312-85 Timed Practice Test 1 — 10 Questions

Question 1

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

10 minute time limit — choose an answer to begin.

Accepted Answer

Execution. While PowerShell can be used for execution, the act of running the script to download the payload is categorized under Execution. The Tactic is the 'why' of the action, and Execution covers running malicious code.

Answer

Discovery

Answer

Persistence

Answer

Command and Control

Question 2

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Accepted Answer

To ensure data compatibility for correlation and cross-source analysis.. Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.

Answer

To reduce the storage space required for logs.

Answer

To increase the ingestion speed of the SIEM.

Answer

To encrypt the logs for regulatory compliance.

Question 3

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Accepted Answer

Infrastructure. In the Diamond Model, Infrastructure represents the physical and logical communication paths and services, such as IPs and domains, used by the adversary.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 4

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Accepted Answer

Weaponization. The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.

Answer

Exploitation

Answer

Delivery

Answer

Installation

Question 5

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

Accepted Answer

The vulnerability has a high severity rating based on its characteristics.. CVSS scores represent the severity of a vulnerability, with higher scores indicating higher severity.

Answer

The vulnerability is currently being exploited in the wild.

Answer

The vulnerability affects only Windows systems.

Answer

The vulnerability is already patched.

Question 6

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Accepted Answer

Application of NLP techniques to extract entities.. NLP (Natural Language Processing) is the standard technique for converting unstructured text into structured, normalized intelligence.

Answer

Hashing the entire document.

Answer

Direct ingestion into the SIEM.

Answer

Manual entry into a spreadsheet.

Question 7

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Accepted Answer

T1572: Protocol Tunneling. This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.

Answer

T1204: User Execution

Answer

T1133: External Remote Services

Answer

T1053: Scheduled Task

Question 8

When hunting for malicious DLL side-loading, which file property is most critical to verify?

Accepted Answer

Code signing certificate. Side-loading relies on a legitimate binary loading a malicious DLL with the same name as a required dependency from a different directory.

Answer

File extension

Answer

Creation timestamp

Answer

File size

Question 9

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Accepted Answer

Command and Control. Beaconing is a primary method for establishing and maintaining Command and Control.

Answer

Exfiltration

Answer

Privilege Escalation

Answer

Collection

Question 10

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

Accepted Answer

valid_from. The Indicator object in STIX 2.1 contains specific properties including the pattern, validity period, and confidence score.

Answer

firewall_acl_rule

Answer

user_password_hash