312-85 Multiple Select — 50 Questions

Question 1

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Accepted Answer

Defense Evasion. Persistence (D) is the ATT&CK tactic explicitly defined as techniques adversaries use to keep access to systems across restarts, changed credentials, or other interruptions, making it the core answer for maintaining a presence. Privilege Escalation (E) is commonly involved because adversaries need higher-level permissions (e.g., SYSTEM or root) to install durable persistence mechanisms such as services, scheduled tasks, or registry Run keys that survive reboots. Defense Evasion (C) is also involved because maintaining a foothold requires hiding artifacts and activity from security tools, for example by disabling logging, obfuscating scripts, or masquerading as legitimate processes. Exfiltration (A) is about stealing data out of the environment and does not itself maintain access, and Reconnaissance (B) is information gathering before compromise, so neither belongs to the persistence-focused tactics.

Answer

Exfiltration

Answer

Reconnaissance

Question 2

You are a CTI analyst tasked with creating a threat intelligence report for your organization's security operations center (SOC). The SOC team needs to quickly detect and respond to a newly identified adversary campaign. Which two elements are most critical to include in this report? (Choose two.)

Accepted Answer

MITRE ATT&CK techniques and tactics used by the adversary.. IOCs and MITRE ATT&CK techniques are critical for SOC detection and response. IOCs provide specific artifacts to hunt for, while ATT&CK mappings describe adversary behaviors, enabling comprehensive defense. Other elements like geopolitical context or policy recommendations are valuable for different audiences but do not directly support the SOC's operational needs.

Answer

Recommendations for strategic policy changes to the board.

Answer

A detailed narrative of the adversary's geopolitical motivations.

Answer

A comprehensive list of all threat actors known to use similar TTPs.

Question 3

A hunter is investigating anomalous DNS activity on an internal resolver. Several endpoints are issuing high volumes of queries for long, random-looking subdomains under a single registered domain, with responses that are mostly NXDOMAIN but occasionally resolve. Which TWO detection approaches would most effectively confirm whether this is DNS tunneling or domain generation algorithm activity? (Choose two.)

Accepted Answer

Correlate the timing and volume of queries with the process that initiated them using endpoint DNS client event telemetry.. Confirming DNS tunneling or DGA activity requires both statistical characterization of the query names and attribution to the originating process. Measuring query length and entropy against a per-endpoint baseline exposes algorithmically generated or encoded names, while endpoint DNS client telemetry ties those queries to the specific binary responsible. Together these methods produce defensible evidence rather than relying on blocklists.

Answer

Review the resolver's cache hit ratio and increase the TTL on all cached records to reduce query volume.

Answer

Search the SIEM for the registered domain across historical proxy logs and add it to a watchlist if it appears in any HTTP request.

Answer

Block all outbound DNS at the perimeter and force every endpoint to use DNS over HTTPS to a public resolver.

Question 4

A threat hunter is investigating possible data staging prior to exfiltration on a file server. The hunter has full Windows Security auditing, Sysmon, and PowerShell logging available. Which TWO telemetry patterns most directly indicate that an adversary is staging and compressing collected data on the host? (Choose two.)

Accepted Answer

A single process creating a large number of file read operations across many directories within a short window, followed by writes to one new archive file.. Staging is characterized by broad collection followed by consolidation into a single archive, and by archiving that deviates from normal administrative patterns. Reading many directories then writing one archive, and creating an encrypted archive with a non-standard extension from a web server parent, both directly evidence that behavior.

Answer

Repeated DNS queries from the server to a single external domain at irregular intervals with varying query types.

Answer

A high volume of failed authentication attempts against the file server from multiple internal workstations.

Answer

Scheduled tasks created by the built-in backup service account to copy files to a known backup share each night.

Question 5

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Accepted Answer

Logon Type 3 occurring from a workstation to a workstation. Option A is correct because Pass-the-Hash (PtH) abuses NTLM authentication to move laterally, and a Logon Type 3 (network logon) from one workstation to another is abnormal in most environments and is a classic signature of PtH lateral movement using stolen NTLM hashes. Option B is correct because a successful logon originating from an unexpected or unusual source IP indicates an attacker is authenticating with compromised credentials/hashes from a host that should not be initiating such access, which is a strong PtH indicator. Option D is correct because PtH relies on NTLM authentication (the hash is replayed directly), so observing NTLM authentication where Kerberos would normally be expected (e.g., in a domain environment that supports Kerberos) is a strong indicator of hash-based authentication abuse. Option C is not a PtH indicator because successful local service startup is normal system behavior and unrelated to credential theft or replay. Option E is not a PtH indicator because a high volume of Kerberos TGS requests suggests Kerberos ticket activity (e.g., Kerberoasting or normal service ticket requests), not NTLM hash replay.

Answer

Success of local service startup

Answer

High volume of Kerberos TGS requests

Question 6

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Accepted Answer

Mitigation suggestions. Operational teams need context on the threat and the specific technical indicators to look for.

Answer

The history of the geopolitical tension

Answer

The stock price of the vendor

Answer

The full raw database dump

Question 7

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Accepted Answer

Reconnaissance. Reconnaissance (A) is effectively defended at the network level because controls such as firewalls, IDS/IPS, and DNS/WHOIS privacy can hide or limit the information an adversary gathers during active scanning and enumeration. Delivery (B) is a network-level phase since malicious payloads arrive via email, web downloads, or exploit kits, and controls like secure email gateways, web proxies, and IPS signatures can block or quarantine them in transit. Command and Control (E) is also network-defensible because C2 traffic relies on protocols such as HTTP/HTTPS, DNS, or custom ports, and egress filtering, DNS sinkholing, and NGFW/IDS detection can disrupt beaconing. Installation (C) typically occurs on the endpoint after code execution, so it is better addressed by host-based controls like EDR, application allowlisting, and patching rather than network controls. Actions on Objectives (D) happen post-compromise on internal systems and data, requiring host, identity, and data-level defenses such as EDR, least privilege, and DLP instead of purely network-level security.

Answer

Installation

Answer

Actions on Objectives

Question 8

You are building a link analysis chart to map an intrusion set's operational infrastructure. You have collected domain registrations, malware sample hashes, and command-and-control IP addresses, but you need to select additional data elements that will produce meaningful links rather than coincidental ones. (Choose two.)

Accepted Answer

Passive DNS resolution history showing which domains resolved to the same C2 IP within the campaign window.. Meaningful links in infrastructure analysis require artifacts with low base rates and temporal alignment to the campaign. TLS certificate serials and issuer strings are reused by adversaries across C2 servers, and passive DNS history connects domains to C2 IPs within the campaign window. Both produce defensible clusters, unlike shared privacy WHOIS addresses, coarse geolocation, or aggregate detection counts.

Answer

The total number of malware detections reported for each hash across all customers of your antivirus vendor.

Answer

The geographic country of the IP addresses based solely on a commercial geolocation database.

Answer

The registrar's generic WHOIS privacy email address used by thousands of unrelated domains.

Question 9

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Accepted Answer

Cross-referencing indicators across multiple sources.. Option C (Cross-referencing indicators across multiple sources) is correct because corroborating an indicator such as an IP address, domain, or file hash against independent feeds reduces false positives and increases confidence in its accuracy and relevance. Option D (Validating the source authenticity) is correct because confirming that a feed genuinely originates from a trusted, reputable provider (for example via signed feeds, verified credentials, or established reputation) prevents ingestion of spoofed or poisoned intelligence that would degrade reliability. Option A is wrong because metadata such as timestamps, confidence scores, and provenance is essential for assessing indicator freshness and trustworthiness, so removing it harms reliability. Option B is wrong because increasing ingest frequency only refreshes data faster; it does not improve the accuracy or trustworthiness of the intelligence itself. Option E is wrong because automatically trusting all feeds is the opposite of reliability, as it allows unvetted or malicious data to enter the pipeline unchecked.

Answer

Removing all metadata.

Answer

Increasing the ingest frequency.

Answer

Automatically trusting all feeds.

Question 10

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Accepted Answer

Tasking collection assets and monitoring the flow of raw intelligence data. Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.

Answer

Conducting corporate financial payroll audits

Answer

Configuring office building climate control thermostats

Answer

Writing custom assembly code for rootkit deployment

Question 11

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

Accepted Answer

The adversary's phishing email address and spoofed sender domain. Infrastructure in the Diamond Model comprises the physical and logical communication structures the adversary uses, such as command-and-control domains, IP addresses, and phishing email addresses or spoofed sender domains. These elements enable the adversary to deliver capabilities and maintain control. Malware and exploits are Capability, victim assets are Victim, and adversary personas are Adversary, so those options do not belong to Infrastructure.

Answer

The adversary's social media profile used for reconnaissance

Answer

The victim organization's internal file server hostname

Answer

The specific malware family and exploit code used in the attack

Question 12

A threat intelligence analyst is processing a new feed that contains indicators of compromise (IOCs) in STIX 2.1 format. Before ingesting the data into the internal platform, the analyst must validate that the STIX objects conform to the specification. Which two of the following are required properties for a STIX 2.1 'Indicator' object? (Choose two.)

Accepted Answer

pattern_type. In STIX 2.1, an Indicator object must include the 'pattern' and 'pattern_type' properties. The 'pattern' contains the detection logic, and 'pattern_type' specifies the language of that pattern. Other properties like 'name', 'description', and 'valid_from' are optional and provide context but are not required for the object to be valid.

Answer

name

Answer

description

Answer

valid_from

Question 13

Which TWO methods are effective for visualizing threat actor TTPs within a CTI report?

Accepted Answer

Flow diagrams illustrating the attack execution sequence.. Option D is correct because flow diagrams (e.g., attack trees or sequence diagrams) map the ordered execution of adversary tactics, techniques, and procedures, making the attack chain and dependencies between steps immediately understandable to analysts and decision-makers. Option E is correct because heat maps aggregate TTP frequency or coverage data into a visual density representation, letting readers quickly spot the most prevalent or least-defended techniques across a campaign or sector. Both visualizations align with CTI reporting goals of conveying behavioral patterns rather than isolated artifacts. Option A does not belong because a bibliography is a reference list, not a visualization of TTPs. Option B does not belong because a photograph of a threat actor provides no technical insight into their tradecraft and is often unavailable or unreliable. Option C does not belong because a raw list of every log entry is unstructured telemetry, not a visualization, and would obscure rather than reveal TTP patterns.

Answer

A bibliography of all external sources.

Answer

A photograph of the threat actor.

Answer

A raw list of every log entry captured.

Question 14

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

Accepted Answer

Systematically testing evidence against every hypothesis.. Option A is correct because ACH requires evaluating each piece of evidence against all competing hypotheses in a matrix, which exposes inconsistencies and prevents premature anchoring on a favored theory. Option D is correct because ACH emphasizes disconfirmation—actively seeking evidence that refutes a hypothesis—since a single credible disconfirming item can eliminate a hypothesis more decisively than confirming evidence can support it. Options B, C, and E are incorrect: weighting by personal intuition reintroduces the very bias ACH is designed to counter, focusing only on supporting evidence is confirmation bias, and limiting analysis to a single hypothesis defeats the comparative purpose of ACH.

Answer

Assigning weights based on personal intuition.

Answer

Focusing only on the evidence that supports your primary theory.

Answer

Limiting the number of hypotheses to one.

Question 15

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Accepted Answer

The vendor's track record for providing accurate, validated intelligence. Option A is correct because a vendor's historical accuracy and validation of intelligence directly determine whether its feeds can be trusted for detection and response decisions. Option B is correct because consistent reporting over time demonstrates reliability, reduces gaps in coverage, and shows the vendor is not sporadic or reactive. Option E is correct because transparency about methodology allows analysts to assess data provenance, collection sources, and analytical rigor, which is essential for trusting the intelligence. Option C is not correct because raw indicator volume without context is a poor reliability metric and can increase false positives. Option D is not correct because social media follower counts reflect popularity, not the technical quality or accuracy of threat intelligence.

Answer

The volume of indicators provided without context

Answer

The number of social media followers the vendor has

Question 16

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

Accepted Answer

pattern. For a STIX 2.1 Indicator SDO to be well-formed, the required common properties are type (C) and id (D), plus the Indicator-specific required property pattern (A). The type field must be present and set to the exact string 'indicator' so parsers can identify the SDO, while id must be a valid STIX identifier of the form indicator--<UUIDv4> that uniquely identifies the object. The pattern field is mandatory because it carries the actual detection logic (e.g., a STIX Patterning expression such as [file:hashes.'SHA-256' = '...']), and without it the Indicator has no content to match. By contrast, description (B) is optional human-readable context, and valid_until (E) is an optional timestamp bounding the indicator's validity, so neither is required for well-formedness.

Answer

description

Answer

valid_until

Question 17

You are a threat intelligence analyst at a financial institution. Your team is preparing to share a report on a recent ransomware campaign with a trusted partner via a TAXII 2.1 collection. To ensure the report is correctly interpreted and the sharing complies with internal policies, which two actions must you take before dissemination? (Choose two.)

Accepted Answer

Apply a TLP marking to the report to indicate sharing restrictions.. Before sharing via TAXII, you must apply the appropriate TLP marking to communicate handling restrictions and verify that the recipient is authorized to receive information at that TLP level. These steps ensure compliance with sharing policies and prevent unauthorized disclosure. Other actions like PGP encryption or PDF conversion are not standard requirements.

Answer

Convert the report to PDF format to preserve formatting.

Answer

Include a disclaimer that the information is provided 'as is' without warranty.

Answer

Encrypt the report using PGP before sending it via TAXII.

Question 18

A threat intelligence analyst is preparing to analyze a large set of intrusion artifacts collected from multiple sensors. She wants to apply structured analysis techniques to reduce bias and improve the defensibility of her conclusions. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

Analysis of Competing Hypotheses to evaluate alternative explanations against evidence.. Structured analytic techniques such as Analysis of Competing Hypotheses and Key Assumptions Check are designed to reduce cognitive bias and make reasoning transparent. ACH forces consideration of alternative explanations and highlights diagnostic evidence, while a Key Assumptions Check exposes the beliefs that underpin interpretation. Together they provide a defensible, repeatable foundation for analyzing large artifact sets and communicating conclusions to decision-makers.

Answer

Devil's Advocacy to argue the opposite of the prevailing view regardless of evidence.

Answer

Timeline analysis to sequence events chronologically without assessing causality.

Answer

Brainstorming to generate as many ideas as possible without evaluating them.

Question 19

A threat hunter is investigating a suspected data exfiltration channel that uses DNS tunneling. The organization's DNS logs capture query names, query types, response codes, and source hosts, but not full packet payloads. Which TWO characteristics of the DNS queries would most reliably indicate tunneling activity rather than normal DNS behavior? (Choose two.)

Accepted Answer

Unusually long and high-entropy subdomain labels encoded in the query name.. Without payload visibility, tunneling must be inferred from query shape and type: long, high-entropy subdomain labels carry encoded data, and sustained TXT queries from one host exploit a record type and volume that normal endpoints rarely produce. Popular A-record lookups, organization-wide NXDOMAIN noise, and internal PTR queries all match benign baselines and cannot isolate a tunneling channel.

Answer

Frequent NXDOMAIN responses for typo-like domain names across the entire organization.

Answer

Queries that use the A record type for well-known public domains from many different hosts.

Answer

Periodic PTR record queries for internal RFC1918 addresses from a single host.

Question 20

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

Accepted Answer

Analysis and production. The threat intelligence lifecycle comprises planning and direction, collection, processing and exploitation, analysis and production, dissemination, and feedback. Planning and direction sets requirements, processing standardizes raw data, and analysis and production turns that data into finished intelligence, so those three are the recognized phases among the choices.

Answer

Vulnerability remediation

Answer

Penetration testing