20+ practice questions focused on Cyber Threats And Attack Frameworks — one of the most tested topics on the Certified Threat Intelligence Analyst (312-85) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Cyber Threats And Attack Frameworks PracticeIn the Diamond Model, the 'Technology' axis (often associated with the Capability-Infrastructure edge) is used to track what specifically?
Explanation: It tracks the technical dependencies and tools that enable the relationship between the adversary's capability and the infrastructure they employ.
A threat intelligence analyst is reviewing a report on an adversary group that has been observed using spear-phishing emails with malicious attachments to gain initial access. The report states that the group then uses credential dumping to escalate privileges and moves laterally using SMB. According to the Lockheed Martin Cyber Kill Chain, which phase does the use of credential dumping fall into?
Explanation: Credential dumping is a post-exploitation technique used to extract credentials from a compromised system. In the Cyber Kill Chain, it falls under Actions on Objectives, where the adversary pursues their ultimate goals, including privilege escalation and lateral movement. This phase occurs after earlier stages like delivery, exploitation, and installation.
While reviewing an incident, a threat intelligence analyst maps the adversary's behavior and finds that the attacker leveraged a signed, legitimate remote monitoring and management (RMM) tool already present in the environment to execute commands and move laterally. Under the MITRE ATT&CK framework, which tactic does this activity primarily support?
Explanation: The adversary used a trusted, signed RMM tool already present to execute commands and move laterally, which is a classic Defense Evasion technique. By leveraging an existing legitimate application, the attacker avoids introducing malicious binaries, bypasses application allowlisting, and blends into normal administrative activity. This behavior is mapped to Defense Evasion in MITRE ATT&CK, specifically under Trusted Developer Utilities Proxy Execution or similar sub-techniques.
An analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. The analyst notes that the adversary used a specific spear-phishing email with a malicious attachment to gain initial access. Under the Diamond Model, which core feature does the spear-phishing email represent?
Explanation: In the Diamond Model, the spear-phishing email with a malicious attachment is a Capability. Capabilities are the tools and techniques the adversary uses to exploit the victim, including malware, exploits, and social engineering lures. The email serves as the weaponized payload delivery mechanism. Documenting it as Capability helps analysts understand the adversary's tradecraft and link it to other events in the intrusion.
During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?
Explanation: The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.
+15 more Cyber Threats And Attack Frameworks questions available
Practice all Cyber Threats And Attack Frameworks questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Cyber Threats And Attack Frameworks. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Cyber Threats And Attack Frameworks questions on the 312-85 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Cyber Threats And Attack Frameworks is tested as part of the Certified Threat Intelligence Analyst (312-85) blueprint. Practicing with targeted Cyber Threats And Attack Frameworks questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 312-85 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Cyber Threats And Attack Frameworks is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Cyber Threats And Attack Frameworks practice session with instant scoring and detailed explanations.
Start Cyber Threats And Attack Frameworks Practice →