312-85 Threat Intelligence IN SOC IR And Risk Management — 20 Questions

Question 1

In Palo Alto Networks Cortex XSOAR, you are building a playbook to automate the qualification of incoming phishing alerts. Which integration command is used to calculate a 'reputation score' based on data from a connected threat intelligence platform (TIP)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

!getIndicatorScore. The '!getIndicatorScore' command is the standard XSOAR automation command used to fetch and aggregate reputation scores from all integrated threat intelligence sources.

Answer

!fetchIntel

Answer

!updateReputation

Answer

!queryTI

Question 2

When using IBM QRadar Incident Forensics, you identify an ongoing data exfiltration attempt. To integrate external TI feeds for automated IOC blocking, which configuration tab in the QRadar Log Activity app allows for immediate watchlist creation?

Accepted Answer

Offenses. The 'Offenses' tab in QRadar allows users to create watchlists or update Reference Sets directly from event data that has been enriched by threat intelligence feeds.

Answer

Deployment Editor

Answer

Log Activity

Answer

Asset Profile

Question 3

You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?

Accepted Answer

FQL. CrowdStrike Falcon Insight's Event Search interface uses Falcon Query Language (FQL) as its native query syntax. FQL is specifically designed to query the Falcon platform's event data, including process executions, network connections, and file hashes. To search for a specific file hash, you would use FQL syntax such as `aid=* hash=*` or more precisely `hash=*` with the appropriate hash type (MD5, SHA1, SHA256).

Answer

SPL

Answer

KQL

Answer

Lucene

Question 4

You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?

Accepted Answer

Relationship. In STIX 2.1, the Relationship object is the generic SDO (STIX Domain Object) that explicitly links two other SDOs or SCOs (STIX Cyber-observable Objects) via the source_ref, target_ref, and relationship_type properties. To express that a Threat Actor uses a particular Infrastructure, you create a Relationship with relationship_type 'uses', source_ref pointing to the Threat Actor, and target_ref pointing to the Infrastructure. This is the standardized mechanism for capturing associations between entities in STIX, rather than embedding them in a single object.

Answer

Indicator

Answer

Sighting

Answer

Identity

Question 5

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

Accepted Answer

threat_intel_by_str. The 'threat_intel_by_str' lookup table is the primary repository for normalized threat intelligence data that Splunk ES uses for correlation across its dashboards.

Answer

assets_by_cidr

Answer

threat_group_mapping

Answer

notable_events_summary

Question 6

A SOC analyst needs to verify if an IP address flagged by a TI feed is a known Tor exit node. Which category of threat intelligence is this information considered?

Accepted Answer

Technical. Operational intelligence provides immediate, actionable data like IP addresses or file hashes to support SOC operations.

Answer

Strategic

Answer

Operational

Answer

Tactical

Question 7

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

Accepted Answer

Export Objects. 'Export Objects' allows you to extract HTTP or DNS data, including domain names, from a PCAP file.

Answer

Follow TCP Stream

Answer

Endpoints

Answer

Expert Information

Question 8

You are using ThreatConnect to prioritize indicators. Which scoring metric is automatically calculated based on the confidence level of the source and the age of the indicator?

Accepted Answer

Threat Rating. ThreatConnect utilizes the 'Threat Rating' which is a composite score derived from source confidence and the recency of the data.

Answer

CVSS Score

Answer

Impact Factor

Answer

Risk Appetite

Question 9

Which TWO types of intelligence are most essential for an Incident Response team during an active attack investigation?

Accepted Answer

Tactical Intelligence. Tactical Intelligence (C) is essential because it provides the real-time, actionable indicators of compromise — such as malicious IPs, hashes, domains, and TTPs — that the IR team needs to detect, contain, and eradicate the attacker during an active incident. Operational Intelligence (E) is equally essential because it gives context on the attacker's ongoing operations, infrastructure, and campaign activity, enabling the team to anticipate adversary moves and coordinate the response effort. Together, tactical and operational intelligence directly support the immediate, hands-on investigation and decision-making required while an attack is in progress. Regulatory Intelligence (A) is not a recognized intelligence discipline for live incident handling; it concerns compliance and legal obligations rather than attack analysis. Market Intelligence (B) relates to business and competitive data and has no role in technical incident response. Strategic Intelligence (D) focuses on long-term, high-level trends and policy planning, which is too broad and slow-moving to guide an active attack investigation.

Answer

Regulatory Intelligence

Answer

Market Intelligence

Answer

Strategic Intelligence

Question 10

Which TWO protocols are most commonly used for the automated exchange of threat intelligence between different organizations or platforms?

Accepted Answer

TAXII. TAXII (Trusted Automated Exchange of Intelligence Information) is correct because it is the OASIS-defined application-layer protocol specifically designed to transport cyber threat intelligence between organizations, platforms, and services over HTTPS. STIX (Structured Threat Information Expression) is correct because it is the standardized language/format used to represent and share threat intelligence, and it is commonly paired with TAXII for automated exchange. ICMP is a network diagnostic and error-reporting protocol, not a threat-intelligence sharing mechanism. LDAP is a directory-access protocol used for querying directory services such as Active Directory. SNMP is used for monitoring and managing network devices, not for exchanging threat intelligence.

Answer

ICMP

Answer

LDAP

Answer

SNMP

Question 11

A SOC analyst receives a high-confidence indicator of compromise (IOC) from a trusted ISAC: a SHA-256 hash of a malicious binary. The organization's endpoint detection and response (EDR) solution supports automated response actions. The analyst wants to immediately block this hash across all endpoints. Which action should the analyst take first according to threat intelligence best practices?

Accepted Answer

Search the EDR for any historical occurrences of the hash to determine if it has already been seen in the environment.. The correct approach is to first search existing EDR telemetry for the hash. This validates whether the threat is present and helps scope the incident before implementing blocks. It prevents unnecessary disruption and ensures response actions are based on evidence. Only after confirming relevance should the analyst proceed with blocking or quarantine.

Answer

Create a ticket in the SIEM and wait for the next scheduled threat intelligence update to automatically ingest and block the hash.

Answer

Add the hash to the EDR blocklist and enable automated quarantine for any endpoint that triggers it.

Answer

Immediately push the hash to the firewall to block outbound connections to any IP address associated with the binary.

Question 12

A threat intelligence analyst is preparing a report for the SOC manager after a ransomware incident. The analyst has external feeds indicating the ransomware group's TTPs, internal logs showing initial access via a phishing attachment, and a risk assessment showing the affected business unit has a low tolerance for downtime. Which combination of intelligence types should the analyst prioritize to directly support the SOC's future detection and response efforts?

Accepted Answer

Technical intelligence about the ransomware group's TTPs and operational intelligence about the initial access vector observed in the incident.. For SOC detection and response, technical intelligence at the TTP level provides durable detection opportunities, while operational intelligence about the observed initial access vector links external threat data to the organization's specific exposure. This combination enables the SOC to build and tune detections that address the actual attack path, rather than relying on ephemeral indicators or high-level strategic context that does not translate into actionable rules.

Answer

Operational intelligence about the group's campaign timing and technical intelligence about the C2 protocol used.

Answer

Strategic intelligence about the ransomware group's geopolitical motivations and tactical intelligence about the specific phishing attachment hash.

Answer

Tactical intelligence about the phishing attachment hash and strategic intelligence about the business unit's risk tolerance.

Question 13

A threat intelligence analyst is preparing to share indicators of compromise (IOCs) with a partner organization. To ensure the sharing is effective and secure, which two considerations are most important according to threat intelligence sharing best practices? (Choose two.)

Accepted Answer

Use a standardized format such as STIX/TAXII to facilitate automated ingestion.. Using standardized formats like STIX/TAXII and ensuring the recipient can ingest and act on the indicators are crucial for effective threat intelligence sharing. These practices enable automated, efficient exchange and maximize the value of the shared data. They address both the technical and operational aspects of sharing.

Answer

Establish a formal sharing agreement that defines the terms and handling of the shared data.

Answer

Share all indicators regardless of confidence level to maximize the partner's awareness.

Answer

Encrypt the shared data using PGP to protect it from unauthorized access during transit.

Question 14

A threat intelligence analyst is evaluating a new external feed for integration into the SOC's detection stack. The feed provides indicators of compromise (IOCs) with varying confidence levels and includes some outdated IP addresses. The analyst must decide which criteria are most important to assess before operationalizing the feed. (Choose two.)

Accepted Answer

The feed's relevance to the organization's industry and the confidence level assigned to its indicators.. When operationalizing an external feed, the most critical criteria are whether the indicators are current and updated frequently, and whether they are relevant to the organization's threat profile with reliable confidence scoring. Freshness prevents stale indicators from causing false positives or missed detections, while relevance and confidence ensure the SOC focuses on threats that matter, optimizing detection fidelity and analyst time.

Answer

The feed's compatibility with the SIEM's data model and the analyst's ability to write custom parsers.

Answer

The feed's cost and the vendor's marketing materials.

Answer

The feed's format (STIX, CSV, etc.) and the number of indicators it contains.

Question 15

A SOC analyst is using threat intelligence to enhance the incident response process. The analyst wants to integrate intelligence into the IR lifecycle to improve detection, containment, and recovery. Which two actions best leverage threat intelligence during the containment phase of an incident? (Choose two.)

Accepted Answer

Use atomic indicators to block malicious IPs and domains at the perimeter.. The two correct actions are using atomic indicators to block malicious IPs and domains at the perimeter, and using operational intelligence to predict adversary next steps and prioritize containment. Both directly support the containment phase by either stopping adversary communication or guiding where to focus containment efforts. The other actions are important but belong to other phases of the IR lifecycle.

Answer

Correlate internal logs with threat intelligence to identify affected systems.

Answer

Share the incident details with the ISAC to receive additional threat intelligence.

Answer

Map adversary TTPs to MITRE ATT&CK to identify detection gaps.

Question 16

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Accepted Answer

Planning and Direction. The Planning and Direction phase of the intelligence cycle is where the organization defines its intelligence requirements, including identifying which threat actors (e.g., specific APT groups) are likely to target it. This drives the collection and analysis that follow. Determining whether you are a target for a specific APT is a requirements-setting activity, which belongs here.

Answer

Dissemination

Answer

Processing

Answer

Collection

Question 17

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the industry-standard framework for mapping adversarial techniques and identifying gaps in security controls.

Answer

STRIDE

Answer

OSINT

Answer

CVSS

Question 18

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Accepted Answer

join. The `join` operator in KQL is the correct choice because it combines rows from two tables (e.g., a ThreatIntelligenceIndicator table and a DeviceEvents/DeviceLogs table) based on a matching key column such as IP address, file hash, or domain. This is exactly the operation needed to correlate TI indicator data with device telemetry for Living off the Land hunting. `join` supports inner, leftouter, rightouter, fullouter, and anti/leftanti/semi variants, giving analysts flexibility in matching indicators to observed activity.

Answer

merge

Answer

lookup

Answer

union

Question 19

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Accepted Answer

Strategic. Strategic threat intelligence is tailored for senior leadership and decision-makers, focusing on high-level trends, adversary motivations, geopolitical context, and risk to the business — exactly what informs budget allocation and long-term security investment. It answers 'what threats matter to our organization and how should we prioritize resources?' rather than providing technical indicators or TTP-level detail. Because management needs a summary to justify spending, strategic reporting is the correct audience-appropriate choice.

Answer

Technical

Answer

Operational

Answer

Tactical

Question 20

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Accepted Answer

Indicators of Compromise. The Indicators of Compromise (IOCs) section is the most critical for incident responders because it contains the concrete, actionable artifacts — file hashes, IP addresses, domain names, registry keys, mutexes — that responders use to search their environment for signs of the malware. Without IOCs, responders cannot perform the host and network sweeps needed to confirm local presence. Attribution, mitigation, and executive summary provide context but do not enable detection.

Answer

Threat Actor Attribution

Answer

Mitigation Strategy

Answer

Executive Summary