How many Hard Difficulty Questions questions are on this page?

This page has 20 Hard Difficulty Questions scenario questions for the 312-85 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 312-85 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Threat Intelligence Analyst (312-85) questions

Scenario-based practice

Hard Difficulty Questions

Practise Certified Threat Intelligence Analyst (312-85) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

312-85

exam code

EC-Council

vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

A
Weaponization
Weaponization involves the creation of the malicious artifact intended for the victim.
B
Exploitation
Why wrong: Exploitation involves the actual triggering of the vulnerability.
C
Delivery
Why wrong: Delivery is the transmission of the weaponized payload to the target.
D
Installation
Why wrong: Installation is the persistent placement of the malware on the system.

Hard Difficulty Questions

How to approach hard difficulty questions

Quick answer

Related 312-85 topic practice pages

Data Analysis practice questions

Intelligence Reporting And Dissemination practice questions

Data Collection And Processing practice questions

Cyber Threats And Attack Frameworks practice questions

Introduction TO Threat Intelligence practice questions

Threat Hunting And Detection practice questions

Threat Intelligence IN SOC IR And Risk Management practice questions

Requirements Planning Direction And Review practice questions

312-85 fundamentals practice questions

312-85 scenario practice questions

312-85 troubleshooting practice questions

Practice scenarios

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Which THREE of the following are key components of a STIX 2.1 'Indicator' object?

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?