2024 Verified 312-85 dumps Q&As on your Certified Threat Intelligence Analyst Exam Questions Certain Success!
312-85 Exam Dumps - 100% Marks In 312-85 Exam!
NEW QUESTION # 10
Karry, a threat analyst at an XYZ organization, is performing threat intelligence analysis. During the data collection phase, he used a data collection method that involves no participants and is purely based on analysis and observation of activities and processes going on within the local boundaries of the organization.
Identify the type data collection method used by the Karry.
- A. Passive data collection
- B. Active data collection
- C. Raw data collection
- D. Exploited data collection
Answer: A
NEW QUESTION # 11
During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary's information, such as Modus operandi, tools, communication channels, and forensics evasion strategies used by adversaries.
Identify the type of threat intelligence analysis is performed by John.
- A. Operational threat intelligence analysis
- B. Technical threat intelligence analysis
- C. Tactical threat intelligence analysis
- D. Strategic threat intelligence analysis
Answer: C
Explanation:
Tactical threat intelligence analysis focuses on the immediate, technical indicators of threats, such as the tactics, techniques, and procedures (TTPs) used by adversaries, their communication channels, the tools and software they utilize, and their strategies for evading forensic analysis. This type of analysis is crucial for operational defenses and is used by security teams to adjust their defenses against current threats. Since John successfully extracted information related to the adversaries' modus operandi, tools, communication channels, and evasion strategies, he is performing tactical threat intelligence analysis. This differs from strategic and operational threat intelligence, which focus on broader trends and specific operations, respectively, and from technical threat intelligence, which deals with technical indicators like malware signatures and IPs.References:
* "Tactical Cyber Intelligence," by Cyber Threat Intelligence Network, Inc.
* "Intelligence-Driven Incident Response: Outwitting the Adversary," by Scott J. Roberts and Rebekah Brown
NEW QUESTION # 12
Joe works as a threat intelligence analyst with Xsecurity Inc. He is assessing the TI program by comparing the project results with the original objectives by reviewing project charter. He is also reviewing the list of expected deliverables to ensure that each of those is delivered to an acceptable level of quality.
Identify the activity that Joe is performing to assess a TI program's success or failure.
- A. Determining the costs and benefits associated with the program
- B. Determining the fulfillment of stakeholders
- C. Identifying areas of further improvement
- D. Conducting a gap analysis
Answer: D
Explanation:
By assessing the Threat Intelligence (TI) program through a comparison of project results with the original objectives, and by ensuring that all expected deliverables have been produced to an acceptable quality level, Joe is conducting a gap analysis. Gap analysis involves identifying the difference between the current state and the desired state or objectives, in this case, the outcomes of the TI program versus its intended goals as outlined in the project charter. This process allows for the assessment of what was successful, what fell short, and where improvements can be made, thereby evaluating the program's overall effectiveness and identifying areas for future enhancement.References:
* "Project Management Body of Knowledge (PMBOK)" by the Project Management Institute
* "Intelligence Analysis: A Target-Centric Approach" by Robert M. Clark
NEW QUESTION # 13
Which of the following characteristics of APT refers to numerous attempts done by the attacker to gain entry to the target's network?
- A. Risk tolerance
- B. Attack origination points
- C. Multiphased
- D. Timeliness
Answer: B
NEW QUESTION # 14
Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive dat a. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?
- A. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
- B. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
- C. Jim should identify the attack at an initial stage by checking the content of the user agent field.
- D. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
Answer: B
NEW QUESTION # 15
Lizzy, an analyst, wants to recognize the level of risks to the organization so as to plan countermeasures against cyber attacks. She used a threat modelling methodology where she performed the following stages:
Stage 1: Build asset-based threat profiles
Stage 2: Identify infrastructure vulnerabilities
Stage 3: Develop security strategy and plans
Which of the following threat modelling methodologies was used by Lizzy in the aforementioned scenario?
- A. VAST
- B. TRIKE
- C. OCTAVE
- D. DREAD
Answer: C
Explanation:
The threat modeling methodology employed by Lizzy, which involves building asset-based threat profiles, identifying infrastructure vulnerabilities, and developing security strategies and plans, aligns with the OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) methodology. OCTAVE focuses on organizational risk and security practices, emphasizing self-directed risk assessments to identify and prioritize threats to organizational assets and develop appropriate security strategies and plans. This methodology is asset-driven and revolves around understanding critical assets, identifying threats to those assets, and assessing vulnerabilities, leading to the development of a comprehensive security strategy.References:
* The CERT Guide to System and Network Security Practices by Julia H. Allen
* "OCTAVE Method Implementation Guide Version 2.0," Carnegie Mellon University, Software Engineering Institute
NEW QUESTION # 16
John, a professional hacker, is trying to perform APT attack on the target organization network. He gains access to a single system of a target organization and tries to obtain administrative login credentials to gain further access to the systems in the network using various techniques.
What phase of the advanced persistent threat lifecycle is John currently in?
- A. Persistence
- B. Expansion
- C. Search and exfiltration
- D. Initial intrusion
Answer: B
Explanation:
The phase described where John, after gaining initial access, is attempting to obtain administrative credentials to further access systems within the network, is known as the 'Expansion' phase of an Advanced Persistent Threat (APT) lifecycle. This phase involves the attacker expanding their foothold within the target's environment, often by escalating privileges, compromising additional systems, and moving laterally through the network. The goal is to increase control over the network and maintain persistence for ongoing access.
This phase follows the initial intrusion and sets the stage for establishing long-term presence and eventual data exfiltration or other malicious objectives.References:
* MITRE ATT&CK Framework, specifically the tactics related to Credential Access and Lateral Movement
* "APT Lifecycle: Detecting the Undetected," a whitepaper by CyberArk
NEW QUESTION # 17
ABC is a well-established cyber-security company in the United States. The organization implemented the automation of tasks such as data enrichment and indicator aggregation. They also joined various communities to increase their knowledge about the emerging threats. However, the security teams can only detect and prevent identified threats in a reactive approach.
Based on threat intelligence maturity model, identify the level of ABC to know the stage at which the organization stands with its security and vulnerabilities.
- A. Level 1: preparing for CTI
- B. Level 3: CTI program in place
- C. Level 2: increasing CTI capabilities
- D. Level 0: vague where to start
Answer: B
Explanation:
ABC cyber-security company, which has implemented automation for tasks such as data enrichment and indicator aggregation and has joined various communities to increase knowledge about emerging threats, is demonstrating characteristics of a Level 3 maturity in the threat intelligence maturity model. At this level, organizations have a formal Cyber Threat Intelligence (CTI) program in place, with processes and tools implemented to collect, analyze, and integrate threat intelligence into their security operations. Although they may still be reactive in detecting and preventing threats, the existence of structured CTI capabilities indicates a more developed stage of threat intelligence maturity.References:
* "Building a Threat Intelligence Program," by Recorded Future
* "The Threat Intelligence Handbook," by Chris Pace, Cybersecurity Evangelist at Recorded Future
NEW QUESTION # 18
A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?
- A. Strategic reports
- B. Low-level data
- C. Advisories
- D. Detection indicators
Answer: B
NEW QUESTION # 19
Kim, an analyst, is looking for an intelligence-sharing platform to gather and share threat information from a variety of sources. He wants to use this information to develop security policies to enhance the overall security posture of his organization.
Which of the following sharing platforms should be used by Kim?
- A. PortDroid network analysis
- B. Cuckoo sandbox
- C. OmniPeek
- D. Blueliv threat exchange network
Answer: D
Explanation:
The Blueliv Threat Exchange Network is a collaborative platform designed for sharing and receiving threat intelligence among security professionals and organizations. It provides real-time information on global threats, helping participants to enhance their security posture by leveraging shared intelligence. The platform facilitates the exchange ofinformation related to cybersecurity threats, including indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs) of threat actors, and other relevant data. This makes it an ideal choice for Kim, who is looking to gather and share threat information to develop security policies for his organization. In contrast, Cuckoo Sandbox is a malware analysis system, OmniPeek is a network analyzer, and PortDroid is a network analysis application, none of which are primarily designed for intelligence sharing.References:
* Blueliv's official documentation and resources
* "Building an Intelligence-Led Security Program," by Allan Liska
NEW QUESTION # 20
Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to prevent their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack.
Which of the following online sources should Alice use to gather such information?
- A. Social network settings
- B. Hacking forums
- C. Financial services
- D. Job sites
Answer: B
NEW QUESTION # 21
Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?
- A. Data collection through DNS zone transfer
- B. Data collection through passive DNS monitoring
- C. Data collection through DNS interrogation
- D. Data collection through dynamic DNS (DDNS)
Answer: C
NEW QUESTION # 22
Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP).
Which TLP color would you signify that information should be shared only within a particular community?
- A. Green
- B. Red
- C. White
- D. Amber
Answer: D
Explanation:
In the Traffic Light Protocol (TLP), the color amber signifies that the information should be limited to those who have a need-to-know within the specified community or organization, and not further disseminated without permission. TLP Red indicates information that should not be disclosed outside of the originating organization. TLP Green indicates information that is limited to the community but can be disseminated within the community without restriction. TLP White, or TLP Clear, indicates information that can be shared freely with no restrictions. Therefore, for information meant to be shared within a particular community with some restrictions on further dissemination, TLP Amber is the appropriate designation.References:
* FIRST (Forum of Incident Response and Security Teams) Traffic Light Protocol (TLP) Guidelines
* CISA (Cybersecurity and Infrastructure Security Agency) TLP Guidelines
NEW QUESTION # 23
Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.
What stage of ACH is Bob currently in?
- A. Inconsistency
- B. Refinement
- C. Diagnostics
- D. Evidence
Answer: B
Explanation:
In the Analysis of Competing Hypotheses (ACH) process, the stage where Mr. Bob is applying analysis to reject hypotheses and select the most likely one based on listed evidence, followed by preparing a matrix with screened hypotheses and evidence, is known as the 'Refinement' stage. This stage involves refining the list of hypotheses by systematically evaluating the evidence against each hypothesis, leading to the rejection of inconsistent hypotheses and the strengthening of the most plausible ones. The preparation of a matrix helps visualize the relationship between each hypothesis and the available evidence, facilitating a more objective and structured analysis.References:
* "Psychology of Intelligence Analysis" by Richards J. Heuer, Jr., for the CIA's Center for the Study of Intelligence
* "A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis" by the CIA
NEW QUESTION # 24
Jian is a member of the security team at Trinity, Inc. He was conducting a real-time assessment of system activities in order to acquire threat intelligence feeds. Heacquired feeds from sources like honeynets, P2P monitoring. infrastructure, and application logs.
Which of the following categories of threat intelligence feed was acquired by Jian?
- A. Proactive surveillance feeds
- B. External intelligence feeds
- C. CSV data feeds
- D. Internal intelligence feeds
Answer: D
Explanation:
Internal intelligence feeds are derived from data and information collected within an organization's own networks and systems. Jian's activities, such as real-time assessment of system activities and acquiring feeds from honeynets, P2P monitoring, infrastructure, and application logs, fall under the collection of internal intelligence feeds. These feeds are crucial for identifying potential threats and vulnerabilities within the organization and form a fundamental part of a comprehensive threat intelligence program. They contrast with external intelligence feeds, which are sourced from outside the organization and include information on broader cyber threats, trends, and TTPs of threat actors.References:
* "Building an Intelligence-Led Security Program" by Allan Liska
* "Threat Intelligence: Collecting, Analysing, Evaluating" by M-K. Lee, L. Healey, and P. A. Porras
NEW QUESTION # 25
Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?
- A. True attribution
- B. Intrusion-set attribution
- C. Nation-state attribution
- D. Campaign attribution
Answer: A
Explanation:
True attribution in the context of cyber threats involves identifying the actual individual, group, or nation-state behind an attack or intrusion. This type of attribution goes beyond associating an attack with certain tactics, techniques, and procedures (TTPs) or a known group and aims to pinpoint the real-world entity responsible.
True attribution ischallenging due to the anonymity of the internet and the use of obfuscation techniques by attackers, but it is crucial for understanding the motive behind an attack and for forming appropriate responses at diplomatic, law enforcement, or cybersecurity levels.References:
* "Attribution of Cyber Attacks: A Framework for an Evidence-Based Analysis" by Jason Healey
* "The Challenges of Attribution in Cyberspace" in the Journal of Cyber Policy
NEW QUESTION # 26
A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?
- A. MAC spoofing attack
- B. Distributed Denial-of-Service (DDoS) attack
- C. DHCP attacks
- D. Bandwidth attack
Answer: B
Explanation:
The attack described, where multiple connection requests from different geo-locations are received by a server within a short time span leading to stress and reduced performance, is indicative of a Distributed Denial-of-Service (DDoS) attack. In a DDoS attack, the attacker floods the target's resources (such as a server) with excessive requests from multiple sources, making it difficult for the server to handle legitimate traffic, leading to degradation or outright unavailability of service. The use of multiple geo-locations for the attack sources is a common characteristic of DDoS attacks, making them harder to mitigate.References:
* "Understanding Denial-of-Service Attacks," US-CERT
* "DDoS Quick Guide," DHS/NCCIC
NEW QUESTION # 27
An analyst wants to disseminate the information effectively so that the consumers can acquire and benefit out of the intelligence.
Which of the following criteria must an analyst consider in order to make the intelligence concise, to the point, accurate, and easily understandable and must consist of a right balance between tables, narrative, numbers, graphics, and multimedia?
- A. The right time
- B. The right content
- C. The right presentation
- D. The right order
Answer: C
NEW QUESTION # 28
Walter and Sons Company has faced major cyber attacks and lost confidential dat a. The company has decided to concentrate more on the security rather than other resources. Therefore, they hired Alice, a threat analyst, to perform data analysis. Alice was asked to perform qualitative data analysis to extract useful information from collected bulk data.
Which of the following techniques will help Alice to perform qualitative data analysis?
- A. Finding links between data and discover threat-related information
- B. Numerical calculations, statistical modeling, measurement, research, and so on.
- C. Regression analysis, variance analysis, and so on
- D. Brainstorming, interviewing, SWOT analysis, Delphi technique, and so on
Answer: D
NEW QUESTION # 29
......
Pass Your 312-85 Exam Easily With 100% Exam Passing Guarantee: https://www.examslabs.com/ECCouncil/Certified-Threat-Intelligence-Analyst/best-312-85-exam-dumps.html
Exam Dumps Use Real Certified Threat Intelligence Analyst Dumps With 52 Questions: https://drive.google.com/open?id=1hmHsV-ZADZ9IJNUuoIBWr30XTfKW6z4A