312-85 Threat Intelligence IN SOC IR And Risk Management Practice Test 2 — 15 Questions

Question 1

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Planning and Direction. The Planning and Direction phase of the intelligence cycle is where the organization defines its intelligence requirements, including identifying which threat actors (e.g., specific APT groups) are likely to target it. This drives the collection and analysis that follow. Determining whether you are a target for a specific APT is a requirements-setting activity, which belongs here.

Answer

Dissemination

Answer

Processing

Answer

Collection

Question 2

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the industry-standard framework for mapping adversarial techniques and identifying gaps in security controls.

Answer

STRIDE

Answer

OSINT

Answer

CVSS

Question 3

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Accepted Answer

join. The `join` operator in KQL is the correct choice because it combines rows from two tables (e.g., a ThreatIntelligenceIndicator table and a DeviceEvents/DeviceLogs table) based on a matching key column such as IP address, file hash, or domain. This is exactly the operation needed to correlate TI indicator data with device telemetry for Living off the Land hunting. `join` supports inner, leftouter, rightouter, fullouter, and anti/leftanti/semi variants, giving analysts flexibility in matching indicators to observed activity.

Answer

merge

Answer

lookup

Answer

union

Question 4

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Accepted Answer

Strategic. Strategic threat intelligence is tailored for senior leadership and decision-makers, focusing on high-level trends, adversary motivations, geopolitical context, and risk to the business — exactly what informs budget allocation and long-term security investment. It answers 'what threats matter to our organization and how should we prioritize resources?' rather than providing technical indicators or TTP-level detail. Because management needs a summary to justify spending, strategic reporting is the correct audience-appropriate choice.

Answer

Technical

Answer

Operational

Answer

Tactical

Question 5

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Accepted Answer

Indicators of Compromise. The Indicators of Compromise (IOCs) section is the most critical for incident responders because it contains the concrete, actionable artifacts — file hashes, IP addresses, domain names, registry keys, mutexes — that responders use to search their environment for signs of the malware. Without IOCs, responders cannot perform the host and network sweeps needed to confirm local presence. Attribution, mitigation, and executive summary provide context but do not enable detection.

Answer

Threat Actor Attribution

Answer

Mitigation Strategy

Answer

Executive Summary

Question 6

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

Accepted Answer

Commercial threat feed. A commercial threat feed is a classic 'push' source because the vendor proactively delivers indicators and reports to the subscriber without the subscriber having to request each item — data flows outward from provider to consumer. Push sources are characterized by automated, scheduled, or real-time delivery of curated intelligence, often via API, TAXII, or email. This contrasts with pull sources, where the analyst must actively query or retrieve data.

Answer

Internal log analysis

Answer

Packet capture

Answer

Manual web research

Question 7

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Accepted Answer

Reduces false positives from stale indicators. Setting an expiration time on STIX/TAXII indicators ensures that the SIEM automatically stops using them after a defined period. Threat intelligence indicators often have a limited useful lifespan; after that, they may become irrelevant or even lead to false positives. By expiring stale indicators, the SIEM reduces false positives and maintains detection accuracy.

Answer

Increases ingestion speed

Answer

Decreases storage costs

Answer

Complies with GDPR

Question 8

You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?

Accepted Answer

Blocking legitimate business traffic. Automated blocking without human verification means the firewall acts on TI indicators (IPs, domains, hashes) immediately, and if the feed contains false positives — such as shared hosting IPs, CDN ranges, or legitimate SaaS domains — the organization blocks its own business traffic. This is the primary operational risk because it directly impacts availability and user productivity. Human verification (or at least a staging/allowlist review) is required to prevent TI-driven outages.

Answer

Increased malware infection rate

Answer

Overloading the SIEM

Answer

Higher license costs

Question 9

Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?

Accepted Answer

Industry vertical focus. Option A (Industry vertical focus) is correct because threat intelligence relevance depends on whether the feed targets threats, actors, and campaigns specific to your sector (e.g., finance, healthcare, energy), since adversaries and TTPs differ by industry. Option C (Technology stack alignment) is correct because a feed is only actionable if it covers the platforms, software, and vulnerabilities you actually run — indicators for products absent from your environment add noise rather than detection value. Option D (Geographical region coverage) is correct because threats are often region-specific (e.g., APT groups, regional fraud campaigns, local regulatory-targeted attacks), so feeds must cover the geographies where you operate and host infrastructure. Option B (Number of API calls) is not a relevance factor but a technical/operational integration metric affecting throughput and licensing, not whether the intelligence matches your threat profile. Option E (Cost of the feed) is a budgetary/procurement consideration, not an indicator of whether the intelligence is relevant to your organization's risk exposure.

Answer

Number of API calls

Answer

Cost of the feed

Question 10

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Accepted Answer

Delivering intelligence in a usable, timely format. Dissemination is the phase in the threat intelligence lifecycle where finished intelligence is delivered to the consumers who need it — in this case, the IR team — in a format and timeframe that makes it actionable. The key characteristics are timeliness, relevance, and usability: raw or unformatted intel is useless if responders cannot quickly parse it during an active incident. This phase bridges collection/analysis and operational action, ensuring the IR team receives indicators, context, and prioritization aligned to their response playbooks.

Answer

Defining incident response procedures

Answer

Validating the data source reliability

Answer

Archiving incident data

Question 11

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Accepted Answer

Enrichment with context. During the Processing phase of the intelligence cycle, raw collected data is converted into a usable, standardized form, so enrichment with context (B) is correct because adding contextual metadata such as source reputation, geolocation, timestamps, or threat actor associations increases the value and interpretability of the data. Normalization of data formats (C) is correct because converting disparate formats (for example, timestamps to a common standard like ISO 8601 or IP addresses to a consistent notation) enables correlation and comparison across sources. Deduplication of entries (D) is correct because removing redundant records reduces noise, storage overhead, and analyst confusion, directly improving data quality and integrity. Physical media scanning (A) belongs to the Collection phase, where data is actually gathered from sources, not processed. Executive sign-off (E) is a management/approval activity that occurs outside the technical Processing phase and does not contribute to data quality.

Answer

Physical media scanning

Answer

Executive sign-off

Question 12

Which TWO components are mandatory for a valid STIX 2.1 'Indicator' object to function within an automated ingestion system?

Accepted Answer

pattern. In STIX 2.1, the Indicator SDO requires the 'pattern' property (option C), which contains the actual detection expression (e.g., a STIX Patterning string) that an automated ingestion system parses and matches against telemetry, making it mandatory for the object to function. The 'pattern_type' property (option D) is also required because it tells the consuming tool which patterning language/specification the pattern uses (e.g., 'stix'), so the pattern can be correctly interpreted; without it the pattern cannot be reliably evaluated. By contrast, 'created_by_ref' (option A) is optional and only identifies the Identity that created the object, 'valid_from' (option B) is optional and merely indicates when the Indicator is considered valid, and 'confidence' (option E) is optional and expresses a subjective confidence level — none of these are needed for the Indicator's detection logic to be ingested and processed.

Answer

created_by_ref

Answer

valid_from

Answer

confidence

Question 13

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

Accepted Answer

Initiate threat hunting across endpoints. High-confidence indicators should be validated against internal logs, the firewall/proxy should be updated to block the activity, and the threat should be hunted for historical presence.

Answer

Disable all network interfaces

Answer

Publicly disclose the intelligence

Question 14

Which TWO aspects of a threat intelligence report are most useful for long-term strategic risk management decisions?

Accepted Answer

Long-term trend forecasting. Long-term trend forecasting (A) is correct because strategic risk management depends on understanding how the threat landscape evolves over quarters and years, enabling investment and policy decisions rather than immediate tactical fixes. Threat actor motivation analysis (C) is also correct because knowing why adversaries target an organization or sector informs durable, strategic defenses such as sector-wide controls, governance priorities, and risk appetite. Incident response ticket numbers (B) are operational tracking artifacts with no strategic value. Specific file hashes (D) are tactical indicators used for detection and blocking, and firewall rule recommendations (E) are tactical/technical controls, neither of which supports long-term strategic planning.

Answer

Incident response ticket numbers

Answer

Specific file hashes

Answer

Firewall rule recommendations

Question 15

Which THREE of the following are considered 'Internal' sources of threat intelligence for a SOC?

Accepted Answer

EDR platform alerts. Internal threat intelligence comes from telemetry and artifacts generated inside the organization's own environment. Option A (EDR platform alerts) is correct because endpoint detection and response tools continuously collect host-level events, process behavior, and indicators from the organization's own endpoints, making them a first-party internal source. Option C (SIEM logs) is correct because the SIEM aggregates and correlates logs from internal sources such as firewalls, servers, and authentication systems, producing intelligence derived from the organization's own infrastructure. Option D (Incident response reports) is correct because IR documentation captures lessons learned, observed TTPs, and IOCs from actual incidents handled within the organization, which is inherently internal intelligence. Option B (Twitter feeds) is not internal because it is an open-source, external social media source, and Option E (Commercial threat feeds) is not internal because it is a paid third-party subscription service providing externally sourced intelligence.

Answer

Twitter feeds

Answer

Commercial threat feeds