312-85 Multiple Select — 50 Questions

Question 1

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Accepted Answer

valid_from. The Indicator object in STIX 2.1 contains specific properties including the pattern, validity period, and confidence score.

Answer

firewall_acl_rule

Answer

user_password_hash

Question 2

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 3

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Accepted Answer

number_observed. Observed data objects record the 'first_observed', 'last_observed', and 'number_observed' properties to provide context to the sighting.

Answer

vulnerability_scanner_id

Answer

root_password

Question 4

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence, Defense Evasion, and Privilege Escalation are essential for staying on a system and remaining undetected.

Answer

Exfiltration

Answer

Reconnaissance

Question 5

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Accepted Answer

Tasking collection assets and monitoring the flow of raw intelligence data. Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.

Answer

Conducting corporate financial payroll audits

Answer

Configuring office building climate control thermostats

Answer

Writing custom assembly code for rootkit deployment

Question 6

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

SHA-256 File Hash. IOCs are typically digital forensic artifacts like file hashes or network connection logs.

Answer

Server rack temperature

Answer

Employee behavior patterns

Answer

Project management timeline

Question 7

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Accepted Answer

The timeliness of the intelligence.. Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.

Answer

The size of the vendor's marketing department.

Answer

The format of the document (PDF vs CSV).

Question 8

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

Accepted Answer

Sensitive file access and data movement tracking.. Insider threats are detected via access logs, file activity, and network communication patterns.

Answer

Employee cafeteria transaction history.

Answer

Public internet speed test results.

Question 9

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Accepted Answer

The ephemeral nature of cloud assets. Cloud environments are dynamic, leading to challenges with visibility and scope.

Answer

Cloud environments are immune to malware

Answer

The total lack of logs in cloud environments

Answer

The inability to use API-based intelligence collection

Question 10

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Accepted Answer

Access Control Lists (ACLs). TAXII collections require defined access controls and content selection (filters) to ensure only authorized entities receive specific intelligence.

Answer

Database indexing strategy

Answer

Default STIX versioning

Answer

Server uptime SLA

Question 11

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Accepted Answer

Aggregating and deduplicating indicators from multiple sources. Processing is where data is made usable through normalization, aggregation, and filtering.

Answer

Presenting findings to the board of directors

Answer

Identifying new intelligence requirements

Question 12

Which THREE of the following are valid reasons to use the STIX 'Sighting' object?

Accepted Answer

To indicate the source of the observation. The Sighting object is used to indicate that an indicator was seen, provide context on the target, and show where it was detected.

Answer

To define the threat actor profile

Answer

To provide the remediation steps

Question 13

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Accepted Answer

Enrichment with context. Data quality is ensured by normalizing formats, removing duplicates, and enriching data with context from other sources.

Answer

Physical media scanning

Answer

Executive sign-off

Question 14

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

Accepted Answer

Intrusion Set / Threat Actor identity. The Adversary node includes the actors behind the threat and their intent.

Answer

Network infrastructure

Answer

Target organization's industry

Answer

Malware capabilities

Question 15

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

Accepted Answer

Centralizing threat data from multiple disparate sources. TIPs centralize and automate the management of threat data.

Answer

Providing the original source code of all malware

Answer

Eliminating all false positives

Answer

Replacing the need for a security analyst team

Question 16

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

Accepted Answer

Executive Leadership and Risk Management (CISO, CRO). Engaging Incident Response, Security Operations, and Executive Management ensures that CTI requirements align with operational needs and executive risks.

Answer

Residential landscaping contractors

Answer

External catering service providers

Question 17

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Accepted Answer

Tactical level (SIEM systems, Automated security controls, SOC analysts). Intelligence plans address strategic (executive), operational (managerial/defense), and tactical (technical/SOC) consumers.

Answer

Corporate real estate leasing committees

Answer

External consumer product marketing teams

Question 18

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

Accepted Answer

Analyst professional development, training, and industry certifications. Budget planning for CTI must account for commercial tool subscriptions, personnel training/certifications, and intelligence platform licenses.

Answer

Fleet vehicle insurance policies for corporate delivery trucks

Answer

Commercial cafeteria food and beverage restocking contracts

Question 19

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

Accepted Answer

Initiate threat hunting across endpoints. High-confidence indicators should be validated against internal logs, the firewall/proxy should be updated to block the activity, and the threat should be hunted for historical presence.

Answer

Disable all network interfaces

Answer

Publicly disclose the intelligence

Question 20

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Accepted Answer

Capability. The four core vertices of the Diamond Model are Adversary, Capability, Infrastructure, and Victim.

Answer

Network Topology

Answer

Payload