Ucertify offers free demo for 312-85 exam. "Certified Threat Intelligence Analyst", also known as 312-85 exam, is a EC-Council Certification. This set of posts, Passing the EC-Council 312-85 exam, will help you answer those questions. The 312-85 Questions & Answers covers all the knowledge points of the real exam. 100% real EC-Council 312-85 exams and revised by experts!

Check 312-85 free dumps before getting the full version:

An analyst wants to disseminate the information effectively so that the consumers can acquire and benefit out of the intelligence.
Which of the following criteria must an analyst consider in order to make the intelligence concise, to the point, accurate, and easily understandable and must consist of a right balance between tables, narrative, numbers, graphics, and multimedia?

  • A. The right time
  • B. The right presentation
  • C. The right order
  • D. The right content

Answer: B

Andrews and Sons Corp. has decided to share threat information among sharing partners. Garry, a threat analyst, working in Andrews and Sons Corp., has asked to follow a trust model necessary to establish trust between sharing partners. In the trust model used by him, the first organization makes use of a body of evidence in a second organization, and the level of trust between two organizations depends on the degree and quality of evidence provided by the first organization.
Which of the following types of trust model is used by Garry to establish the trust?

  • A. Mediated trust
  • B. Mandated trust
  • C. Direct historical trust
  • D. Validated trust

Answer: D

Tyrion, a professional hacker, is targeting an organization to steal confidential information. He wants to perform website footprinting to obtain the following information, which is hidden in the web page header.
Connection status and content type
Accept-ranges and last-modified information
X-powered-by information
Web server in use and its version
Which of the following tools should the Tyrion use to view header content?

  • A. Hydra
  • B. AutoShun
  • C. Vanguard enforcer
  • D. Burp suite

Answer: D

What is the correct sequence of steps involved in scheduling a threat intelligence program?
* 1. Review the project charter
* 2. Identify all deliverables
* 3. Identify the sequence of activities
* 4. Identify task dependencies
* 5. Develop the final schedule
* 6. Estimate duration of each activity
* 7. Identify and estimate resources for all activities
* 8. Define all activities
* 9. Build a work breakdown structure (WBS)

  • A. 1-->9-->2-->8-->3-->7-->4-->6-->5
  • B. 3-->4-->5-->2-->1-->9-->8-->7-->6
  • C. 1-->2-->3-->4-->5-->6-->9-->8-->7
  • D. 1-->2-->3-->4-->5-->6-->7-->8-->9

Answer: A

Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive data. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?

  • A. Jim should identify the attack at an initial stage by checking the content of the user agent field.
  • B. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
  • C. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
  • D. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.

Answer: C

Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular log in patterns from locations where the organization does not have business relations. This resembles that somebody is trying to steal confidential information.
Which of the following key indicators of compromise does this scenario present?

  • A. Unusual outbound network traffic
  • B. Unexpected patching of systems
  • C. Unusual activity through privileged user account
  • D. Geographical anomalies

Answer: C

Alice, an analyst, shared information with security operation managers and network operations center (NOC) staff for protecting the organizational resources against various threats. Information shared by Alice was highly technical and include threat actor TTPs, malware campaigns, tools used by threat actors, and so on.
Which of the following types of threat intelligence was shared by Alice?

  • A. Strategic threat intelligence
  • B. Tactical threat intelligence
  • C. Technical threat intelligence
  • D. Operational threat intelligence

Answer: C

Sam works as an analyst in an organization named InfoTech Security. He was asked to collect information from various threat intelligence sources. In meeting the deadline, he forgot to verify the threat intelligence sources and used data from an open-source data provider, who offered it at a very low cost. Through it was beneficial at the initial stage but relying on such data providers can produce unreliable data and noise putting the organization network into risk.
What mistake Sam did that led to this situation?

  • A. Sam used unreliable intelligence sources.
  • B. Sam used data without context.
  • C. Sam did not use the proper standardization formats for representing threat data.
  • D. Sam did not use the proper technology to use or consume the information.

Answer: D

Joe works as a threat intelligence analyst with Xsecurity Inc. He is assessing the TI program by comparing the project results with the original objectives by reviewing project charter. He is also reviewing the list of expected deliverables to ensure that each of those is delivered to an acceptable level of quality.
Identify the activity that Joe is performing to assess a TI program’s success or failure.

  • A. Determining the fulfillment of stakeholders
  • B. Identifying areas of further improvement
  • C. Determining the costs and benefits associated with the program
  • D. Conducting a gap analysis

Answer: D

In which of the following attacks does the attacker exploit vulnerabilities in a computer application before the software developer can release a patch for them?

  • A. Active online attack
  • B. Zero-day attack
  • C. Distributed network attack
  • D. Advanced persistent attack

Answer: B

Karry, a threat analyst at an XYZ organization, is performing threat intelligence analysis. During the data collection phase, he used a data collection method that involves no participants and is purely based on analysis and observation of activities and processes going on within the local boundaries of the organization.
Identify the type data collection method used by the Karry.

  • A. Active data collection
  • B. Passive data collection
  • C. Exploited data collection
  • D. Raw data collection

Answer: B

A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?

  • A. DHCP attacks
  • B. MAC spoofing attack
  • C. Distributed Denial-of-Service (DDoS) attack
  • D. Bandwidth attack

Answer: C

A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?

  • A. Advisories
  • B. Strategic reports
  • C. Detection indicators
  • D. Low-level data

Answer: C

Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP).
Which TLP color would you signify that information should be shared only within a particular community?

  • A. Red
  • B. White
  • C. Green
  • D. Amber

Answer: D

In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?

  • A. Structured form
  • B. Hybrid form
  • C. Production form
  • D. Unstructured form

Answer: D


100% Valid and Newest Version 312-85 Questions & Answers shared by 2passeasy, Get Full Dumps HERE: https://www.2passeasy.com/dumps/312-85/ (New 49 Q&As)