312-85 Exam Dumps Pass with Updated 2021 Certified Exam Questions
312-85 Exam Questions - Real & Updated Questions PDF
ECCouncil 312-85 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
| Topic 11 |
|
| Topic 12 |
|
| Topic 13 |
|
NEW QUESTION 16
Tyrion, a professional hacker, is targeting an organization to steal confidential information. He wants to perform website footprinting to obtain the following information, which is hidden in the web page header.
Connection status and content type
Accept-ranges and last-modified information
X-powered-by information
Web server in use and its version
Which of the following tools should the Tyrion use to view header content?
- A. Vanguard enforcer
- B. AutoShun
- C. Hydra
- D. Burp suite
Answer: D
NEW QUESTION 17
Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular log in patterns from locations where the organization does not have business relations. This resembles that somebody is trying to steal confidential information.
Which of the following key indicators of compromise does this scenario present?
- A. Unusual activity through privileged user account
- B. Unusual outbound network traffic
- C. Geographical anomalies
- D. Unexpected patching of systems
Answer: A
NEW QUESTION 18
Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.
What stage of ACH is Bob currently in?
- A. Inconsistency
- B. Diagnostics
- C. Refinement
- D. Evidence
Answer: B
NEW QUESTION 19
Joe works as a threat intelligence analyst with Xsecurity Inc. He is assessing the TI program by comparing the project results with the original objectives by reviewing project charter. He is also reviewing the list of expected deliverables to ensure that each of those is delivered to an acceptable level of quality.
Identify the activity that Joe is performing to assess a TI program's success or failure.
- A. Conducting a gap analysis
- B. Identifying areas of further improvement
- C. Determining the fulfillment of stakeholders
- D. Determining the costs and benefits associated with the program
Answer: A
NEW QUESTION 20
Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive dat a. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?
- A. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
- B. Jim should identify the attack at an initial stage by checking the content of the user agent field.
- C. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
- D. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
Answer: A
NEW QUESTION 21
What is the correct sequence of steps involved in scheduling a threat intelligence program?
1. Review the project charter
2. Identify all deliverables
3. Identify the sequence of activities
4. Identify task dependencies
5. Develop the final schedule
6. Estimate duration of each activity
7. Identify and estimate resources for all activities
8. Define all activities
9. Build a work breakdown structure (WBS)
- A. 1-->9-->2-->8-->3-->7-->4-->6-->5
- B. 1-->2-->3-->4-->5-->6-->9-->8-->7
- C. 1-->2-->3-->4-->5-->6-->7-->8-->9
- D. 3-->4-->5-->2-->1-->9-->8-->7-->6
Answer: A
NEW QUESTION 22
A team of threat intelligence analysts is performing threat analysis on malware, and each of them has come up with their own theory and evidence to support their theory on a given malware.
Now, to identify the most consistent theory out of all the theories, which of the following analytic processes must threat intelligence manager use?
- A. Automated technical analysis
- B. Threat modelling
- C. Application decomposition and analysis (ADA)
- D. Analysis of competing hypotheses (ACH)
Answer: D
NEW QUESTION 23
A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?
- A. Bandwidth attack
- B. MAC spoofing attack
- C. DHCP attacks
- D. Distributed Denial-of-Service (DDoS) attack
Answer: D
NEW QUESTION 24
Jame, a professional hacker, is trying to hack the confidential information of a target organization. He identified the vulnerabilities in the target system and created a tailored deliverable malicious payload using an exploit and a backdoor to send it to the victim.
Which of the following phases of cyber kill chain methodology is Jame executing?
- A. Reconnaissance
- B. Weaponization
- C. Installation
- D. Exploitation
Answer: B
NEW QUESTION 25
A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?
- A. Advisories
- B. Strategic reports
- C. Low-level data
- D. Detection indicators
Answer: D
NEW QUESTION 26
Which of the following characteristics of APT refers to numerous attempts done by the attacker to gain entry to the target's network?
- A. Risk tolerance
- B. Attack origination points
- C. Timeliness
- D. Multiphased
Answer: B
NEW QUESTION 27
An XYZ organization hired Mr. Andrews, a threat analyst. In order to identify the threats and mitigate the effect of such threats, Mr. Andrews was asked to perform threat modeling. During the process of threat modeling, he collected important information about the treat actor and characterized the analytic behavior of the adversary that includes technological details, goals, and motives that can be useful in building a strong countermeasure.
What stage of the threat modeling is Mr. Andrews currently in?
- A. Threat determination and identification
- B. Threat profiling and attribution
- C. Threat ranking
- D. System modeling
Answer: B
NEW QUESTION 28
Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google search operators. He wants to identify whether any fake websites are hosted at the similar to the organization's URL.
Which of the following Google search queries should Moses use?
- A. link: www.infothech.org
- B. related: www.infothech.org
- C. cache: www.infothech.org
- D. info: www.infothech.org
Answer: B
NEW QUESTION 29
An organization suffered many major attacks and lost critical information, such as employee records, and financial information. Therefore, the management decides to hire a threat analyst to extract the strategic threat intelligence that provides high-level information regarding current cyber-security posture, threats, details on the financial impact of various cyber-activities, and so on.
Which of the following sources will help the analyst to collect the required intelligence?
- A. Human, social media, chat rooms
- B. OSINT, CTI vendors, ISAO/ISACs
- C. Active campaigns, attacks on other organizations, data feeds from external third parties
- D. Campaign reports, malware, incident reports, attack group reports, human intelligence
Answer: B
NEW QUESTION 30
Andrews and Sons Corp. has decided to share threat information among sharing partners. Garry, a threat analyst, working in Andrews and Sons Corp., has asked to follow a trust model necessary to establish trust between sharing partners. In the trust model used by him, the first organization makes use of a body of evidence in a second organization, and the level of trust between two organizations depends on the degree and quality of evidence provided by the first organization.
Which of the following types of trust model is used by Garry to establish the trust?
- A. Direct historical trust
- B. Mediated trust
- C. Validated trust
- D. Mandated trust
Answer: C
NEW QUESTION 31
......
Pass Guaranteed Quiz 2021 Realistic Verified Free ECCouncil: https://www.exam4labs.com/312-85-practice-torrent.html
Free Certified Threat Intelligence Analyst 312-85 Ultimate Study Guide: https://drive.google.com/open?id=1H7NCa6J2EQSy1ly04BmuSj6S6MJMD3NU