Eccouncil 312-85 practice test

Certified Threat Intelligence Analyst Exam

Last exam update: May 13 ,2024
Page 1 out of 3. Viewing questions 1-15 out of 49

Question 1

In which of the following storage architecture is the data stored in a localized system, server, or
storage hardware and capable of storing a limited amount of data in its database and locally available
for data usage?

  • A. Distributed storage
  • B. Object-based storage
  • C. Centralized storage
  • D. Cloud storage
Answer:

B

User Votes:
A
50%
B
50%
C 1 votes
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 2

In which of the following forms of bulk data collection are large amounts of data first collected from
multiple sources in multiple formats and then processed to achieve threat intelligence?

  • A. Structured form
  • B. Hybrid form
  • C. Production form
  • D. Unstructured form
Answer:

D

User Votes:
A 1 votes
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

Alison, an analyst in an XYZ organization, wants to retrieve information about a companys website
from the time of its inception as well as the removed information from the target website.
What should Alison do to get the information he needs.

  • A. Alison should use SmartWhois to extract the required website information.
  • B. Alison should use https://archive.org to extract the required website information.
  • C. Alison should run the Web Data Extractor tool to extract the required website information.
  • D. Alison should recover cached pages of the website from the Google search engine cache to extract the required website information.
Answer:

C

User Votes:
A
50%
B
50%
C 1 votes
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

An XYZ organization hired Mr. Andrews, a threat analyst. In order to identify the threats and mitigate
the effect of such threats, Mr. Andrews was asked to perform threat modeling. During the process of
threat modeling, he collected important information about the treat actor and characterized the
analytic behavior of the adversary that includes technological details, goals, and motives that can be
useful in building a strong countermeasure.
What stage of the threat modeling is Mr. Andrews currently in?

  • A. System modeling
  • B. Threat determination and identification
  • C. Threat profiling and attribution
  • D. Threat ranking
Answer:

C

User Votes:
A
50%
B
50%
C 1 votes
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

Alice, an analyst, shared information with security operation managers and network operations
center (NOC) staff for protecting the organizational resources against various threats. Information
shared by Alice was highly technical and include threat actor TTPs, malware campaigns, tools used by
threat actors, and so on.
Which of the following types of threat intelligence was shared by Alice?

  • A. Strategic threat intelligence
  • B. Tactical threat intelligence
  • C. Technical threat intelligence
  • D. Operational threat intelligence
Answer:

C

User Votes:
A
50%
B
50%
C 1 votes
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

Sam works as an analyst in an organization named InfoTech Security. He was asked to collect
information from various threat intelligence sources. In meeting the deadline, he forgot to verify the
threat intelligence sources and used data from an open-source data provider, who offered it at a very
low cost. Through it was beneficial at the initial stage but relying on such data providers can produce
unreliable data and noise putting the organization network into risk.
What mistake Sam did that led to this situation?

  • A. Sam used unreliable intelligence sources.
  • B. Sam used data without context.
  • C. Sam did not use the proper standardization formats for representing threat data.
  • D. Sam did not use the proper technology to use or consume the information.
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

A network administrator working in an ABC organization collected log files generated by a traffic
monitoring system, which may not seem to have useful information, but after performing proper
analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?

  • A. Advisories
  • B. Strategic reports
  • C. Detection indicators
  • D. Low-level data
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

An organization suffered many major attacks and lost critical information, such as employee records,
and financial information. Therefore, the management decides to hire a threat analyst to extract the
strategic threat intelligence that provides high-level information regarding current cyber-security
posture, threats, details on the financial impact of various cyber-activities, and so on.
Which of the following sources will help the analyst to collect the required intelligence?

  • A. Active campaigns, attacks on other organizations, data feeds from external third parties
  • B. OSINT, CTI vendors, ISAO/ISACs
  • C. Campaign reports, malware, incident reports, attack group reports, human intelligence
  • D. Human, social media, chat rooms
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

Tracy works as a CISO in a large multinational company. She consumes threat intelligence to
understand the changing trends of cyber security. She requires intelligence to understand the current
business trends and make appropriate decisions regarding new technologies, security budget,
improvement of processes, and staff. The intelligence helps her in minimizing business risks and
protecting the new technology and business initiatives.
Identify the type of threat intelligence consumer is Tracy.

  • A. Tactical users
  • B. Strategic users
  • C. Operational users
  • D. Technical users
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

An analyst wants to disseminate the information effectively so that the consumers can acquire and
benefit out of the intelligence.
Which of the following criteria must an analyst consider in order to make the intelligence concise, to
the point, accurate, and easily understandable and must consist of a right balance between tables,
narrative,
numbers,
graphics, and multimedia?

  • A. The right time
  • B. The right presentation
  • C. The right order
  • D. The right content
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 11

Joe works as a threat intelligence analyst with Xsecurity Inc. He is assessing the TI program by
comparing the project results with the original objectives by reviewing project charter. He is also
reviewing the list of expected deliverables to ensure that each of those is delivered to an acceptable
level of quality.
Identify the activity that Joe is performing to assess a TI programs success or failure.

  • A. Determining the fulfillment of stakeholders
  • B. Identifying areas of further improvement
  • C. Determining the costs and benefits associated with the program
  • D. Conducting a gap analysis
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 12

Tyrion, a professional hacker, is targeting an organization to steal confidential information. He wants
to perform website footprinting to obtain the following information, which is hidden in the web page
header.
Connection status and content type
Accept-ranges and last-modified information
X-powered-by information
Web server in use and its version
Which of the following tools should the Tyrion use to view header content?

  • A. Hydra
  • B. AutoShun
  • C. Vanguard enforcer
  • D. Burp suite
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a
stage where he is required to apply his analysis skills effectively to reject as many hypotheses and
select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of
listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top,
and the listed evidence for the hypotheses are placed at the bottom.
What stage of ACH is Bob currently in?

  • A. Diagnostics
  • B. Evidence
  • C. Inconsistency
  • D. Refinement
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

SecurityTech Inc. is developing a TI plan where it can drive more advantages in less funds. In the
process of selecting a TI platform, it wants to incorporate a feature that ranks elements such as
intelligence sources, threat actors, attacks, and digital assets of the organization, so that it can put in
more funds toward the resources which are critical for the organizations security.
Which of the following key features should SecurityTech Inc. consider in their TI plan for selecting the
TI platform?

  • A. Search
  • B. Open
  • C. Workflow
  • D. Scoring
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an
indication of adversarys information, such as Modus operandi, tools, communication channels, and
forensics evasion strategies used by adversaries.
Identify the type of threat intelligence analysis is performed by John.

  • A. Operational threat intelligence analysis
  • B. Technical threat intelligence analysis
  • C. Strategic threat intelligence analysis
  • D. Tactical threat intelligence analysis
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2