195 questions total · 3pages · All types, answers revealed
Page 1 of 3
Page 2Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?
Patterns of activity are IOAs.
Why this answer
IOCs are static (hashes, IPs), whereas IOAs describe patterns of activity (behavior) that indicate an attack is in progress.
When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?
Techniques describe how the adversary achieves the tactical goal.
Why this answer
Mapping involves identifying the Technique ID (T1574.002) and analyzing it within the context of the observed execution flow.
Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?
High-frequency execution vector.
Why this answer
PowerShell, WMI, and Scheduled Tasks are the most common vectors for adversary code execution on Windows systems.
Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)
These are direct sources of technical network intelligence.
Why this answer
Technical intelligence typically comes from logs, network traffic, and malware analysis.
Which TWO of the following are primary goals of conducting a threat modeling exercise on a new software application?
Requirement definition is a key output.
Why this answer
Goals include identifying risks early and defining security requirements to mitigate those risks.
A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?
TXT records are frequently used to carry data in DNS tunneling attacks.
Why this answer
Extremely high volumes of TXT or NULL record queries are classic indicators of DNS tunneling for data exfiltration.
An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?
Validation and prioritization ensure that analytical resources are focused on high-value, relevant requests.
Why this answer
Once an RFI is submitted, it must be triaged, validated, and prioritized against existing intelligence requirements before collection and analysis tasks are assigned.
When hunting for malicious DLL side-loading, which file property is most critical to verify?
Legitimate binaries are signed; unauthorized DLLs in the same directory often lack valid signatures.
Why this answer
Side-loading relies on a legitimate binary loading a malicious DLL with the same name as a required dependency from a different directory.
You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?
TLP:RED is strictly for the immediate recipient and cannot be shared further.
Why this answer
TLP:RED is used for information that cannot be shared outside of the specific recipients, which is appropriate for sensitive zero-day intelligence.
Which TWO protocols are most commonly used for the automated exchange of threat intelligence between different organizations or platforms?
TAXII provides the transport layer for threat intel.
Why this answer
TAXII is the transport protocol, and STIX is the serialization format, making them the standard combination for automated TI sharing.
You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?
IOCs are the specific artifacts used for detection.
Why this answer
The Indicators of Compromise (IOC) section provides the specific hashes, IPs, and file paths needed for immediate detection.
You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?
Executives require high-level summaries focusing on risk and impact.
Why this answer
Strategic intelligence, which focuses on trends and risk impact, is designed for executive audiences.
Which TWO of the following actions are considered 'Defense Evasion' techniques?
This removes evidence of the intrusion.
Why this answer
Defense Evasion covers any method used to hide from security tools, such as clearing logs or disabling antivirus.
Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?
Required to see the code executed from memory.
Why this answer
Fileless malware resides in memory or the registry, so WMI and PowerShell logs are primary sources.
In threat modeling, what does the 'D' in DREAD risk assessment stand for?
Damage potential measures the severity of the impact.
Why this answer
DREAD stands for Damage, Reproducibility, Exploitability, Affected users, and Discoverability.
Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)
Assets like containers exist for short times, making them hard to track.
Why this answer
Cloud environments are dynamic, leading to challenges with visibility and scope.
Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?
Used to suppress user visibility during execution.
Why this answer
-EncodedCommand and -NoP (NoProfile) are hallmarks of malicious script execution designed to bypass standard environment configs.
Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?
Frequency is a key attribute of sightings.
Why this answer
Observed data objects record the 'first_observed', 'last_observed', and 'number_observed' properties to provide context to the sighting.
Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?
The versioning mismatch requires a transformation or a compatibility plugin.
Why this answer
STIX 2.x is not backward compatible with STIX 1.x due to significant changes in the JSON structure and object models.
Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?
Threats vary significantly across different industries.
Why this answer
Relevance is determined by the industry vertical, the geographical footprint of the organization, and the specific technology stack in use.
A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?
A1 signifies a reliable source and confirmed information.
Why this answer
Under the Admiralty Code, A1 represents a reliable source (A) and information that is confirmed by other independent sources (1).
Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?
The tree view in Process Explorer clearly displays parent-child relationships.
Why this answer
Sysinternals Process Explorer is the industry standard for viewing hierarchical process structures (tree view).
A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?
Feedback from consumers on previous intelligence products directly informs the direction and planning phase to update requirements.
Why this answer
Feedback and review from completed intelligence operations and stakeholder evaluations provide the necessary insights to refine and adjust requirements in the direction and planning phase.
An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?
T1547.001 specifically covers persistence via Run keys.
Why this answer
Modifying Run keys is a standard method for achieving persistence on Windows systems, mapped to T1547.001.
Which THREE of the following are core components of the STIX 2.1 Domain Object (SDO) structure?
This is a core SDO.
Why this answer
The SDOs are the building blocks of STIX 2.1 intelligence, which include Actors, Malware, and Attack Patterns among others.
You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?
The core of ACH is to look for evidence that is most diagnostic in disproving a hypothesis.
Why this answer
ACH methodology dictates that you should focus on evidence that disproves hypotheses rather than supports them. Finding contradictory evidence is more diagnostic than finding supporting evidence.
Which TWO items are part of the 'Adversary' vertex in the Diamond Model?
Aliases are critical for tracking specific groups.
Why this answer
The Adversary vertex tracks the threat actor's identity, including known aliases and their organizational affiliation.
When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?
This is the precise definition of timeliness in CTI.
Why this answer
Timeliness refers to the gap between when an event occurs and when the intelligence regarding that event is received by the analyst.
Which of the following is an example of an 'Indicator of Compromise' (IOC)?
File hashes are classic, technical IOCs.
Why this answer
An IOC is a piece of forensic evidence that indicates a system has been compromised.
When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?
Z-score identifies how far, in terms of standard deviations, a data point is from the mean.
Why this answer
Standard deviation or Z-score is used to determine how many standard deviations an observation is from the mean.
During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?
This log provides the full de-obfuscated script content.
Why this answer
The Microsoft-Windows-PowerShell/Operational log (Event ID 4104) captures the full script block text, even if obfuscated or encoded.
You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?
403 errors are frequently triggered by IP-based access control lists.
Why this answer
403 Forbidden indicates the server understood the request but refuses to authorize it, often due to IP whitelisting or invalid API tokens at the source.
An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?
ISACs and regulatory bodies offer tailored threat intelligence sharing, sector benchmarks, and specific threat vectors.
Why this answer
Information Sharing and Analysis Centers (ISACs) or Information Sharing and Analysis Organizations (ISAOs) provide sector-specific threat intelligence and peer collaboration crucial for accurate threat requirements.
When analyzing network traffic for C2 communication, which THREE anomalies are common indicators of malicious activity?
Tunneling data through allowed protocols is common.
Why this answer
Beaconing patterns, unusual protocol usage, and irregular traffic volume are classic indicators.
You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?
This cmdlet provides full visibility into task configurations and triggers.
Why this answer
Get-ScheduledTask is the standard management cmdlet for listing and inspecting scheduled tasks in Windows.
An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?
Strategic analysts specialize in communicating high-level threat trends, geopolitical events, and business risk to executive leadership.
Why this answer
The Threat Intelligence Manager or Strategic Threat Analyst bridges the gap between technical threat indicators and business risk, ensuring executive leadership understands the strategic impact.
You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?
Most TAXII clients allow for query parameters to filter by confidence.
Why this answer
Filtering by confidence levels is typically performed within the TAXII client configuration or via an API parameter defined by the threat feed provider.
An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?
SMB traffic via 445 is the primary vector for lateral movement.
Why this answer
TCP Port 445 is the standard port for SMB/CIFS, which is essential for lateral movement tools like PSExec.
A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?
Event ID 8 records remote thread creation, essential for detecting process hollowing.
Why this answer
Event ID 8 (CreateRemoteThread) is a primary indicator of process hollowing, where a process injects code into another process.
In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?
Mapping templates allow users to define which CSV columns map to specific MISP fields, preventing default errors.
Why this answer
The MISP 'Import' functionality allows for template-based mapping to ensure CSV columns map to specific MISP attributes and categories correctly.
You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?
A 403 Forbidden status is the standard response when the credentials provided lack authorization for the specific resource.
Why this answer
The 403 error specifically indicates that the client is authenticated but lacks the necessary permissions to access the requested Collection ID.
You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?
0.1 (New Probability) * $500,000 (Impact) = $50,000.
Why this answer
ALE = SLE x ARO. Since ALE = Probability x Impact, original ALE = 0.2 x $500,000 = $100,000. New probability is 0.1. 0.1 x $500,000 = $50,000.
When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)
Analyzing campaigns, motivations, and TTPs is a core function of a threat intelligence team.
Why this answer
CTI teams are responsible for analyzing threat actor TTPs and providing actionable intelligence to defenders. They do not typically manage network firewalls or perform software development.
Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?
C2 represents the channel established for persistent control over the system.
Why this answer
Establishing persistence via a C2 channel is the definition of the Command and Control phase in the Cyber Kill Chain.
You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?
ATT&CK provides a comprehensive matrix of adversarial behavior.
Why this answer
MITRE ATT&CK is the industry-standard framework for mapping adversarial techniques and identifying gaps in security controls.
While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?
Decoding is essential for normalization and indicator extraction.
Why this answer
Decoding the payload allows the analyst to extract actual IOCs (like C2 domains) which can then be indexed.
Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?
Performed externally.
Why this answer
Reconnaissance, Weaponization, and Delivery occur before the attacker has a presence on the target host.
You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?
Expired indicators lose relevance and can trigger false alerts.
Why this answer
Setting an expiration period ensures that stale or obsolete indicators are removed, which reduces false positives and improves correlation performance.
You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?
False positives can lead to significant outages.
Why this answer
The primary risk of automated blocking is the potential for blocking legitimate services, leading to business disruption due to false positives.
Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?
This is the structured approach of forming a theory and proving/disproving it.
Why this answer
Hypothesis-driven hunting starts with a theory or a TTP and searches for evidence to confirm or deny it.
Which TWO of the following are common challenges when sharing intelligence between organizations?
Trust is essential for sharing sensitive info.
Why this answer
Trust and formatting (schema) are the most frequent hurdles in collaborative threat intelligence.
Which TWO of the following are recognized categories of threat intelligence sources?
OSINT is a primary intelligence category.
Why this answer
Threat intelligence sources are generally categorized into open-source (OSINT) and closed/proprietary sources.
You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?
Behavioral monitoring of legitimate tools (e.g., PowerShell, WMI) is the standard for detecting LotL attacks.
Why this answer
Because they use legitimate tools, you must focus on behavioral detection (Tactic-Technique-Procedure analysis) rather than signature-based file detection.
To effectively hunt for C2 communication, which THREE indicators should be monitored in your proxy or firewall logs?
Consistent heartbeats indicate automated C2.
Why this answer
Unusual User-Agents, connection frequency, and destination domain age are critical indicators of C2 infrastructure.
Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?
GDPR governs the protection and movement of personal data internationally.
Why this answer
GDPR (General Data Protection Regulation) has strict requirements regarding the export and sharing of personal data, which often includes logs or artifacts linked to individuals.
You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?
The 'targets' relationship correctly defines the relationship between a threat and its target vulnerability.
Why this answer
In STIX 2.1, the 'targets' relationship is used to indicate that a malware object is designed to exploit a specific vulnerability object.
When performing quantitative analysis, which THREE of the following are necessary to calculate the Annualized Loss Expectancy (ALE)?
A component of the ALE formula.
Why this answer
ALE = SLE x ARO. SLE is calculated by Asset Value x Exposure Factor.
You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?
EDR is designed to detect malicious activities and installations on the endpoint.
Why this answer
The Installation phase involves the malware establishing a persistent foothold on the host, which is best detected by host-based security tools like EDR.
During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)
Tactical consumers require indicators of compromise, file hashes, and IP blocklists.
Why this answer
Intelligence plans address strategic (executive), operational (managerial/defense), and tactical (technical/SOC) consumers.
Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)
Deduplication is essential during processing to reduce noise.
Why this answer
Processing is where data is made usable through normalization, aggregation, and filtering.
During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?
PIRs articulate the exact gaps in knowledge that leadership needs filled to make informed security decisions.
Why this answer
PIRs focus the entire threat intelligence collection and analysis effort on answering specific, critical questions that drive decision-making for leadership.
Which TWO types of intelligence are most essential for an Incident Response team during an active attack investigation?
Provides insight into adversary TTPs for mitigation.
Why this answer
Tactical and Operational intelligence are essential for responding to live incidents. Tactical details the TTPs, while Operational provides the immediate indicators.
You are implementing a TIP and want to prioritize intelligence based on the source's reputation. Where should you configure this logic?
This allows the platform to favor data from trusted sources over others.
Why this answer
Most enterprise TIPs have a 'Source Reliability' or 'Feed Weighting' configuration module to assign trust scores to different contributors.
You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?
ip-src is the correct attribute type for source IPs.
Why this answer
IP-src is the standard MISP attribute type for source IP addresses, allowing for proper correlation with network logs.
You are selecting a format for sharing intelligence with a heterogeneous group of partners. Which THREE of the following are benefits of choosing STIX/TAXII over unstructured CSV/PDF reporting?
Automation removes the need for manual parsing of PDFs or CSVs.
Why this answer
STIX/TAXII provides machine-readability, standardized schemas, and automated distribution, which are key for modern automated defense.
Which THREE of the following are considered challenges when ingesting threat intelligence feeds?
Disparate formats create significant processing overhead.
Why this answer
Data volume, lack of standardization, and quality/noise are the most significant hurdles in intelligence ingestion.
You are configuring a TAXII 2.1 client to consume feeds from an industry ISAC. You have successfully authenticated but are receiving empty response bodies for your collections. Which configuration setting should you verify in the TAXII client to ensure you are polling the correct resource path?
The API Root is the base URL for all TAXII 2.1 collections; an incorrect root leads to 404 errors or empty response sets.
Why this answer
In TAXII 2.1, resources are accessed via a specific API root path. If the root path is misconfigured, the client may authenticate to the server but fail to resolve the collection endpoints.
You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?
The relationship_type property is the critical field identifying the semantic link between the source and target.
Why this answer
The 'relationship_type' property defines the semantic nature of the link; if it does not match the STIX 2.1 controlled vocabulary for that SDO pair, the parser will reject the bundle.
When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)
Training and certifications for analysts are essential personnel budget items to maintain analytical capability.
Why this answer
Budget planning for CTI must account for commercial tool subscriptions, personnel training/certifications, and intelligence platform licenses.
In the context of STIX 2.1, what is the purpose of the 'relationship' object?
Relationship objects allow for semantic linking of intelligence data.
Why this answer
The relationship object links two SDOs (like an Indicator and a Malware object) to provide context.
Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)
Centralization is the core purpose of a TIP.
Why this answer
TIPs centralize and automate the management of threat data.
You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?
FQL is the query language for the Falcon platform.
Why this answer
CrowdStrike utilizes FQL (Falcon Query Language) to search across the sensor data and endpoint activity logs.
In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?
Normalization maps different formats to a standard schema to enable meaningful analysis.
Why this answer
Normalization allows for the correlation of disparate data types into a single schema for accurate analysis.
Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?
Strategic TI addresses the needs of executive decision-makers.
Why this answer
Strategic intelligence is designed for executive audiences to understand trends and risk posture over time.
You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?
Execution covers techniques that result in the execution of adversary-controlled code on a local or remote system.
Why this answer
While PowerShell can be used for execution, the act of running the script to download the payload is categorized under Execution. The Tactic is the 'why' of the action, and Execution covers running malicious code.
Page 1 of 3
Page 2Practice 312-85 by domain
Target a specific domain to shore up weak areas.