EC-COUNCIL ECCouncil Certification 312-85 Questions & Answers

• Question 21:

  Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive data. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.

  What should Jim do to detect the data staging before the hackers exfiltrate from the network?

  A. Jim should identify the attack at an initial stage by checking the content of the user agent field.

  B. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.

  C. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.

  D. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.

  Correct Answer: C

• Question 22:

  Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.

  Daniel comes under which of the following types of threat actor.

  A. Industrial spies

  B. State-sponsored hackers

  C. Insider threat

  D. Organized hackers

  Correct Answer: D

• Question 23:

  Sam works as an analyst in an organization named InfoTech Security. He was asked to collect information from various threat intelligence sources. In meeting the deadline, he forgot to verify the threat intelligence sources and used data from an open-source data provider, who offered it at a very low cost. Through it was beneficial at the initial stage but relying on such data providers can produce unreliable data and noise putting the organization network into risk.

  What mistake Sam did that led to this situation?

  A. Sam used unreliable intelligence sources.

  B. Sam used data without context.

  C. Sam did not use the proper standardization formats for representing threat data.

  D. Sam did not use the proper technology to use or consume the information.

  Correct Answer: D

• Question 24:

  Cybersol Technologies initiated a cyber-threat intelligence program with a team of threat intelligence analysts. During the process, the analysts started converting the raw data into useful information by applying various techniques, such as machine-based techniques, and statistical methods.

  In which of the following phases of the threat intelligence lifecycle is the threat intelligence team currently working?

  A. Dissemination and integration

  B. Planning and direction

  C. Processing and exploitation

  D. Analysis and production

  Correct Answer: A

• Question 25:

  In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?

  A. Structured form

  B. Hybrid form

  C. Production form

  D. Unstructured form

  Correct Answer: D

• Question 26:

  A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.

  Which of the following categories of threat information has he collected?

  A. Advisories

  B. Strategic reports

  C. Detection indicators

  D. Low-level data

  Correct Answer: C

• Question 27:

  Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP). Which TLP color would you signify that information should be shared only within a particular community?

  A. Red

  B. White

  C. Green

  D. Amber

  Correct Answer: D

• Question 28:

  Sarah is a security operations center (SOC) analyst working at JW Williams and Sons organization based in Chicago. As a part of security operations, she contacts information providers (sharing partners) for gathering information such as collections of validated and prioritized threat indicators along with a detailed technical analysis of malware samples, botnets, DDoS attack methods, and various other malicious tools. She further used the collected information at the tactical and operational levels.

  Sarah obtained the required information from which of the following types of sharing partner?

  A. Providers of threat data feeds

  B. Providers of threat indicators

  C. Providers of comprehensive cyber-threat intelligence

  D. Providers of threat actors

  Correct Answer: C

• Question 29:

  Lizzy, an analyst, wants to recognize the level of risks to the organization so as to plan countermeasures against cyber attacks. She used a threat modelling methodology where she performed the following stages: Stage 1: Build asset-based threat profiles Stage 2: Identify infrastructure vulnerabilities Stage 3: Develop security strategy and plans Which of the following threat modelling methodologies was used by Lizzy in the aforementioned scenario?

  A. TRIKE

  B. VAST

  C. OCTAVE

  D. DREAD

  Correct Answer: C

• Question 30:

  Walter and Sons Company has faced major cyber attacks and lost confidential data. The company has decided to concentrate more on the security rather than other resources. Therefore, they hired Alice, a threat analyst, to perform data analysis. Alice was asked to perform qualitative data analysis to extract useful information from collected bulk data.

  Which of the following techniques will help Alice to perform qualitative data analysis?

  A. Regression analysis, variance analysis, and so on

  B. Numerical calculations, statistical modeling, measurement, research, and so on.

  C. Brainstorming, interviewing, SWOT analysis, Delphi technique, and so on

  D. Finding links between data and discover threat-related information

  Correct Answer: C