support this goal? (Choose two.)

Accepted Answer

Requirements definition. Requirements definition ensures the threat model addresses the right threats by aligning with stakeholder needs, while analysis transforms data into actionable insights. Together, they directly support relevance and actionability. Dissemination, collection, and feedback are important but do not shape the model's core content during creation.

Answer

Feedback

Answer

Dissemination

Answer

Collection

Question 11

A threat intelligence analyst is assessing the 'reliability' of a human source who provided information about a planned attack. The source has previously provided accurate but incomplete information. According to the Admiralty Code, which rating should the analyst assign to this source?

Accepted Answer

B - Usually reliable. The Admiralty Code rates source reliability from A (completely reliable) to F (cannot be judged). A source that provides accurate but incomplete information is usually reliable, as it has demonstrated accuracy but not completeness. Therefore, B is the appropriate rating, reflecting that the source is generally trustworthy but may require corroboration.

Answer

D - Not usually reliable

Answer

C - Fairly reliable

Answer

A - Completely reliable

Question 12

A financial services firm wants to improve its defense against a specific ransomware group that has been targeting the sector. The CISO asks the threat intelligence team to produce a report that describes the group's typical intrusion techniques, the tools it uses, and how those map to observable behaviors on endpoints. Which type of threat intelligence product best fits this request?

Accepted Answer

Tactical threat intelligence. Tactical threat intelligence focuses on adversary TTPs, tools, and observable behaviors that support detection and hunting. The request for techniques, tools, and endpoint behaviors maps directly to this layer. Strategic intelligence targets leadership decision-making, operational intelligence covers campaign-level intent and timing, and technical intelligence covers atomic indicators, none of which fully matches the requested technique-level detail.

Answer

Technical threat intelligence

Answer

Operational threat intelligence

Answer

Strategic threat intelligence

Question 13

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

Accepted Answer

The IP addresses of the Command and Control servers used. In the Diamond Model of Intrusion Analysis, the four core nodes are Adversary, Capability, Infrastructure, and Victim. The Infrastructure node represents the physical or logical resources the adversary uses to deliver capabilities and maintain control — most commonly C2 servers, IP addresses, domains, and staging points. Since the question asks what belongs in Infrastructure, the IP addresses of the Command and Control servers are the correct fit.

Answer

The time of day the attack occurred

Answer

The specific malware hash used in the attack

Answer

The adversary's primary motivation

Question 14

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

Accepted Answer

Create a custom CSV mapping template in the 'Import' module. MISP's CSV import module supports saved mapping templates that let you define which CSV column maps to which MISP attribute field (e.g., 'Category', 'Type', 'to_ids'). Creating a custom template persists the column-to-field mapping so every future import using that template parses Category correctly without manual intervention. This is the designed, repeatable mechanism for structured CSV ingestion in MISP.

Answer

Change the file extension to .misp

Answer

Manually edit each indicator after the import is complete

Answer

Use the MISP API to overwrite the database schema

Question 15

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in AWS accounts, including who made API calls, when, from where, and with what credentials. Unauthorized API key usage would appear as anomalous or unexpected API calls in CloudTrail logs, making it the most directly relevant CTI source for investigating compromised or misused credentials.

Answer

AWS GuardDuty

Answer

AWS WAF

Answer

AWS Inspector

Answer

AWS Config

Question 16

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Accepted Answer

Define specific PIRs regarding third-party software vendors and update frequency. The Direction phase translates broad stakeholder intent into actionable intelligence requirements. Refining 'Supply Chain threats' into specific Priority Intelligence Requirements (PIRs) — such as which third-party vendors, what indicators, and how often to refresh — makes collection and production measurable and scoped. This is exactly what the Direction phase demands: turning vague asks into defined, answerable questions.

Answer

Ignore the request until more data is available

Answer

Purchase all available supply chain threat reports

Answer

Automate the collection of all supply chain news

Question 17

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Accepted Answer

Processing. Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.

Answer

Collection

Answer

Dissemination

Answer

Analysis

Question 18

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

Accepted Answer

Command and Control. Command and Control (C2) is the Cyber Kill Chain phase where an adversary establishes a persistent communication channel with compromised systems to issue commands and exfiltrate data. Persistent communication with an external host is the defining characteristic of C2, typically using protocols like HTTP/S, DNS, or custom beacons to evade detection. Exploitation and Installation precede C2, while Actions on Objectives follow it.

Answer

Exploitation

Answer

Installation

Answer

Actions on Objectives

Question 19

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Accepted Answer

The interval between the occurrence of a threat and the availability of intelligence. Timeliness in threat intelligence measures the latency between when a threat event occurs and when intelligence about it becomes available to defenders. It is a core quality dimension alongside relevance, accuracy, and completeness, and it directly affects how actionable intelligence is — stale intel may describe threats that have already been mitigated or evolved.

Answer

The length of the intelligence report

Answer

The number of IOCs provided per month

Answer

The accuracy of the threat actor attribution

Question 20

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Accepted Answer

A list of known malicious file hashes. An IOC is a piece of forensic evidence that indicates a system has been compromised.

Answer

A description of an adversary's motivation

Answer

A whitepaper on general cybersecurity trends

Answer

An organization's security policy document