312-85 Multiple Select — 10 Questions

Question 1

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Accepted Answer

valid_from. The Indicator object in STIX 2.1 contains specific properties including the pattern, validity period, and confidence score.

Answer

firewall_acl_rule

Answer

user_password_hash

Question 2

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 3

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Accepted Answer

number_observed. Observed data objects record the 'first_observed', 'last_observed', and 'number_observed' properties to provide context to the sighting.

Answer

vulnerability_scanner_id

Answer

root_password

Question 4

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence, Defense Evasion, and Privilege Escalation are essential for staying on a system and remaining undetected.

Answer

Exfiltration

Answer

Reconnaissance

Question 5

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Accepted Answer

Tasking collection assets and monitoring the flow of raw intelligence data. Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.

Answer

Conducting corporate financial payroll audits

Answer

Configuring office building climate control thermostats

Answer

Writing custom assembly code for rootkit deployment

Question 6

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

SHA-256 File Hash. IOCs are typically digital forensic artifacts like file hashes or network connection logs.

Answer

Server rack temperature

Answer

Employee behavior patterns

Answer

Project management timeline

Question 7

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Accepted Answer

The timeliness of the intelligence.. Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.

Answer

The size of the vendor's marketing department.

Answer

The format of the document (PDF vs CSV).

Question 8

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

Accepted Answer

Sensitive file access and data movement tracking.. Insider threats are detected via access logs, file activity, and network communication patterns.

Answer

Employee cafeteria transaction history.

Answer

Public internet speed test results.

Question 9

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Accepted Answer

The ephemeral nature of cloud assets. Cloud environments are dynamic, leading to challenges with visibility and scope.

Answer

Cloud environments are immune to malware

Answer

The total lack of logs in cloud environments

Answer

The inability to use API-based intelligence collection

Question 10

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Accepted Answer

Access Control Lists (ACLs). TAXII collections require defined access controls and content selection (filters) to ensure only authorized entities receive specific intelligence.

Answer

Database indexing strategy

Answer

Default STIX versioning

Answer

Server uptime SLA