Enhance your career with 312-85 PDF Dumps - True ECCouncil Exam Questions
New (2023) Download free 312-85 PDF for ECCouncil Practice Tests
NEW QUESTION 10
Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?
- A. Data collection through DNS zone transfer
- B. Data collection through DNS interrogation
- C. Data collection through dynamic DNS (DDNS)
- D. Data collection through passive DNS monitoring
Answer: B
NEW QUESTION 11
In which of the following storage architecture is the data stored in a localized system, server, or storage hardware and capable of storing a limited amount of data in its database and locally available for data usage?
- A. Object-based storage
- B. Distributed storage
- C. Centralized storage
- D. Cloud storage
Answer: C
NEW QUESTION 12
SecurityTech Inc. is developing a TI plan where it can drive more advantages in less funds. In the process of selecting a TI platform, it wants to incorporate a feature that ranks elements such as intelligence sources, threat actors, attacks, and digital assets of the organization, so that it can put in more funds toward the resources which are critical for the organization's security.
Which of the following key features should SecurityTech Inc. consider in their TI plan for selecting the TI platform?
- A. Workflow
- B. Scoring
- C. Search
- D. Open
Answer: B
NEW QUESTION 13
An attacker instructs bots to use camouflage mechanism to hide his phishing and malware delivery locations in the rapidly changing network of compromised bots. In this particular technique, a single domain name consists of multiple IP addresses.
Which of the following technique is used by the attacker?
- A. Dynamic DNS
- B. DNS interrogation
- C. Fast-Flux DNS
- D. DNS zone transfer
Answer: C
NEW QUESTION 14
A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?
- A. Strategic reports
- B. Detection indicators
- C. Low-level data
- D. Advisories
Answer: C
NEW QUESTION 15
During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary's information, such as Modus operandi, tools, communication channels, and forensics evasion strategies used by adversaries.
Identify the type of threat intelligence analysis is performed by John.
- A. Technical threat intelligence analysis
- B. Strategic threat intelligence analysis
- C. Tactical threat intelligence analysis
- D. Operational threat intelligence analysis
Answer: C
NEW QUESTION 16
Henry. a threat intelligence analyst at ABC Inc., is working on a threat intelligence program. He was assigned to work on establishing criteria for prioritization of intelligence needs and requirements.
Which of the following considerations must be employed by Henry to prioritize intelligence requirements?
- A. Understand data reliability
- B. Produce actionable data
- C. Develop a collection plan
- D. Understand frequency and impact of a threat
Answer: D
NEW QUESTION 17
Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.
Daniel comes under which of the following types of threat actor.
- A. Industrial spies
- B. Insider threat
- C. Organized hackers
- D. State-sponsored hackers
Answer: C
NEW QUESTION 18
Alice, an analyst, shared information with security operation managers and network operations center (NOC) staff for protecting the organizational resources against various threats. Information shared by Alice was highly technical and include threat actor TTPs, malware campaigns, tools used by threat actors, and so on.
Which of the following types of threat intelligence was shared by Alice?
- A. Strategic threat intelligence
- B. Operational threat intelligence
- C. Tactical threat intelligence
- D. Technical threat intelligence
Answer: D
NEW QUESTION 19
ABC is a well-established cyber-security company in the United States. The organization implemented the automation of tasks such as data enrichment and indicator aggregation. They also joined various communities to increase their knowledge about the emerging threats. However, the security teams can only detect and prevent identified threats in a reactive approach.
Based on threat intelligence maturity model, identify the level of ABC to know the stage at which the organization stands with its security and vulnerabilities.
- A. Level 0: vague where to start
- B. Level 3: CTI program in place
- C. Level 2: increasing CTI capabilities
- D. Level 1: preparing for CTI
Answer: C
NEW QUESTION 20
Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?
- A. Intrusion-set attribution
- B. Campaign attribution
- C. Nation-state attribution
- D. True attribution
Answer: D
NEW QUESTION 21
A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?
- A. DHCP attacks
- B. Bandwidth attack
- C. MAC spoofing attack
- D. Distributed Denial-of-Service (DDoS) attack
Answer: D
NEW QUESTION 22
A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?
- A. Low-level data
- B. Strategic reports
- C. Detection indicators
- D. Advisories
Answer: C
NEW QUESTION 23
In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?
- A. Structured form
- B. Unstructured form
- C. Production form
- D. Hybrid form
Answer: B
NEW QUESTION 24
Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP).
Which TLP color would you signify that information should be shared only within a particular community?
- A. Green
- B. Red
- C. Amber
- D. White
Answer: A
NEW QUESTION 25
Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular log in patterns from locations where the organization does not have business relations. This resembles that somebody is trying to steal confidential information.
Which of the following key indicators of compromise does this scenario present?
- A. Unusual activity through privileged user account
- B. Unusual outbound network traffic
- C. Unexpected patching of systems
- D. Geographical anomalies
Answer: A
NEW QUESTION 26
Jian is a member of the security team at Trinity, Inc. He was conducting a real-time assessment of system activities in order to acquire threat intelligence feeds. He acquired feeds from sources like honeynets, P2P monitoring. infrastructure, and application logs.
Which of the following categories of threat intelligence feed was acquired by Jian?
- A. CSV data feeds
- B. Internal intelligence feeds
- C. Proactive surveillance feeds
- D. External intelligence feeds
Answer: B
NEW QUESTION 27
Miley, an analyst, wants to reduce the amount of collected data and make the storing and sharing process easy. She uses filtering, tagging, and queuing technique to sort out the relevant and structured data from the large amounts of unstructured data.
Which of the following techniques was employed by Miley?
- A. Convenience sampling
- B. Normalization
- C. Sandboxing
- D. Data visualization
Answer: B
NEW QUESTION 28
......
100% Free 312-85 Files For passing the exam Quickly: https://actualtests.latestcram.com/312-85-exam-cram-questions.html
