Certified Threat Intelligence Analyst (312-85) (312-85) — Questions 151–225

Domains registered recently with no reputation are often used for malicious purposes, including exfiltration. Attackers frequently use new domains to avoid blocklists. Outbound traffic to such a domain, especially combined with other factors like data volume, is highly suspicious and indicative of exfiltration.

Unstructured dark web text must be parsed before indicators can be matched or correlated. Applying NLP extracts named entities such as threat actor names, malware families, domains and IP addresses, converting free text into structured observables the TIP can ingest and enrich.

Normalisation converts collected feeds into a unified schema, enabling correlation across heterogeneous sources during processing. This directly satisfies the phase's requirement to structure raw data before analysis, distinguishing it from collection (gathering) and dissemination (distribution). Without it, mismatched formats would block automated enrichment and comparison.

Regular, short-lived outbound connections to a malicious IP on port 443 are a classic indicator of command-and-control (C2) beaconing. Malware often beacons at fixed intervals to check for instructions, maintain persistence, and receive updates. The use of port 443 helps blend with normal HTTPS traffic, and the short duration minimizes detection. This pattern is distinct from data exfiltration, which would involve larger transfers.

Process hollowing unmaps a legitimate process's memory and injects malicious code into that suspended host, so execution appears to originate from a trusted binary. This masquerading defeats host defences and analysts, placing the technique under Defense Evasion rather than Execution or Persistence.

Within the Diamond Model, the C2 server IP address is a physical or logical resource the adversary uses to communicate with and control victims, which is the Infrastructure vertex. Capability covers tools and malware, while Adversary and Victim are the other two vertices.

The Diamond Model plots adversary, capability, infrastructure and victim as four vertices, with edges representing their relationships, so analysts can visualise how the components of a single intrusion interrelate. This satisfies the stem's intrusion-analysis reporting scenario.

Requirements tied to decisions, stakeholders, and deadlines are actionable and measurable. They tell collectors what to look for, tell analysts what question to answer, and give leadership a way to judge whether the product was useful. This is the defining characteristic of priority intelligence requirements.

TAXII transports threat intelligence over HTTPS, so unencrypted or weak ciphers expose data in transit. Enforcing TLS 1.2 or higher prevents downgrade and interception attacks, protecting server-client exchanges of STIX content from eavesdropping and tampering.

Late supply chain detection stems from requirements that miss the intrusion's origin. Refocusing collection on initial access vectors, supplier dependencies and IAB forums generates intelligence covering the earliest attack stages, closing the gap in the direction and planning phase.

TLP:RED indicates the information is highly sensitive and should only be shared with the specific individuals for whom it is intended. This aligns with the requirement to restrict access to intended recipients. Delivering it only to them ensures compliance. TLP:RED provides clear handling instructions, preventing further dissemination without explicit permission.

Relevance ensures the feed addresses threats targeting the organisation's actual sector and regions, satisfying the planning-phase requirement to match intelligence to the defined collection scope. Feeds covering unrelated industries or geographies waste analyst effort and budget, so sector and geographic alignment is a critical vetting criterion before onboarding any external vendor.

A JA3S fingerprint is the server-side TLS hello hash. A value unique to your environment and recurring across multiple hosts indicates one distinct server implementation, consistent with a specific C2 listener such as Cobalt Strike, rather than legitimate shared infrastructure.

If PIRs are clear but reports do not answer them, the collection plan may not be properly aligned to gather the necessary data. Evaluating this alignment is the first step to ensure that collection activities are directly supporting the PIRs. Without this alignment, even well-defined PIRs will not yield actionable intelligence because the right data is not being collected.

OSINT from vendor advisories and vulnerability databases is critical for understanding software supply chain risks. It provides information on known vulnerabilities, patches, and incidents affecting vendors. This helps the CTI team assess exposure and prioritize threats. It is a low-cost, accessible source that should be part of the collection plan for supply chain attacks.

A 406 Not Acceptable response means the server cannot produce a representation matching the client's Accept header. The TAXII client most likely requested a media type the platform does not support, such as an incorrect STIX version or MIME type.

This reflects sound intelligence tradecraft: assess source reliability and information credibility separately, corroborate against internal data, and assign confidence before operational use. Conflicts are treated as analytical problems to resolve, not as reasons to discard or blindly accept. The decision to block, monitor, or hunt then follows from the assessed confidence and potential impact.

Closed forums where actors discuss criminal activity and sell access require protected handling. The material comes from restricted access that may involve human sources or monitored accounts, so source protection and recipient restrictions are the appropriate caveats to preserve both the source and the legal position.

The Lockheed Martin Cyber Kill Chain structures adversary activity into sequential phases, from reconnaissance to actions on objectives. It is widely paired with MITRE ATT&CK to guide threat intelligence collection, analysis and intelligence-driven defence planning across an organisation.

This correctly captures the data-to-intelligence hierarchy. Raw data becomes information once it is processed and organized, and information becomes intelligence when it is analyzed with context about the threat, the environment, and the decision it must support. This is the foundational concept in the Introduction to Threat Intelligence domain.

ACH is a structured technique that explicitly lists competing hypotheses and scores evidence for consistency and inconsistency. It helps analysts avoid confirmation bias by forcing consideration of alternatives and by highlighting which evidence is diagnostic. For a large artifact set, ACH provides a repeatable, auditable method to weigh explanations and document why one is favored over others, directly supporting defensible conclusions.

A Relationship SRO connects two SDOs via a relationship_type such as 'uses', linking the Threat-Actor identity to the Infrastructure object without merging them. It satisfies the stem's requirement to associate a specific actor with the infrastructure they recently utilised.

AWS CloudTrail records API activity as management and data events, capturing the identity, timestamp, source IP and request parameters behind every AWS API call. This audit trail directly exposes unauthorised API key usage, satisfying the requirement to identify relevant indicators in a cloud-native environment.

Threat intelligence exists to support decisions with timely, relevant, and actionable insight, giving the organization an advantage over adversaries. Reducing uncertainty about who threatens the business, how, and with what impact allows leaders and defenders to prioritize and respond effectively. This purpose statement aligns with the Introduction to Threat Intelligence domain and applies across strategic, operational, tactical, and technical products.

Documenting identified threats grouped by category, such as spoofing, tampering or elevation of privilege, gives the threat model its core inventory. Without this categorised list, the model cannot prioritise mitigations or demonstrate coverage, making it an essential component.

Insider threats typically involve authorised users accessing data beyond their normal remit. Tracking sensitive file access and data movement exposes unusual downloads, bulk copies or transfers to removable media, revealing exfiltration behaviour that authentication logs alone cannot show.

In an ACH matrix, each hypothesis is scored against diagnostic evidence; the lowest total indicates that the evidence weighs most heavily against it. A low score therefore means the hypothesis is least consistent with the observed indicators, making it the least likely explanation given the current evidence set.

Understanding critical assets and business processes ensures IRs are directly tied to what the organization values and must protect. This step aligns intelligence needs with business risk, making subsequent requirements actionable and prioritized. Without this foundation, IRs risk being generic and misaligned with the CISO's risk appetite, leading to wasted collection efforts and irrelevant intelligence.

STIX is a JSON-based structured language, so the SIEM's CSV requirement cannot be met natively. An ETL script parses STIX objects and flattens their fields into delimited rows, satisfying the format constraint of the pipeline.

The Diamond Model treats Infrastructure, Capability, Adversary and Victim as interconnected vertices. Discovering a new IP lets the analyst pivot along the Infrastructure-Capability or Infrastructure-Adversary edge to attribute the activity and expand the intrusion set.

TTPs reveal how an actor operates, including their preferred tools and methods. This directly informs capability assessment and helps predict likely attack vectors against the telemedicine platform. Understanding TTPs allows the team to prioritize defenses against techniques the actor is known to use, making it a critical factor in threat modeling.

STIX 2.1 is a machine-readable, schema-defined JSON format with typed objects and relationships, so it parses consistently and can be automated. Unstructured prose, PDFs or raw feeds lack that fixed schema, making the STIX file the structured example.

Scheduled Task/Job is a persistence technique where adversaries schedule tasks to execute malicious code at specific times or on certain events. In this scenario, the adversary uses scheduled tasks to maintain persistence, which aligns with this technique. It allows them to survive reboots and re-establish access.

DNS tunneling encodes data in DNS queries and responses, often using long subdomains and high query volumes to a single domain. Analyzing DNS query logs for these patterns directly detects the C2 technique described. This data source is readily available in most enterprises and provides the necessary visibility into the DNS layer where the tunneling occurs.

Sysmon Event ID 1 records process creation with full command-line arguments and parent process details, exposing LotL abuse such as renamed system binaries or suspicious PowerShell invocations. This process-level telemetry satisfies the requirement to hunt adversary misuse of legitimate built-in tools.

Kerberoasting abuses any authenticated user's ability to request service tickets, so the strongest signal is a low-privilege account suddenly requesting RC4 tickets for many SPNs it has no business need for, especially at unusual times. This behavioral deviation distinguishes attacker enumeration from routine service access by authorized accounts during working hours.

Target-centric analysis focuses on a specific entity, event, or transaction (like an M&A), aligning collection requirements around actors targeting that specific asset.

certutil.exe includes URL cache and decode switches that fetch remote files and write them to disk, letting attackers download payloads using a signed Microsoft binary. This living-off-the-land abuse evades application allowlisting that blocks standalone download tools.

A high CVSS score reflects the intrinsic severity of a vulnerability, derived from metrics such as exploitability, impact and scope. It rates the flaw's characteristics, not the likelihood of exploitation or the value of the affected asset.

Processing is the phase in which raw collected data is converted into a structured, usable format through normalization, deduplication, decoding, and translation into a common schema. Every action described, from time normalization to field mapping, is a conversion step that prepares data for analysis, which is the definition of processing.

Refining supply chain threats into specific Priority Intelligence Requirements scopes collection to named third-party software vendors and defines update frequency, converting a broad stakeholder theme into actionable, measurable intelligence tasks with clear cadence and focus.

Dissemination delivers finished intelligence to the stakeholders who need it, in a format and timeframe matching their requirements. It satisfies the stem by covering the hand-off of analysed intelligence to the target audience, distinct from collection, processing or analysis phases.

A centralised team applies one set of collection, analysis and dissemination standards across all business units, producing a single consolidated risk picture rather than fragmented, inconsistent reporting. This coherence is the structural advantage over distributed analysts embedded in individual units.

Dissemination delivers finished intelligence to the IR team in a format and timeframe they can act on, satisfying the stem's requirement for usable, timely delivery. It is the phase that translates analysis into consumable reports, briefings or machine-readable feeds, ensuring responders receive actionable indicators before threats materialise.

Capability is one of the four Diamond Model vertices, representing the adversary's tools, techniques and malware used in an intrusion. It satisfies the question's requirement for a primary vertex, pairing with adversary, infrastructure and victim to describe each event.

TLP markings are essential for communicating sharing restrictions and ensuring that the recipient handles the information appropriately. Without a TLP marking, the partner may not know the sensitivity of the data, leading to potential mishandling. This is a standard requirement for intelligence sharing under TLP.

Attackers often name malicious processes after legitimate system processes like 'kworker' to blend in. A user-space process with a PPID of 1 indicates it was likely started by init or reparented, which is uncommon for genuine kernel threads. High CPU usage and the mismatched PPID are red flags for a masquerading process, possibly a cryptominer or backdoor.

Command and Control server IP addresses are the physical and logical assets an adversary uses to deliver capabilities and maintain access. Populating Infrastructure with these C2 IPs satisfies the Diamond Model's requirement for the mechanism connecting adversary to victim.

Reused malware and shared hosting are low-fidelity artifacts that can be copied, leaked, or rented by unrelated actors, so they cannot by themselves support high-confidence attribution. Sound analytic standards require corroborating evidence, such as infrastructure overlaps, tradecraft consistency, victimology, and operational patterns, before confidence is raised. The valid criticism is that the stated confidence outruns the evidence.

Event ID 4698 logs the creation of a scheduled task and includes the task's XML definition. The XML may contain a <Hidden>true</Hidden> setting, which indicates the task is hidden from the default view in Task Scheduler. Attackers often use this to conceal persistence. Focusing on this event and field directly addresses the scenario.

Before attempting to extract or transform data, it is essential to validate that the XML is well-formed and conforms to its schema. This ensures that the data can be reliably parsed and that any subsequent processing steps will not fail due to structural issues. Validating the XML is a foundational step that prevents errors downstream and is considered best practice in data processing workflows.

PowerShell provides a command-line interface for running scripts and binaries on a host, which maps directly to the Execution tactic in MITRE ATT&CK. The stem specifies that the adversary uses PowerShell to execute commands, so the action satisfies Execution's definition of running malicious code.

The StartUp folder is a classic autostart location; any new file created there indicates a program will execute at user logon, a common persistence technique. Monitoring this path detects unauthorised startup entries that other FIM events would miss.

Automated scraping without rate-limit awareness floods a target with rapid requests, which defenders detect as abusive traffic and block at the network edge. The immediate consequence is the scraping host's source IP being blacklisted, halting collection until the address is rotated.

Reassessing PIRs with stakeholders from both entities ensures that the intelligence requirements reflect the combined business goals, risks, and operational needs. This collaborative approach identifies new priorities and gaps, aligning collection efforts with the post-merger landscape. It is a proactive step that directly addresses the shift in business objectives and ensures that intelligence supports decision-making at all levels.

Weaponization couples an exploit with a deliverable payload, producing the tailored malware itself. Custom-compiling a Trojan to evade EDR is precisely this pairing step, occurring before delivery, so it sits in the Weaponization phase rather than Exploitation or Command and Control.

Diagnosticity measures how well an evidence item distinguishes among hypotheses; ambiguous items that are consistent with many hypotheses add little value even if they raise a total score. The analyst should down-weight non-diagnostic evidence, note inconsistencies, and record residual uncertainty. This preserves analytical rigor and ensures the conclusion reflects the strength of evidence, not just the arithmetic sum of a matrix.

Executive summaries translate technical findings into business impact and risk language for C-level decision-makers, while technical IOCs remain in an appendix for SOC analysts. This layered format delivers actionable intelligence to both audiences without diluting either, satisfying the intelligence cycle's dissemination requirement.

The acquisition introduces new regions with distinct threats and compliance obligations, so PIRs must be updated to prioritize intelligence that supports decision-making in those areas. This ensures the CTI program remains aligned with the expanded business footprint and addresses emerging risks such as regional threat actors or data protection laws. Without this reassessment, intelligence efforts may focus on outdated priorities.

Enrichment with context adds surrounding metadata and situational detail to raw collected data, improving its interpretability and analytical value during Processing. This contextual layer helps analysts assess relevance and reliability, supporting the data-quality objectives of the intelligence cycle's Processing phase.

Regular expression validation checks whether an indicator conforms to the syntactic rules of its type (e.g., IPv4 address format, domain name characters). Discarding malformed indicators prevents corrupt data from entering the platform, ensuring data quality. This is a standard processing step to enforce validity before storage.

Event ID 4769 is generated when a Kerberos service ticket is requested. In a Kerberoasting attack, the attacker requests service tickets for accounts with SPNs, which are encrypted with the service account's password hash. The attacker can then extract the ticket and crack it offline. Monitoring Event ID 4769 for requests with weak encryption types (e.g., RC4) and unusual service names is key to detecting Kerberoasting.

Logging tokens in plain text exposes credentials to anyone with log access, directly breaching confidentiality. STRIDE's Information Disclosure category covers exactly this unauthorised exposure of data, so it is the specific threat satisfied by the plain-text token logging in the API gateway.

A commercial threat feed is a push source: the vendor proactively delivers curated indicators and reports to the subscriber without the SOC requesting them. This contrasts with pull sources such as internal log queries or open-source lookups, satisfying the requirement for externally initiated intelligence delivery.

Malware hashes are tactical intelligence because they are atomic, machine-readable indicators that directly support immediate detection and blocking. They satisfy the stem's requirement for tactical categorisation, unlike strategic intelligence, which addresses long-term trends and adversary intent rather than specific, actionable artefacts.

An executive summary tailored to the board should emphasize business impact, risk, and strategic recommendations. This audience requires high-level insights to guide decisions on investments, policy changes, and risk mitigation. Technical details are unnecessary and can obscure the key messages. This approach aligns with intelligence reporting best practices for senior leadership, ensuring clarity and actionable takeaways.

The Confidence Score tells the analyst how reliable the data is for automated blocking.

TLP:AMBER allows sharing within the organization and with its clients or subsidiaries as needed. It provides a balance between protection and necessary dissemination, making it suitable for sensitive information that needs to be shared with a foreign subsidiary while still limiting further distribution. This marking aligns with the need to protect defensive details while enabling action.

TAXII 2.1 defines the HTTPS-based transport and collection semantics for exchanging STIX intelligence, enabling automated publish-subscribe feeds rather than manual file transfers. This directly satisfies the ISAC requirement for automated, near-real-time sharing between members' platforms.

Industrial control systems and production manufacturing IT/OT infrastructure are crown jewels because compromise halts physical output, endangers safety and disrupts supply. Their availability and integrity requirements directly shape intelligence priorities, making them a typical critical asset category.

A vendor's demonstrated record of accurate, validated intelligence directly evidences reliability, satisfying the evaluation criterion. Past performance shows whether reported indicators are trustworthy and actionable, which is central to assessing a threat intelligence provider's dependability.

Initial Access is the tactic that describes how adversaries gain an entry point into the network. Using valid VPN credentials to access the corporate network is an example of the Valid Accounts technique under Initial Access. This matches the scenario where the adversary used compromised credentials to enter the environment, making Initial Access the correct tactic.

AppInit DLLs is a specific MITRE ATT&CK technique under Persistence and Privilege Escalation. It involves modifying the AppInit_DLLs registry key to load a malicious DLL into every process that loads User32.dll, providing persistence and often privilege escalation. The scenario exactly matches this technique, making it the correct answer.

TLP:AMBER requires clear marking and communication of handling restrictions to ensure recipients understand the sharing limitations. This is critical for compliance and prevents unintended disclosure. Without it, the report may be mishandled, violating the protocol and potentially damaging trust with the source and partners.

Analysis of competing hypotheses systematically evaluates alternatives against evidence, and key assumptions check surfaces unstated premises. Pairing these with estimative probability terminology and explicit confidence statements gives consumers a clear, calibrated view of uncertainty and the reasoning behind the judgment.