20+ practice questions focused on Introduction TO Threat Intelligence — one of the most tested topics on the Certified Threat Intelligence Analyst (312-85) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Introduction TO Threat Intelligence PracticeYou are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?
Explanation: The 403 error specifically indicates that the client is authenticated but lacks the necessary permissions to access the requested Collection ID.
You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?
Explanation: In STIX 2.1, the 'targets' relationship type is used to link a Malware object to a Vulnerability object, indicating that the malware exploits or targets that vulnerability. The STIX 2.1 relationship vocabulary explicitly defines 'targets' for this malware-to-vulnerability semantic, making it the correct choice for documenting exploitation intent.
You have noticed high-frequency beaconing to a domain that was recently registered. In the context of threat intelligence, how is this categorized?
Explanation: Newly Registered Domains (NRDs) are a common indicator of malicious activity often used for C2 infrastructure.
Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)
Explanation: In the Diamond Model of Intrusion Analysis, the Adversary node represents the actor conducting the intrusion, and its two primary components are the adversary's identity (often expressed as an Intrusion Set or Threat Actor) and the adversary's motivation, so options A and D are correct. Option A is right because the Intrusion Set / Threat Actor identity captures who is responsible for the activity, which is the core of the Adversary vertex. Option D is right because motivation explains why the adversary is conducting the operation and is the second defining component of the Adversary node. Option B is incorrect because Network infrastructure belongs to the Infrastructure node, not the Adversary node. Option C is incorrect because the Target organization's industry is part of the Victim node's characterization, not the Adversary. Option E is incorrect because Malware capabilities belong to the Capability node of the Diamond Model.
Which THREE of the following are considered 'Tactical' intelligence products? (Choose three)
Explanation: Tactical intelligence is specific, actionable data used for immediate defense.
+15 more Introduction TO Threat Intelligence questions available
Practice all Introduction TO Threat Intelligence questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Introduction TO Threat Intelligence. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Introduction TO Threat Intelligence questions on the 312-85 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Introduction TO Threat Intelligence is tested as part of the Certified Threat Intelligence Analyst (312-85) blueprint. Practicing with targeted Introduction TO Threat Intelligence questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 312-85 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Introduction TO Threat Intelligence is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Introduction TO Threat Intelligence practice session with instant scoring and detailed explanations.
Start Introduction TO Threat Intelligence Practice →