Certified Threat Intelligence Analyst

Here you have the best ECCouncil 312-85 practice exam questions

  • You have 66 total questions to study from
  • Each page has 5 questions, making a total of 14 pages
  • You can navigate through the pages using the buttons at the bottom
  • This questions were last updated on November 1, 2025
  • This site is not affiliated with or endorsed by ECCouncil.
Question 1 of 66
Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.
Daniel comes under which of the following types of threat actor.
    Correct Answer: D

    Daniel is motivated by profit and conducts hacking activities to steal sensitive data and money, which he then sells on the black market. This fits the description of organized hackers, who often work in groups, are highly skilled, and engage in illegal activities for financial gain.

Question 2 of 66
An attacker instructs bots to use camouflage mechanism to hide his phishing and malware delivery locations in the rapidly changing network of compromised bots. In this particular technique, a single domain name consists of multiple IP addresses.
Which of the following technique is used by the attacker?
    Correct Answer: D

    Fast-Flux DNS is a technique used by attackers where a single domain name is associated with multiple IP addresses that change rapidly. This method helps attackers to hide phishing and malware delivery locations in a network of compromised bots, making it difficult to trace and shut down the malicious servers.

Question 3 of 66
Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP).
Which TLP color would you signify that information should be shared only within a particular community?
    Correct Answer: C

    The Traffic Light Protocol (TLP) is a set of designations used to ensure that sensitive information is shared with the appropriate audience. The TLP color 'Green' signifies that information can be shared within a defined community. This means that the information can be shared freely within a particular community but not beyond it. Therefore, the correct TLP color for ensuring that sensitive information is shared only within a particular community is 'Green'.

Question 4 of 66
Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google search operators. He wants to identify whether any fake websites are hosted at the similar to the organization’s URL.
Which of the following Google search queries should Moses use?
    Correct Answer: A

    To identify whether any fake websites are hosted that are similar to the organization’s URL, the correct Google search query to use is 'related: www.infothech.org'. The 'related' operator is used to find websites related to a specified URL, which can help in identifying potential phishing or fake websites that mimic the organization’s URL.

Question 5 of 66
A team of threat intelligence analysts is performing threat analysis on malware, and each of them has come up with their own theory and evidence to support their theory on a given malware.
Now, to identify the most consistent theory out of all the theories, which of the following analytic processes must threat intelligence manager use?
    Correct Answer: C

    The correct process to identify the most consistent theory out of multiple theories proposed by analysts is the Analysis of Competing Hypotheses (ACH). ACH is a structured analytic technique that involves comparing multiple hypotheses against available evidence to determine which hypothesis is most consistent with the evidence. This method helps in systematically evaluating each hypothesis, thereby identifying the most accurate conclusion.