EC-COUNCIL ECCouncil Certification 312-85 Questions & Answers

• Question 11:

  During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary's information, such as Modus operandi, tools, communication channels, and forensics evasion strategies used by adversaries.

  Identify the type of threat intelligence analysis is performed by John.

  A. Operational threat intelligence analysis

  B. Technical threat intelligence analysis

  C. Strategic threat intelligence analysis

  D. Tactical threat intelligence analysis

  Correct Answer: D

• Question 12:

  John, a professional hacker, is trying to perform APT attack on the target organization network. He gains access to a single system of a target organization and tries to obtain administrative login credentials to gain further access to the systems in the network using various techniques.

  What phase of the advanced persistent threat lifecycle is John currently in?

  A. Initial intrusion

  B. Search and exfiltration

  C. Expansion

  D. Persistence

  Correct Answer: C

• Question 13:

  An attacker instructs bots to use camouflage mechanism to hide his phishing and malware delivery locations in the rapidly changing network of compromised bots. In this particular technique, a single domain name consists of multiple IP addresses.

  Which of the following technique is used by the attacker?

  A. DNS zone transfer

  B. Dynamic DNS

  C. DNS interrogation

  D. Fast-Flux DNS

  Correct Answer: D

• Question 14:

  Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.

  What stage of ACH is Bob currently in?

  A. Diagnostics

  B. Evidence

  C. Inconsistency

  D. Refinement

  Correct Answer: A

• Question 15:

  Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?

  A. Nation-state attribution

  B. True attribution

  C. Campaign attribution

  D. Intrusion-set attribution

  Correct Answer: B

• Question 16:

  Joe works as a threat intelligence analyst with Xsecurity Inc. He is assessing the TI program by comparing the project results with the original objectives by reviewing project charter. He is also reviewing the list of expected deliverables to ensure that each of those is delivered to an acceptable level of quality.

  Identify the activity that Joe is performing to assess a TI program's success or failure.

  A. Determining the fulfillment of stakeholders

  B. Identifying areas of further improvement

  C. Determining the costs and benefits associated with the program

  D. Conducting a gap analysis

  Correct Answer: D

• Question 17:

  Jame, a professional hacker, is trying to hack the confidential information of a target organization. He identified the vulnerabilities in the target system and created a tailored deliverable malicious payload using an exploit and a backdoor to send it to the victim.

  Which of the following phases of cyber kill chain methodology is Jame executing?

  A. Reconnaissance

  B. Installation

  C. Weaponization

  D. Exploitation

  Correct Answer: C

• Question 18:

  Michael, a threat analyst, works in an organization named TechTop, was asked to conduct a cyber-threat intelligence analysis. After obtaining information regarding threats, he has started analyzing the information and understanding the nature of the threats.

  What stage of the cyber-threat intelligence is Michael currently in?

  A. Unknown unknowns

  B. Unknowns unknown

  C. Known unknowns

  D. Known knowns

  Correct Answer: C

• Question 19:

  Miley, an analyst, wants to reduce the amount of collected data and make the storing and sharing process easy. She uses filtering, tagging, and queuing technique to sort out the relevant and structured data from the large amounts of unstructured data.

  Which of the following techniques was employed by Miley?

  A. Sandboxing

  B. Normalization

  C. Data visualization

  D. Convenience sampling

  Correct Answer: B

• Question 20:

  Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular log in patterns from locations where the organization does not have business relations. This resembles that somebody is trying to steal confidential information.

  Which of the following key indicators of compromise does this scenario present?

  A. Unusual outbound network traffic

  B. Unexpected patching of systems

  C. Unusual activity through privileged user account

  D. Geographical anomalies

  Correct Answer: C