無料Certified Threat Intelligence Analyst 312-85究極の学習ガイド（更新された90問あります)
トップクラスの312-85練習試験問題
質問 # 30
Tracy works as a CISO in a large multinational company. She consumes threat intelligence to understand the changing trends of cyber security. She requires intelligence to understand the current business trends and make appropriate decisions regarding new technologies, security budget, improvement of processes, and staff.
The intelligence helps her in minimizing business risks and protecting the new technology and business initiatives.
Identify the type of threat intelligence consumer is Tracy.
- A. Technical users
- B. Strategic users
- C. Tactical users
- D. Operational users
正解：B
解説：
Tracy, as a Chief Information Security Officer (CISO), requires intelligence that aids in understanding broader business and cybersecurity trends, making informed decisions regarding new technologies, security budgets, process improvements, and staffing. This need aligns with the role of a strategic user of threat intelligence. Strategic users leverage intelligence to guide long-term planning and decision-making, focusing on minimizing business risks and safeguarding against emerging threats to new technology and business initiatives. This type of intelligence is less about the technical specifics of individual threats and more about understanding the overall threat landscape, regulatory environment, and industry trends to inform high-level strategy and policy.
References:
"The Role of Strategic Intelligence in Cybersecurity," Journal of Cybersecurity Education, Research and Practice
"Cyber Threat Intelligence and the Lessons from Law Enforcement," by Robert M. Lee and David Bianco, SANS Institute Reading Room
質問 # 31
In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?
- A. Unstructured form
- B. Production form
- C. Hybrid form
- D. Structured form
正解：A
解説：
In the context of bulk data collection for threat intelligence, data is often initially collected in an unstructured form from multiple sources and in various formats. This unstructured data includes information from blogs, news articles, threat reports, social media, and other sources that do not follow a specific structure or format.
The subsequent processing of this data involves organizing, structuring, and analyzing it to extract actionable threat intelligence. This phase is crucial for turning vast amounts of disparate data into coherent, useful insights for cybersecurity purposes.References:
* "The Role of Unstructured Data in Cyber Threat Intelligence," by Jason Trost, Anomali
* "Turning Unstructured Data into Cyber Threat Intelligence," by Giorgio Mosca, IEEE Xplore
質問 # 32
A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?
- A. Low-level data
- B. Advisories
- C. Strategic reports
- D. Detection indicators
正解：A
質問 # 33
Miley, an analyst, wants to reduce the amount of collected data and make the storing and sharing process easy. She uses filtering, tagging, and queuing technique to sort out the relevant and structured data from the large amounts of unstructured data.
Which of the following techniques was employed by Miley?
- A. Convenience sampling
- B. Data visualization
- C. Sandboxing
- D. Normalization
正解：D
解説：
Normalization in the context of data analysis refers to the process of organizing data to reduce redundancy and improve efficiency in storing and sharing. By filtering, tagging, and queuing, Miley is effectively normalizing the data-converting it from various unstructured formats into a structured, more accessible format. This makes the data easier to analyze, store, and share. Normalization is crucial in cybersecurity and threat intelligence to manage the vast amounts of data collected and ensure that only relevant data is retained and analyzed. This technique contrasts with sandboxing, which is used for isolating and analyzing suspicious code; data visualization, which involves representing data graphically; and convenience sampling, which is a method of sampling where samples are taken from a group that is conveniently accessible.
References:
"The Application of Data Normalization to Database Security," International Journal of Computer Science Issues SANS Institute Reading Room, "Data Normalization Considerations in Cyber Threat Intelligence"
質問 # 34
Tyrion, a professional hacker, is targeting an organization to steal confidential information. He wants to perform website footprinting to obtain the following information, which is hidden in the web page header.
Connection status and content type
Accept-ranges and last-modified information
X-powered-by information
Web server in use and its version
Which of the following tools should the Tyrion use to view header content?
- A. Vanguard enforcer
- B. Hydra
- C. Burp suite
- D. AutoShun
正解：C
解説：
Burp Suite is a comprehensive tool used for web application security testing, which includes functionality for viewing and manipulating the HTTP/HTTPS headers of web page requests and responses. This makes it an ideal tool for someone like Tyrion, who is looking to perform website footprinting to gather information hidden in the web page header, such as connection status, content type, server information, and other metadata that can reveal details about the web server and its configuration. Burp Suite allows users to intercept, analyze, and modify traffic between the browser and the web server, which is crucial for uncovering such hidden information.References:
* "Burp Suite Essentials" by Akash Mahajan
* Official Burp Suite Documentation
質問 # 35
Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive data. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?
- A. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
- B. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
- C. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
- D. Jim should identify the attack at an initial stage by checking the content of the user agent field.
正解：B
解説：
In the scenario described, where attackers have penetrated the network and are staging data for exfiltration, Jim should focus on monitoring network traffic for signs of malicious file transfers, implement file integrity monitoring, and scrutinize event logs. This approach is crucial for detecting unusual activity that could indicate data staging, such as large volumes of data being moved to uncommon locations, sudden changes in file integrity, or suspicious entries in event logs. Early detection of these indicators can help in identifying the staging activity before the data is exfiltrated from the network.References:
* NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide"
* SANS Institute Reading Room, "Detecting Malicious Activity with DNS and NetFlow"
質問 # 36
In which of the following storage architecture is the data stored in a localized system, server, or storage hardware and capable of storing a limited amount of data in its database and locally available for data usage?
- A. Object-based storage
- B. Cloud storage
- C. Distributed storage
- D. Centralized storage
正解：D
解説：
Centralized storage architecture refers to a system where data is stored in a localized system, server, or storage hardware. This type of storage is capable of holding a limited amount of data in its database and is locally available for data usage. Centralized storage is commonly used in smaller organizations or specific departments within larger organizations where the volume of data is manageable and does not require the scalability offered by distributed or cloud storage solutions. Centralized storage systems simplify data management and access but might present challenges in terms of scalability and data recovery.
References:
"Data Storage Solutions for Your Business: Centralized vs. Decentralized," Techopedia
"The Basics of Centralized Data Storage," by Margaret Rouse, SearchStorage
質問 # 37
In which of the following attacks does the attacker exploit vulnerabilities in a computer application before the software developer can release a patch for them?
- A. Advanced persistent attack
- B. Distributed network attack
- C. Active online attack
- D. Zero-day attack
正解：D
質問 # 38
SecurityTech Inc. is developing a TI plan where it can drive more advantages in less funds. In the process of selecting a TI platform, it wants to incorporate a feature that ranks elements such as intelligence sources, threat actors, attacks, and digital assets of the organization, so that it can put in more funds toward the resources which are critical for the organization's security.
Which of the following key features should SecurityTech Inc. consider in their TI plan for selecting the TI platform?
- A. Scoring
- B. Workflow
- C. Open
- D. Search
正解：A
質問 # 39
In which of the following storage architecture is the data stored in a localized system, server, or storage hardware and capable of storing a limited amount of data in its database and locally available for data usage?
- A. Object-based storage
- B. Cloud storage
- C. Distributed storage
- D. Centralized storage
正解：D
解説：
Centralized storage architecture refers to a system where data is stored in a localized system, server, or storage hardware. This type of storage is capable of holding a limited amount of data in its database and is locally available for data usage. Centralized storage is commonly used in smaller organizations or specific departments within larger organizations where the volume of data is manageable and does not require the scalability offered by distributed or cloud storage solutions. Centralized storage systems simplify data management and access but might present challenges in terms of scalabilityand data recovery.References:
* "Data Storage Solutions for Your Business: Centralized vs. Decentralized," Techopedia
* "The Basics of Centralized Data Storage," by Margaret Rouse, SearchStorage
質問 # 40
Alice, an analyst, shared information with security operation managers and network operations center (NOC) staff for protecting the organizational resources against various threats. Information shared by Alice was highly technical and include threat actor TTPs, malware campaigns, tools used by threat actors, and so on.
Which of the following types of threat intelligence was shared by Alice?
- A. Technical threat intelligence
- B. Strategic threat intelligence
- C. Operational threat intelligence
- D. Tactical threat intelligence
正解：D
質問 # 41
What term describes the trust establishment process, wherein the first organization relies on a body of evidence presented to the second organization, and the level of trust is contingent upon the degree and quality of evidence provided by the initiating organization?
- A. Validated trust
- B. Mandated trust
- C. Mediated trust
- D. Direct historical trust
正解：A
解説：
The scenario describes a trust establishment process where one organization bases its trust in another on the degree and quality of evidence that the second organization provides. This concept is known as Validated Trust.
Validated Trust is built through the verification and assessment of presented evidence such as certifications, security audits, compliance documentation, or past performance. The higher the credibility and quality of the evidence, the greater the level of trust established.
This type of trust is evidence-based, meaning it does not rely solely on previous interactions or third-party mediation but on verifiable proof provided directly between the entities involved.
Why the Other Options Are Incorrect:
* A. Mandated Trust:This is imposed by regulation, policy, or authority. It is not based on evidence but on obligation or requirement.
* B. Direct Historical Trust:This trust is formed from prior experiences and a consistent history of interactions between the entities. It does not depend on new evidence or documentation.
* D. Mediated Trust:This form of trust is established through an intermediary (such as a trusted third party or certificate authority) who vouches for the credibility of one organization to another.
Conclusion:
The process where trust is established based on the degree and quality of evidence provided by one party is known as Validated Trust.
Final Answer: C. Validated Trust
Explanation Reference (Based on CTIA Study Concepts):
According to the CTIA study topics under "Information Sharing and Trust Establishment," validated trust is the level of confidence gained through verification of tangible evidence, certifications, or attestations demonstrating security assurance and reliability.
質問 # 42
Tim is working as an analyst in an ABC organization. His organization had been facing many challenges in converting the raw threat intelligence data into meaningful contextual information. After inspection, he found that it was due to noise obtained from misrepresentation of data from huge data collections. Hence, it is important to clean the data before performing data analysis using techniques such as data reduction. He needs to choose an appropriate threat intelligence framework that automatically performs data collection, filtering, and analysis for his organization.
Which of the following threat intelligence frameworks should he choose to perform such task?
- A. HighCharts
- B. TC complete
- C. SIGVERIF
- D. Threat grid
正解：D
解説：
Threat Grid is a threat intelligence and analysis platform that offers advanced capabilities for automatic data collection, filtering, and analysis. It is designed to help organizations convert raw threat data into meaningful, actionable intelligence. By employing advanced analytics and machine learning, Threat Grid can reduce noise from large data sets, helping to eliminate misrepresentations and enhance the quality of the threat intelligence.
This makes it an ideal choice for Tim, who is looking to address the challenges of converting raw data into contextual information and managing the noise from massive data collections.References:
* "Cisco Threat Grid: Unify Your Threat Defense," Cisco
* "Integrating and Automating Threat Intelligence," by Threat Grid
質問 # 43
Walter and Sons Company has faced major cyber attacks and lost confidential data. The company has decided to concentrate more on the security rather than other resources. Therefore, they hired Alice, a threat analyst, to perform data analysis. Alice was asked to perform qualitative data analysis to extract useful information from collected bulk data.
Which of the following techniques will help Alice to perform qualitative data analysis?
- A. Finding links between data and discover threat-related information
- B. Numerical calculations, statistical modeling, measurement, research, and so on.
- C. Regression analysis, variance analysis, and so on
- D. Brainstorming, interviewing, SWOT analysis, Delphi technique, and so on
正解：D
解説：
For Alice to perform qualitative data analysis, techniques such as brainstorming, interviewing, SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis, and the Delphi technique are suitable. Unlike quantitative analysis, which involves numerical calculations and statistical modeling, qualitative analysis focuses on understanding patterns, themes, and narratives within the data. These techniques enable the analyst to explore the data's deeper meanings and insights, which are essential for strategic decision-making and developing a nuanced understanding of cybersecurity threats and vulnerabilities.References:
* "Qualitative Research Methods in Cybersecurity," SANS Institute Reading Room
* "The Delphi Method for Cybersecurity Risk Assessment," by Cybersecurity and Infrastructure Security Agency (CISA)
質問 # 44
Jack is a professional hacker who wants to perform remote exploitation on the target system of an organization. He established a two-way communication channel between the victim's system and his server.
He used encryption techniques to hide the presence of a communication channel on a victim's system and further applied privilege escalation techniques to exploit the system.
What phase of the cyber kill chain methodology is Jack currently in?
- A. Weaponization
- B. Delivery
- C. Reconnaissance
- D. Command and Control
正解：D
解説：
In the Cyber Kill Chain model, the Command and Control (C2) phase refers to the stage where the attacker establishes a communication channel between the compromised system and their own server to maintain remote control, issue commands, and exfiltrate data.
In the given scenario, Jack has already compromised the system and set up a two-way communication link, which is encrypted to avoid detection. This activity is characteristic of the Command and Control phase.
Key Characteristics of the Command and Control Phase:
* The attacker establishes remote communication with the compromised host.
* Encryption or obfuscation methods are used to hide the channel.
* The attacker uses this channel to send further commands, escalate privileges, and execute malicious actions.
* Typical tools: Remote Access Trojans (RATs), backdoors, and tunneling techniques.
Why the Other Options Are Incorrect:
* B. Weaponization:This phase involves creating or configuring the malicious payload or exploit (e.g., binding malware to a document or executable). It occurs before the attack delivery.
* C. Reconnaissance:The attacker gathers information about the target (network structure, vulnerabilities) before launching an attack.
* D. Delivery:This phase involves transmitting the weaponized payload to the target through methods such as email attachments, infected links, or USB drives.
Conclusion:
By establishing an encrypted communication channel and controlling the victim's system remotely, Jack is in the Command and Control phase of the Cyber Kill Chain.
Final Answer: A. Command and Control
Explanation Reference (Based on CTIA Study Concepts):
As defined in CTIA materials under "Adversary Tactics, Techniques, and Procedures (TTPs)" and "Cyber Kill Chain Stages," the Command and Control phase involves creating and maintaining communication between compromised hosts and attacker infrastructure for persistent access and control.
質問 # 45
Organizations must choose the right threat intelligence platform to assess and leverage intelligence information, monitor multiple enforcement points, manage intelligence feeds, and select appropriate security for digital assets.
Which of the following key factors ensures that the threat intelligence platform offers a structured way to perform investigations on attacks by processing the threat intelligence and utilizing internal security controls to automate the detection process?
- A. Open
- B. Search
- C. Workflow
- D. Scoring
正解：C
解説：
The key factor that enables a structured and automated process for investigating attacks, processing intelligence, and integrating it with internal controls is Workflow.
In a Threat Intelligence Platform (TIP), the workflow defines a structured sequence of steps or processes that analysts follow to collect, process, analyze, and act on intelligence data. It ensures that:
* Intelligence is processed consistently and efficiently.
* Alerts, investigations, and responses follow predefined automation rules.
* Internal controls are linked with threat feeds for faster detection and mitigation.
A well-designed workflow also supports investigation automation, report generation, and integration with other security systems such as SIEM, SOAR, and EDR tools.
Why the Other Options Are Incorrect:
* A. Scoring: Refers to prioritizing or rating intelligence based on risk or severity but does not automate investigations.
* B. Search: Involves querying the intelligence database for specific data but lacks structured investigation processes.
* D. Open: Indicates an open architecture or API support, not workflow automation or process structuring.
Conclusion:
The correct factor that ensures structured, automated investigations in a Threat Intelligence Platform is Workflow.
Final Answer: C. Workflow
Explanation Reference (Based on CTIA Study Concepts):
CTIA defines workflow as a key element in threat intelligence platforms that organizes and automates intelligence-driven investigations across multiple security controls.
質問 # 46
In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?
- A. Unstructured form
- B. Production form
- C. Hybrid form
- D. Structured form
正解：A
質問 # 47
Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google search operators. He wants to identify whether any fake websites are hosted at the similar to the organization's URL.
Which of the following Google search queries should Moses use?
- A. cache: www.infothech.org
- B. info: www.infothech.org
- C. link: www.infothech.org
- D. related: www.infothech.org
正解：D
質問 # 48
Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to prevent their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack.
Which of the following online sources should Alice use to gather such information?
- A. Job sites
- B. Hacking forums
- C. Social network settings
- D. Financial services
正解：B
質問 # 49
Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?
- A. Data collection through passive DNS monitoring
- B. Data collection through DNS zone transfer
- C. Data collection through DNS interrogation
- D. Data collection through dynamic DNS (DDNS)
正解：C
質問 # 50
Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive dat a. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?
- A. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
- B. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
- C. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
- D. Jim should identify the attack at an initial stage by checking the content of the user agent field.
正解：B
質問 # 51
ABC is a well-established cyber-security company in the United States. The organization implemented the automation of tasks such as data enrichment and indicator aggregation. They also joined various communities to increase their knowledge about the emerging threats. However, the security teams can only detect and prevent identified threats in a reactive approach.
Based on threat intelligence maturity model, identify the level of ABC to know the stage at which the organization stands with its security and vulnerabilities.
- A. Level 3: CTI program in place
- B. Level 2: increasing CTI capabilities
- C. Level 0: vague where to start
- D. Level 1: preparing for CTI
正解：A
解説：
ABC cyber-security company, which has implemented automation for tasks such as data enrichment and indicator aggregation and has joined various communities to increase knowledge about emerging threats, is demonstrating characteristics of a Level 3 maturity in the threat intelligence maturity model. At this level, organizations have a formal Cyber Threat Intelligence (CTI) program in place, with processes and tools implemented to collect, analyze, and integrate threat intelligence into their security operations. Although they may still be reactive in detecting and preventing threats, the existence of structured CTI capabilities indicates a more developed stage of threat intelligence maturity.References:
* "Building a Threat Intelligence Program," by Recorded Future
* "The Threat Intelligence Handbook," by Chris Pace, Cybersecurity Evangelist at Recorded Future
質問 # 52
Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular log in patterns from locations where the organization does not have business relations. This resembles that somebody is trying to steal confidential information.
Which of the following key indicators of compromise does this scenario present?
- A. Unexpected patching of systems
- B. Unusual activity through privileged user account
- C. Geographical anomalies
- D. Unusual outbound network traffic
正解：B
質問 # 53
Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.
What stage of ACH is Bob currently in?
- A. Evidence
- B. Diagnostics
- C. Refinement
- D. Inconsistency
正解：C
解説：
In the Analysis of Competing Hypotheses (ACH) process, the stage where Mr. Bob is applying analysis to reject hypotheses and select the most likely one based on listed evidence, followed by preparing a matrix with screened hypotheses and evidence, is known as the 'Refinement' stage. This stage involves refining the list of hypotheses by systematically evaluating the evidence against each hypothesis, leading to the rejection of inconsistent hypotheses and the strengthening of the most plausible ones. The preparation of a matrix helps visualize the relationship between each hypothesis and the available evidence, facilitating a more objective and structured analysis.
References:
"Psychology of Intelligence Analysis" by Richards J. Heuer, Jr., for the CIA's Center for the Study of Intelligence
"A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis" by the CIA
質問 # 54
Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?
- A. Campaign attribution
- B. Intrusion-set attribution
- C. True attribution
- D. Nation-state attribution
正解：C
質問 # 55
......
ECCouncil 312-85（Certified Threat Intelligence Analyst）認定試験は、脅威インテリジェンスと分析に特化した個人を対象としたプロフェッショナル認定プログラムです。この認定試験では、さまざまなセキュリティ脅威を特定し、軽減するために必要な知識とスキルを測定します。脅威インテリジェンス、サイバー犯罪調査、脅威ハンティング、インシデント対応などのトピックが含まれます。この認定試験に合格した個人は、脅威インテリジェンスと分析の分野での専門家として認められます。
合格させるECCouncil 312-85試験問題でテスト復刻エンジンとPDF：https://www.passtest.jp/ECCouncil/312-85-shiken.html
実際問題を使って312-85問題集無料サンプル問題と練習テストエンジン：https://drive.google.com/open?id=1E1ttkptzklR2KhNR3JxgIea9fTDLml9d