Important Eccouncil 312-85 Exam Questions

CertPrep • Eccouncil • 312-85 Exam Questions

Select Certification Providers

Select Certification Exam

Get Full Version

Eccouncil Certified Threat Intelligence Analyst 312-85 Exam

Attempt the Certified Threat Intelligence Analyst practice test and solve real exam-like 312-85 questions to prepare efficiently and increase your chances of success. Our Eccouncil 312-85 practice questions match the actual Certified Threat Intelligence Analyst exam format, helping you enhance confidence and improve performance. With our 312-85 practice exam software, you can analyze your performance, identify weak areas, and work on them effectively to boost your final Certified Threat Intelligence Analyst exam score.

Vendor:	Eccouncil
Exam Name:	Certified Threat Intelligence Analyst
Registration Code:	312-85
Related Certification:	Eccouncil Certified Threat Intelligence Analyst Certification
Exam Audience:	Threat Analysts and Managers,

Total Questions

Last Updated

29-08-2026

Upgrade to Premium

GET FULL PDF

Question: 1

John, a professional hacker, is trying to perform APT attack on the target organization network. He gains access to a single system of a target organization and tries to obtain administrative login credentials to gain further access to the systems in the network using various techniques.

What phase of the advanced persistent threat lifecycle is John currently in?

AInitial intrusion

BSearch and exfiltration

CExpansion

DPersistence

Answer: C

Explanation:

The phase described where John, after gaining initial access, is attempting to obtain administrative credentials to further access systems within the network, is known as the 'Expansion' phase of an Advanced Persistent Threat (APT) lifecycle. This phase involves the attacker expanding their foothold within the target's environment, often by escalating privileges, compromising additional systems, and moving laterally through the network. The goal is to increase control over the network and maintain persistence for ongoing access. This phase follows the initial intrusion and sets the stage for establishing long-term presence and eventual data exfiltration or other malicious objectives. Reference:

MITRE ATT&CK Framework, specifically the tactics related to Credential Access and Lateral Movement

'APT Lifecycle: Detecting the Undetected,' a whitepaper by CyberArk

Question: 2

Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to prevent their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack.

Which of the following online sources should Alice use to gather such information?

AFinancial services

BSocial network settings

CHacking forums

DJob sites

Answer: C

Explanation:

Alice, looking to gather information on emerging threats including attack methods, tools, and post-attack techniques, should turn to hacking forums. These online platforms are frequented by cybercriminals and security researchers alike, where information on the latest exploits, malware, and hacking techniques is shared and discussed. Hacking forums can provide real-time insights into the tactics, techniques, and procedures (TTPs) used by threat actors, offering a valuable resource for threat intelligence analysts aiming to enhance their organization's defenses. Reference:

'Hacking Forums: A Ground for Cyber Threat Intelligence,' by Digital Shadows

'The Value of Hacking Forums for Threat Intelligence,' by Flashpoint

Question: 3

Henry. a threat intelligence analyst at ABC Inc., is working on a threat intelligence program. He was assigned to work on establishing criteria for prioritization of intelligence needs and requirements.

Which of the following considerations must be employed by Henry to prioritize intelligence requirements?

AUnderstand frequency and impact of a threat

BUnderstand data reliability

CDevelop a collection plan

DProduce actionable data

Answer: A

Explanation:

When prioritizing intelligence requirements, it is crucial to understand the frequency and impact of various threats. This approach helps in allocating resources effectively, focusing on threats that are both likely to occur and that would have significant consequences if they did. By assessing threats based on these criteria, Henry can ensure that the threat intelligence program addresses the most pressing and potentially damaging threats first, thereby enhancing the organization's security posture. This prioritization is essential for effective threat management and for ensuring that the most critical threats are addressed promptly. Reference:

'Cyber Threat Intelligence: Prioritizing and Using CTI Effectively,' by SANS Institute

'Threat Intelligence: What It Is, and How to Use It Effectively,' by Gartner

Question: 4

Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?

ANation-state attribution

BTrue attribution

CCampaign attribution

DIntrusion-set attribution

Answer: B

Explanation:

True attribution in the context of cyber threats involves identifying the actual individual, group, or nation-state behind an attack or intrusion. This type of attribution goes beyond associating an attack with certain tactics, techniques, and procedures (TTPs) or a known group and aims to pinpoint the real-world entity responsible. True attribution is challenging due to the anonymity of the internet and the use of obfuscation techniques by attackers, but it is crucial for understanding the motive behind an attack and for forming appropriate responses at diplomatic, law enforcement, or cybersecurity levels. Reference:

'Attribution of Cyber Attacks: A Framework for an Evidence-Based Analysis' by Jason Healey

'The Challenges of Attribution in Cyberspace' in the Journal of Cyber Policy

Question: 5

Jian is a member of the security team at Trinity, Inc. He was conducting a real-time assessment of system activities in order to acquire threat intelligence feeds. He acquired feeds from sources like honeynets, P2P monitoring. infrastructure, and application logs.

Which of the following categories of threat intelligence feed was acquired by Jian?

AInternal intelligence feeds

BExternal intelligence feeds

CCSV data feeds

DProactive surveillance feeds

Answer: A

Explanation:

Internal intelligence feeds are derived from data and information collected within an organization's own networks and systems. Jian's activities, such as real-time assessment of system activities and acquiring feeds from honeynets, P2P monitoring, infrastructure, and application logs, fall under the collection of internal intelligence feeds. These feeds are crucial for identifying potential threats and vulnerabilities within the organization and form a fundamental part of a comprehensive threat intelligence program. They contrast with external intelligence feeds, which are sourced from outside the organization and include information on broader cyber threats, trends, and TTPs of threat actors. Reference:

'Building an Intelligence-Led Security Program' by Allan Liska

'Threat Intelligence: Collecting, Analysing, Evaluating' by M-K. Lee, L. Healey, and P. A. Porras

SAVE TIME & QUICKLY PREPARE WITH REAL QUESTIONS

GET FULL ACCESS

Other Eccouncil Certification Exams

312-41 Exam

Certified AI Program Manager

112-57 Exam

EC-Council Digital Forensics Essentials

712-50 Exam

EC-Council Certified CISO

212-89 Exam

EC-Council Certified Incident Handler v3

312-39 Exam

Certified SOC Analyst v2

312-49v11 Exam

Computer Hacking Forensic Investigator (CHFIv11)