312-85 Threat Intelligence IN SOC IR And Risk Management Practice Test 3 — 15 Questions

Question 1

A SOC analyst is building a risk-based alert prioritization model in their SIEM. They want to enrich incoming alerts with threat intelligence that reflects the organization's specific business context. Which TWO data sources should be integrated into the risk scoring to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asset criticality inventory mapping business services to hosts. Risk-based alert prioritization requires combining threat context with business impact. Industry-specific ISAC feeds supply threat indicators relevant to the organization's sector, while asset criticality maps technical assets to business services. Together they ensure alerts are scored by both the likelihood of targeting and the potential business impact, which is the essence of contextual risk scoring.

Answer

The SIEM's built-in list of common false-positive signatures

Answer

A global vulnerability database of all CVEs published this year

Answer

Raw packet captures from the DMZ spanning the last 30 days

Question 2

A threat intelligence analyst is supporting an incident response team during an active ransomware outbreak. The IR team needs to know if the ransomware strain has been observed using a specific lateral movement technique. Which action should the analyst take to provide the most actionable intelligence?

Accepted Answer

Search a threat intelligence platform for the ransomware family and its associated TTPs. During an active ransomware incident, the IR team needs specific, timely intelligence about the threat actor's known behaviors. A threat intelligence platform provides curated reports and TTP mappings for ransomware families, allowing the analyst to confirm whether a lateral movement technique is associated with the strain. This directly informs hunting and containment decisions, unlike internal logs or generic frameworks.

Answer

Submit the ransomware sample to a public sandbox and wait for the report

Answer

Query the internal SIEM for historical alerts related to the technique

Answer

Review the MITRE ATT&CK framework for all known lateral movement techniques

Question 3

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Accepted Answer

Technical intelligence containing indicators of compromise and TTPs. When scoping a potential breach, the IR team needs concrete, searchable artifacts. Technical intelligence provides indicators of compromise and TTPs that can be used to query SIEM, EDR, and network logs. This allows the team to identify affected systems quickly. Strategic, operational, and tactical intelligence provide context but lack the specificity required for immediate scoping.

Answer

Operational intelligence about upcoming campaigns in the sector

Answer

Tactical intelligence summarizing recent malware trends

Answer

Strategic intelligence reports on long-term threat actor intentions

Question 4

During an active ransomware incident, your SOC manager asks you to quickly determine whether the malware family has known lateral movement capabilities against Windows environments. Which threat intelligence product best supports this immediate need?

Accepted Answer

A technical malware analysis report detailing the family's TTPs and MITRE ATT&CK mappings. Technical threat intelligence from malware analysis is the right choice because it documents the specific behaviors and MITRE ATT&CK techniques the ransomware uses, including lateral movement. During an active incident, responders need this behavioral detail to decide on containment and hunting. Strategic, tactical, and operational products serve different purposes and lack the granular capability information required here.

Answer

A tactical feed of current IP addresses and file hashes associated with the ransomware

Answer

A strategic threat intelligence report on ransomware trends in your industry

Answer

An operational report on the ransomware group's campaign targeting patterns and victimology

Question 5

You are building a threat intelligence program for a SOC and must define processes for the 'Direction' phase of the intelligence lifecycle. Which two activities belong to this phase? (Choose two.)

Accepted Answer

Translating stakeholder feedback into revised intelligence requirements. The Direction phase involves defining intelligence requirements and continuously refining them based on stakeholder feedback. Identifying PIRs and translating feedback into revised requirements are both about setting and adjusting the focus of the intelligence program. Collection, production, and dissemination are separate lifecycle phases that occur after Direction has established what is needed.

Answer

Collecting raw data from open source and commercial feeds based on the defined requirements

Answer

Disseminating finished intelligence reports to SOC analysts and executives

Answer

Producing finished intelligence reports with recommendations for decision makers

Question 6

Your SOC has just onboarded a new premium threat intelligence feed that delivers atomic indicators with a confidence score of 85. During the first week, analysts notice that 40% of the IP addresses in the feed are sinkholed by the vendor but still resolve to live infrastructure in your environment. You need to configure your SIEM to ingest these indicators while minimizing false positives from sinkholed addresses. What should you do first?

Accepted Answer

Enrich the feed indicators with a 'sinkholed' attribute from the vendor's metadata, then create a SIEM correlation rule that lowers the risk score or excludes those indicators from alerting when the attribute is present.. Sinkholed indicators represent infrastructure controlled by researchers or vendors, not active adversary command-and-control. The proper handling is to enrich indicators with the sinkholed attribute and adjust detection logic so those indicators do not generate false positives, while retaining them for historical analysis and correlation. This balances detection fidelity with operational efficiency and avoids both blind spots and alert fatigue.

Answer

Drop the entire feed and request a new one from the vendor that contains only non-sinkholed indicators.

Answer

Set all indicators from this feed to a confidence score of zero in the SIEM so they never generate alerts.

Answer

Create a whitelist in the SIEM for all sinkholed IP ranges provided by the feed vendor and tag them as 'benign infrastructure'.

Question 7

A SOC analyst receives a threat intelligence report indicating that a new phishing campaign is targeting your industry with a specific malicious domain. The analyst wants to quickly check if any internal hosts have communicated with that domain. Which action should the analyst take first?

Accepted Answer

Search historical DNS and proxy logs for the malicious domain. The first step is to determine if any internal hosts have already communicated with the malicious domain. Searching historical DNS and proxy logs provides that answer quickly using existing data. Blocking, sandboxing, and creating future alerts are all useful but secondary to identifying current exposure. This approach aligns with the incident response principle of detection before containment.

Answer

Submit the domain to a public sandbox for dynamic analysis

Answer

Block the domain at the firewall and update the SIEM watchlist

Answer

Create a new SIEM correlation rule to alert on future connections to the domain

Question 8

A threat intelligence analyst is integrating a new external feed into the organization's SIEM. The feed provides indicators with varying confidence levels. The analyst must ensure that only high-confidence indicators trigger automated alerts to reduce false positives. Which component of the intelligence lifecycle is most directly involved in this filtering process?

Accepted Answer

Analysis. The analysis phase of the intelligence lifecycle involves evaluating collected data for reliability, relevance, and confidence. In this scenario, the analyst uses confidence levels to filter indicators for automated alerting. This ensures that only trustworthy intelligence drives actions, reducing false positives and maintaining SOC efficiency.

Answer

Dissemination

Answer

Collection

Answer

Processing

Question 9

You are the CTI lead at a hospital network. Your SOC receives a vendor report stating that a ransomware group is actively targeting healthcare providers in your region with a new encryptor. Your CISO asks what the FIRST action should be to convert this intelligence into operational value for the SOC. What do you do?

Accepted Answer

Map the reported TTPs to MITRE ATT&CK and check whether existing detections and controls cover them. Because the report describes adversary behavior rather than static indicators, the highest-value first move is to map those behaviors to ATT&CK and evaluate detection and control coverage. This converts strategic reporting into an actionable gap list, letting the SOC prioritize engineering work where the hospital is genuinely exposed. Blocking broad protocols or stale hashes does not address the described targeting pattern.

Answer

Immediately block all outbound SMB traffic at the perimeter firewall

Answer

Add every file hash mentioned in the report to the EDR blocklist and close the ticket

Answer

Escalate the report to the legal department and wait for their guidance before informing the SOC

Question 10

You are a threat intelligence analyst supporting a SOC. The SOC uses a SIEM that ingests indicators from multiple feeds. You notice that a high-priority indicator from a trusted feed is not generating alerts. After investigation, you find the indicator is an IPv6 address, but the SIEM's ingestion parser only supports IPv4. What is the most appropriate action to improve the intelligence program?

Accepted Answer

Update the SIEM's indicator ingestion and detection capabilities to support IPv6. The most appropriate action is to update the SIEM to support IPv6 indicators. This addresses the technical limitation and ensures that all indicators from trusted feeds are ingested and actionable. Removing the feed, using NAT64, or manual monitoring are either overreactions or ineffective workarounds that do not solve the underlying problem and may introduce new risks or inefficiencies.

Answer

Remove the feed entirely and replace it with one that only provides IPv4 indicators

Answer

Configure the SIEM to convert IPv6 indicators to IPv4 using NAT64

Answer

Manually monitor IPv6 indicators outside the SIEM and create tickets for each

Question 11

A junior analyst is tasked with creating a report for the SOC manager on the current threat landscape. The analyst has collected data from various sources, including open-source reports, internal incident tickets, and premium feeds. Which phase of the threat intelligence lifecycle should the analyst focus on to ensure the report is tailored to the organization's specific needs?

Accepted Answer

Planning and Direction. The Planning and Direction phase is where the analyst defines the intelligence requirements based on the SOC manager's needs. This ensures the report focuses on relevant threats and is tailored to the organization. Without this phase, the report may be generic and not actionable for the SOC.

Answer

Analysis

Answer

Collection

Answer

Dissemination

Question 12

During an active incident, your IR team needs to know whether a specific IP address is a known C2 node. Your TI platform returns a confidence score of 95 with a first-seen date of 14 months ago. What is the most appropriate way to use this intelligence in the IR decision-making process?

Accepted Answer

Correlate the IP against current network telemetry and recent TI enrichment before deciding on containment actions. Confidence and freshness are distinct attributes of an indicator. A 95 confidence score reflects the source's certainty at reporting time, but a 14-month-old first-seen date means the infrastructure may have changed hands. During an active incident, the IR team should correlate the IP with current network telemetry and recent enrichment to confirm malicious use before committing to containment that could disrupt business services.

Answer

Discard the indicator entirely because indicators older than 12 months are always worthless

Answer

Immediately notify law enforcement and suspend the affected user account based solely on the indicator

Answer

Treat the IP as definitively malicious and immediately block it at all egress points without further analysis

Question 13

A risk manager asks you to provide threat intelligence that helps prioritize patching efforts for a newly disclosed vulnerability in your internet-facing VPN appliance. Which type of intelligence is most relevant for this request?

Accepted Answer

Operational intelligence on campaigns targeting VPN appliances, including exploitation status. Operational intelligence is most relevant because it provides current information on whether the VPN vulnerability is being actively exploited in campaigns, by which actors, and with what urgency. This directly informs patching prioritization by adding threat context to severity. Strategic, tactical, and technical intelligence each provide different pieces but do not alone answer the question of active exploitation risk.

Answer

Strategic intelligence on the geopolitical motivations of threat actors exploiting VPNs

Answer

Technical intelligence detailing the vulnerability's CVSS score and patch availability

Answer

Tactical intelligence listing IP addresses of known exploit attempts

Question 14

Your organization's SOC is drowning in alerts, and the CISO wants to reduce noise using threat intelligence. Which approach best applies TI to prioritize alerts during triage?

Accepted Answer

Enrich alerts with TI and use match results plus asset criticality to score and prioritize them for analysts. The most effective way to apply threat intelligence to alert triage is enrichment combined with asset criticality scoring. This produces a ranked queue where alerts tied to known malicious infrastructure and high-value assets rise to the top. Analysts work the highest-risk items first, which reduces effective noise without deleting detections or flooding senior staff with undifferentiated alerts.

Answer

Enrich every alert with all available TI feeds and route all enriched alerts to Tier 3

Answer

Suppress all alerts that contain any indicator appearing in any TI feed

Answer

Disable low-severity detection rules until the alert volume returns to a manageable level

Question 15

Your SOC is building a threat intelligence program and the CISO asks which outputs should be delivered to the risk management team to support enterprise risk decisions. (Choose two.)

Accepted Answer

A heat map of control gaps mapped to the ATT&CK techniques used by those prioritized actors. Risk management consumes intelligence that expresses threat in likelihood and impact terms. A sector-relevant actor assessment tells the organization who is likely to attack and how damaging that would be, while a control gap heat map tied to those actors' ATT&CK techniques shows where exposure is concentrated. Together they support risk treatment, control investment, and residual risk acceptance decisions.

Answer

A log of every SIEM alert triggered in the past quarter, including false positives

Answer

Raw packet captures from the SOC's network sensors for the past 90 days

Answer

The full, unfiltered indicator feed from every commercial TI vendor under contract