Free Sales Ending Soon – 100% Valid 312-85 Exam Dumps with 52 Questions [Q26-Q45]

이 게시물 평가하기

Free Sales Ending Soon – 100% Valid 312-85 Exam Dumps with 52 Questions

Verified 312-85 dumps Q&As on your Certified Threat Intelligence Analyst Exam Questions Certain Success!

NO.26 Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?

Nation-state attribution

True attribution

Campaign attribution

Intrusion-set attribution

NO.27 Sarah is a security operations center (SOC) analyst working at JW Williams and Sons organization based in Chicago. As a part of security operations, she contacts information providers (sharing partners) for gathering information such as collections of validated and prioritized threat indicators along with a detailed technical analysis of malware samples, botnets, DDoS attack methods, and various other malicious tools. She further used the collected information at the tactical and operational levels.
Sarah obtained the required information from which of the following types of sharing partner?

Providers of threat data feeds

Providers of threat indicators

Providers of comprehensive cyber-threat intelligence

Providers of threat actors

NO.28 Andrews and Sons Corp. has decided to share threat information among sharing partners. Garry, a threat analyst, working in Andrews and Sons Corp., has asked to follow a trust model necessary to establish trust between sharing partners. In the trust model used by him, the first organization makes use of a body of evidence in a second organization, and the level of trust between two organizations depends on the degree and quality of evidence provided by the first organization.
Which of the following types of trust model is used by Garry to establish the trust?

Mediated trust

Mandated trust

Direct historical trust

Validated trust

In the trust model described, where trust between two organizations depends on the degree and quality of evidence provided by the first organization, the model in use is ‘Validated Trust.’ This model relies on the validation of evidence or credentials presented by one party to another to establish trust. The validation process assesses the credibility, reliability, and relevance of the information shared, forming the basis of the trust relationship between the sharing partners. This approach is common in threat intelligence sharing where the accuracy and reliability of shared information are critical.References:
* “Building a Cybersecurity Culture,” ISACA
* “Trust Models in Information Security,” Journal of Internet Services and Applications

NO.29 Which of the following components refers to a node in the network that routes the traffic from a workstation to external command and control server and helps in identification of installed malware in the network?

Repeater

Gateway

Hub

Network interface card (NIC)

A gateway in a network functions as a node that routes traffic between different networks, such as from a local network to the internet. In the context of cyber threats, a gateway can be utilized to monitor and control the data flow to and from the network, helping in the identification and analysis of malware communications, including traffic to external command and control (C2) servers. This makes it an essential component in detecting installed malware within a network by observing anomalies or unauthorized communications at the network’s boundary. Unlike repeaters, hubs, or network interface cards (NICs) that primarily facilitate network connectivity without analyzing the traffic, gateways can enforce security policies and detect suspicious activities.References:
* “Network Security Basics,” Security+ Guide to Network Security Fundamentals
* “Malware Command and Control Channels: A Journey,” SANS Institute InfoSec Reading Room

NO.30 In which of the following storage architecture is the data stored in a localized system, server, or storage hardware and capable of storing a limited amount of data in its database and locally available for data usage?

Distributed storage

Object-based storage

Centralized storage

Cloud storage

NO.31 Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.
What stage of ACH is Bob currently in?

Diagnostics

Evidence

Inconsistency

Refinement

NO.32 Which of the following characteristics of APT refers to numerous attempts done by the attacker to gain entry to the target’s network?

Risk tolerance

Timeliness

Attack origination points

Multiphased

Advanced Persistent Threats (APTs) are characterized by their ‘Multiphased’ nature, referring to the various stages or phases the attacker undertakes to breach a network, remain undetected, and achieve their objectives.
This characteristic includes numerous attempts to gain entry to the target’s network, often starting with reconnaissance, followed by initial compromise, and progressing through stages such as establishment of a backdoor, expansion, data exfiltration, and maintaining persistence. This multiphased approach allows attackers to adapt and pursue their objectives despite potential disruptions or initial failures in their campaign.References:
* “Understanding Advanced Persistent Threats and Complex Malware,” by FireEye
* MITRE ATT&CK Framework, detailing the multiphased nature of adversary tactics and techniques

NO.33 Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to prevent their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack.
Which of the following online sources should Alice use to gather such information?

금융 서비스

Social network settings

Hacking forums

Job sites

Alice, looking to gather information on emerging threats including attack methods, tools, and post-attack techniques, should turn to hacking forums. These online platforms are frequented by cybercriminals and security researchers alike, where information on the latest exploits, malware, and hacking techniques is shared and discussed. Hacking forums can provide real-time insights into the tactics, techniques, and procedures (TTPs) used by threat actors, offering a valuable resource for threat intelligence analysts aiming to enhance their organization’s defenses.References:
* “Hacking Forums: A Ground for Cyber Threat Intelligence,” by Digital Shadows
* “The Value of Hacking Forums for Threat Intelligence,” by Flashpoint

NO.34 SecurityTech Inc. is developing a TI plan where it can drive more advantages in less funds. In the process of selecting a TI platform, it wants to incorporate a feature that ranks elements such as intelligence sources, threat actors, attacks, and digital assets of the organization, so that it can put in more funds toward the resources which are critical for the organization’s security.
Which of the following key features should SecurityTech Inc. consider in their TI plan for selecting the TI platform?

Open

워크플로

득점

Incorporating a scoring feature in a Threat Intelligence (TI) platform allows SecurityTech Inc. to evaluate and prioritize intelligence sources, threat actors, specific types of attacks, and the organization’s digital assets based on their relevance and threat level to the organization. This prioritization helps in allocating resources more effectively, focusing on protecting critical assets and countering the most significant threats. A scoring system can be based on various criteria such as the severity of threats, the value of assets, the reliability of intelligence sources, and the potential impact of threat actors or attack vectors. By quantifying these elements, SecurityTech Inc. can make informed decisions on where to invest its limited funds to enhance its security posture most effectively.References:
* “Designing and Building a Cyber Threat Intelligence Capability” by the SANS Institute
* “Threat Intelligence: What It Is, and How to Use It Effectively” by Gartner

NO.35 An XYZ organization hired Mr. Andrews, a threat analyst. In order to identify the threats and mitigate the effect of such threats, Mr. Andrews was asked to perform threat modeling. During the process of threat modeling, he collected important information about the treat actor and characterized the analytic behavior of the adversary that includes technological details, goals, and motives that can be useful in building a strong countermeasure.
What stage of the threat modeling is Mr. Andrews currently in?

System modeling

Threat determination and identification

Threat profiling and attribution

Threat ranking

During the threat modeling process, Mr. Andrews is in the stage of threat profiling and attribution, where he is collecting important information about the threat actor and characterizing the analytic behavior of the adversary. This stage involves understanding the technological details, goals, motives, and potential capabilities of the adversaries, which is essential for building effective countermeasures. Threat profiling and attribution help in creating a detailed picture of the adversary, contributing to a more focused and effective defense strategy.References:
* “The Art of Threat Profiling,” by John Pirc, SANS Institute Reading Room
* “Threat Modeling: Designing for Security,” by Adam Shostack

NO.36 Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.
Daniel comes under which of the following types of threat actor.

Industrial spies

State-sponsored hackers

Insider threat

Organized hackers

NO.37 Michael, a threat analyst, works in an organization named TechTop, was asked to conduct a cyber-threat intelligence analysis. After obtaining information regarding threats, he has started analyzing the information and understanding the nature of the threats.
What stage of the cyber-threat intelligence is Michael currently in?

Unknown unknowns

Unknowns unknown

Known unknowns

Known knowns

The “known unknowns” stage in cyber-threat intelligence refers to the phase where an analyst has identified threats but the specific details, implications, or full nature of these threats are not yet fully understood.
Michael, in this scenario, has obtained information on threats and is in the process of analyzing this information to understand the nature of the threats better. This stage involves analyzing the known data to uncover additional insights and fill in the gaps in understanding, thereby transitioning the “unknowns” into
“knowns.” This phase is critical in threat intelligence as it helps in developing actionable intelligence by deepening the understanding of the threats faced.References:
* “Intelligence Analysis: A Target-Centric Approach,” by Robert M. Clark
* “Structured Analytic Techniques for Intelligence Analysis,” by Richards J. Heuer Jr. and Randolph H.
Pherson

NO.38 Karry, a threat analyst at an XYZ organization, is performing threat intelligence analysis. During the data collection phase, he used a data collection method that involves no participants and is purely based on analysis and observation of activities and processes going on within the local boundaries of the organization.
Identify the type data collection method used by the Karry.

Active data collection

Passive data collection

Exploited data collection

Raw data collection

NO.39 A team of threat intelligence analysts is performing threat analysis on malware, and each of them has come up with their own theory and evidence to support their theory on a given malware.
Now, to identify the most consistent theory out of all the theories, which of the following analytic processes must threat intelligence manager use?

Threat modelling

Application decomposition and analysis (ADA)

Analysis of competing hypotheses (ACH)

Automated technical analysis

Analysis of Competing Hypotheses (ACH) is an analytic process designed to help an analyst or a team of analysts evaluate multiple competing hypotheses on an issue fairly and objectively. ACH assists in identifying and analyzing the evidence for and against each hypothesis, ultimately aiding in determining the most likely explanation. In the scenario where a team of threat intelligence analysts has various theories on a particular malware, ACH would be the most appropriate method to assess these competing theories systematically. ACH involves listing all possible hypotheses, collecting data and evidence, and assessing the evidence’s consistency with each hypothesis. This process helps in minimizing cognitive biases and making a more informed decision on the most consistent theory.References:
* Richards J. Heuer Jr., “Psychology of Intelligence Analysis,” Central Intelligence Agency
* “A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis,” Central Intelligence Agency

NO.40 What is the correct sequence of steps involved in scheduling a threat intelligence program?
1. Review the project charter
2. Identify all deliverables
3. Identify the sequence of activities
4. Identify task dependencies
5. Develop the final schedule
6. Estimate duration of each activity
7. Identify and estimate resources for all activities
8. Define all activities
9. Build a work breakdown structure (WBS)

1–>9–>2–>8–>3–>7–>4–>6–>5

3–>4–>5–>2–>1–>9–>8–>7–>6

1–>2–>3–>4–>5–>6–>9–>8–>7

1–>2–>3–>4–>5–>6–>7–>8–>9

The correct sequence for scheduling a threat intelligence program involves starting with the foundational steps of defining the project scope and objectives, followed by detailed planning and scheduling of tasks. The sequence starts with reviewing the project charter (1) to understand the project’s scope, objectives, and constraints. Next, building a Work Breakdown Structure (WBS) (9) helps in organizing the team’s work into manageable sections. Identifying all deliverables (2) clarifies the project’s outcomes. Defining all activities (8) involves listing the tasks required to produce the deliverables. Identifying the sequence of activities (3) and estimating resources (7) and task dependencies (4) sets the groundwork for scheduling. Estimating the duration of each activity (6) is critical before developing the final schedule (5), which combines all these elements into a comprehensive plan. This approach ensures a structured and methodical progression from project initiation to execution.References:
* “A Guide to the Project Management Body of Knowledge (PMBOK Guide),” Project Management Institute
* “Cyber Intelligence-Driven Risk,” by Intel471

NO.41 In which of the following attacks does the attacker exploit vulnerabilities in a computer application before the software developer can release a patch for them?

Active online attack

Zero-day attack

Distributed network attack

Advanced persistent attack

A zero-day attack exploits vulnerabilities in software or hardware that are unknown to the vendor or for which a patch has not yet been released. These attacks are particularly dangerous because they take advantage of the window of time between the vulnerability’s discovery and the availability of a fix, leaving systems exposed to potential exploitation. Zero-day attacks require a proactive and comprehensive approach to security, including the use of advanced threat detection systems and threat intelligence to identify and mitigate potential threats before they can be exploited.References:
* “Understanding Zero-Day Exploits,” by MITRE
* “Zero-Day Threats: What They Are and How to Protect Against Them,” by Symantec

NO.42 Tracy works as a CISO in a large multinational company. She consumes threat intelligence to understand the changing trends of cyber security. She requires intelligence to understand the current business trends and make appropriate decisions regarding new technologies, security budget, improvement of processes, and staff. The intelligence helps her in minimizing business risks and protecting the new technology and business initiatives.
Identify the type of threat intelligence consumer is Tracy.

Tactical users

Strategic users

Operational users

Technical users

Tracy, as a Chief Information Security Officer (CISO), requires intelligence that aids in understanding broader business and cybersecurity trends, making informed decisions regarding new technologies, security budgets, process improvements, and staffing. This need aligns with the role of a strategic user of threat intelligence.
Strategic users leverage intelligence to guide long-term planning and decision-making, focusing on minimizing business risks and safeguarding against emerging threats to new technology and business initiatives. This type of intelligence is less about the technical specifics of individual threats and more about understanding the overall threat landscape, regulatory environment, and industry trends to inform high-level strategy and policy.References:
* “The Role of Strategic Intelligence in Cybersecurity,” Journal of Cybersecurity Education, Research and Practice
* “Cyber Threat Intelligence and the Lessons from Law Enforcement,” by Robert M. Lee and David Bianco, SANS Institute Reading Room

NO.43 Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP).
Which TLP color would you signify that information should be shared only within a particular community?

Red

White

Green

Amber

NO.44 ABC is a well-established cyber-security company in the United States. The organization implemented the automation of tasks such as data enrichment and indicator aggregation. They also joined various communities to increase their knowledge about the emerging threats. However, the security teams can only detect and prevent identified threats in a reactive approach.
Based on threat intelligence maturity model, identify the level of ABC to know the stage at which the organization stands with its security and vulnerabilities.

Level 2: increasing CTI capabilities

Level 3: CTI program in place

Level 1: preparing for CTI

Level 0: vague where to start

NO.45 Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?

Data collection through passive DNS monitoring

Data collection through DNS interrogation

Data collection through DNS zone transfer

Data collection through dynamic DNS (DDNS)

Passive DNS monitoring involves collecting data about DNS queries and responses without actively querying DNS servers, thereby not altering or interfering with DNS traffic. This technique allows analysts to track changes in DNS records and observe patterns that may indicate malicious activity. In the scenario described, Enrique is employing passive DNS monitoring by using a recursive DNS server to log the responses received from name servers, storing these logs in a central database for analysis. This approach is effective for identifying malicious domains, mapping malware campaigns, and understanding threat actors’ infrastructure without alerting them to the fact that they are being monitored. This method is distinct from active techniques such as DNS interrogation or zone transfers, which involve sending queries to DNS servers, and dynamic DNS, which refers to the automatic updating of DNS records.References:
* SANS Institute InfoSec Reading Room, “Using Passive DNS to Enhance Cyber Threat Intelligence”
* “Passive DNS Replication,” by Florian Weimer, FIRST Conference Presentation

로드 중 …