195 questions total · 3pages · All types, answers revealed
Page 3 of 3
When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?
The STIX ID is designed to be the globally unique identifier for objects.
Why this answer
The 'pattern' or 'hash' (if applicable) or a unique 'external_id' are common identifiers, but 'id' in STIX is the unique object identifier.
You are configuring a TAXII 2.1 server to share threat indicators with a government partner. You need to ensure the connection enforces the transport-level security requirements for sensitive data exchange. Which setting must you verify in the TAXII configuration?
mTLS provides the strongest security for TAXII exchanges by requiring both client and server to authenticate each other.
When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?
Accessing LSASS memory is the hallmark of credential dumping tools like Mimikatz.
Why this answer
Mimikatz typically attempts to access LSASS.exe with specific access masks to read memory.
You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?
Vetting is critical to ensure that blocking rules do not disrupt business operations.
Why this answer
Vetting prevents false positives by verifying the validity and current relevance of indicators before they affect production traffic.
When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?
Domain controllers should never be accessed via RDP by standard users.
Why this answer
Remote service creation, RDP to domain controllers, and unusual process spawning from WMI are clear indicators of lateral movement.
Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?
This is anomalous for normal user behavior.
Why this answer
Pass-the-hash involves abnormal logon types, NTLM usage, and suspicious logons from unexpected source IPs.
Which of the following best describes an Advanced Persistent Threat (APT)?
APTs are defined by high capability, persistence, and clear target objectives.
Why this answer
APTs are characterized by their long-term, targeted, and sophisticated nature, often backed by nation-states.
A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?
Actionability and downstream adoption directly reflect the quality and operational value of the intelligence.
Why this answer
Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.
Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?
Mitigation helps the team react to the threat.
Why this answer
Operational teams need context on the threat and the specific technical indicators to look for.
When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?
Firewalls can block scanning activity.
When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?
The type field is required for all STIX objects.
Why this answer
In STIX 2.1, the 'type' field is mandatory for all SDOs and SCOs, and for file objects, it must be set to 'file'.
While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?
Small standard deviation in time deltas indicates high regularity, characteristic of C2 beacons.
Why this answer
Calculating the variance or standard deviation of time intervals between connections (the 'delta') is the standard method for identifying programmatic beaconing.
In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?
Join is used to combine data from two tables.
Why this answer
The 'join' operator in KQL is required to correlate disparate datasets, such as threat intelligence logs and security event logs.
You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?
PowerShell is a standard technique used for code execution.
Why this answer
MITRE ATT&CK maps techniques like PowerShell under 'Execution' as it is used to run malicious code.
You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?
TLP provides a clear, standardized framework for sharing.
Why this answer
The TLP (Traffic Light Protocol) is the globally accepted standard for communicating intelligence sensitivity and sharing boundaries.
You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?
Smoothing functions are effective for identifying periodic signals within noisy telemetry.
Why this answer
Rolling averages help identify underlying trends in noisy data, making periodic beaconing patterns more visible.
An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?
Weaponization focuses on combining exploits and payloads, making intelligence on builder tools and exploit frameworks relevant.
Why this answer
Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.
An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)
Tasking sources and overseeing data flow are core operational responsibilities of collection management.
Why this answer
Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.
Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?
Delivery via phishing is the most common target of security awareness training.
Why this answer
Social engineering and phishing attacks occur during the Delivery phase, which is best addressed by human-centric training.
You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?
Protocol Tunneling describes using legitimate tunnels to hide traffic.
Why this answer
This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.
A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?
This format is designed to provide actionable business context for leadership.
Why this answer
Strategic reports focus on trends, business risk, and high-level summaries, which are best presented in an executive PDF or dashboard format.
When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?
This ensures an objective comparison.
Why this answer
Mitigating bias involves systematically analyzing evidence for all hypotheses and consciously searching for disconfirming information.
When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?
The 'pattern' is the core of the indicator; without it, the indicator is useless.
Why this answer
A well-formed STIX 2.1 Indicator requires an ID, a type, and the pattern that defines what is being looked for (the indicator logic).
You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?
OpenIOC uses an XML structure that supports logic (AND, OR, NOT) and hierarchy.
Why this answer
OpenIOC allows for the expression of complex logical relationships between indicators, rather than just simple flat lists.
When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?
Golden tickets often have abnormally long expiration dates.
Why this answer
The ticket lifetime and the account SID are key indicators; Golden Tickets often use a fake domain admin SID.
When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?
The Collection ID is the mandatory identifier for retrieving data from a specific collection.
Why this answer
In TAXII 2.1, the Collection ID is a unique UUID that enables clients to request specific datasets from a server that may host multiple collections.
You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?
Relationship objects define the SDO connections.
Why this answer
The 'Relationship' object in STIX 2.1 is used to define how SDOs (STIX Domain Objects) interact, such as a Threat Actor 'uses' an Infrastructure object.
You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?
This reveals the regularity of the infrastructure shifts.
Why this answer
Time-series analysis allows you to plot the rotation interval, revealing the temporal pattern of the infrastructure change.
What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?
Exfiltration is a primary activity within the Actions on Objectives phase.
Why this answer
This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.
You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?
The CoA object describes the action to take when an indicator is triggered.
Why this answer
The STIX CoA object is designed to provide automated or manual recommendations to mitigate the threat described in the intelligence.
During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?
The Identify function includes asset management, business environment assessment, and risk assessment tasks that drive intelligence requirements.
Why this answer
The NIST CSF 'Govern' (GV) and 'Identify' (ID) functions encompass the establishment of policies, procedures, and asset/threat identification, with ID.RA (Risk Assessment) and GV subcategories guiding intelligence requirement definition.
Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?
Old intelligence may no longer be relevant.
Why this answer
Data reliability depends on the source's history, the timeliness of the reporting, and the ability to verify the data.
You are integrating a new threat intelligence platform (TIP). You need to define a 'Custom Object' in STIX 2.1 to track a specific internal project codename associated with threat actors. Which prefix must be used for the custom object name to ensure compatibility and avoid collisions?
The 'x-' prefix is mandatory for custom STIX 2.1 extensions.
Why this answer
In STIX 2.1, custom objects must be prefixed with 'x-' to identify them as non-standard extensions to the schema.
An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?
Beaconing is the hallmark of C2 heartbeat signals.
Why this answer
Beaconing is a primary method for establishing and maintaining Command and Control.
Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?
Connectivity must be established first.
Why this answer
Troubleshooting should focus on network reachability, TLS/SSL configuration, and authentication credentials.
A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?
Event ID 4768 (TGT Request) shows the Kerberos pre-authentication requirement status.
Why this answer
AS-REP Roasting targets accounts that do not require Kerberos pre-authentication.
Which THREE of the following are valid reasons to use the STIX 'Sighting' object?
Sightings include source/observer information.
Why this answer
The Sighting object is used to indicate that an indicator was seen, provide context on the target, and show where it was detected.
You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?
This lookup table is the standard index for normalized threat data in Splunk ES.
Why this answer
The 'threat_intel_by_str' lookup table is the primary repository for normalized threat intelligence data that Splunk ES uses for correlation across its dashboards.
A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?
Capability captures the specific software, tools, exploits, and techniques utilized by the adversary against the victim.
Why this answer
In the Diamond Model, the four core vertices are Adversary, Capability, Infrastructure, and Victim. Capability represents the tools and techniques (TTPs) used by the adversary.
Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?
Threat intelligence loses value over time.
Why this answer
Good IOCs must be accurate, timely, and contextually relevant to the threat environment.
When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?
This stage involves defining the scope and requirements for intelligence collection.
Why this answer
The 'Planning and Direction' phase defines the requirements, including identifying which threat actors are relevant to the organization's risk profile.
Which THREE of the following are considered 'Internal' sources of threat intelligence for a SOC?
Endpoint data is a primary source of internal TI.
Why this answer
Internal sources include logs from network devices, EDR alerts from endpoints, and data gathered from internal incident response investigations.
A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?
This tool checks against defined rules.
Why this answer
JSON Schema validation is the standard method for verifying the structure and types of JSON data.
Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?
Linear extrapolation is often inaccurate due to external changes.
Why this answer
Extrapolating short-term patterns into long-term certainties is a common error in trend analysis.
During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?
Confirmation bias describes the tendency to notice and accept evidence supporting one's hypothesis while ignoring contradictory data.
Why this answer
Confirmation bias is the tendency to search for, interpret, favor, and recall information in a way that confirms or supports one's prior beliefs or values.
Page 3 of 3
Practice 312-85 by domain
Target a specific domain to shore up weak areas.