Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary's information, such as Modus operandi, tools, communication channels, and forensics evasion strategies used by adversaries.
Identify the type of threat intelligence analysis is performed by John.
Tactical threat intelligence analysis focuses on the immediate, technical indicators of threats, such as the tactics, techniques, and procedures (TTPs) used by adversaries, their communication channels, the tools and software they utilize, and their strategies for evading forensic analysis. This type of analysis is crucial for operational defenses and is used by security teams to adjust their defenses against current threats. Since John successfully extracted information related to the adversaries' modus operandi, tools, communication channels, and evasion strategies, he is performing tactical threat intelligence analysis. This differs from strategic and operational threat intelligence, which focus on broader trends and specific operations, respectively, and from technical threat intelligence, which deals with technical indicators like malware signatures and IPs. Reference:
'Tactical Cyber Intelligence,' by Cyber Threat Intelligence Network, Inc.
'Intelligence-Driven Incident Response: Outwitting the Adversary,' by Scott J. Roberts and Rebekah Brown
SecurityTech Inc. is developing a TI plan where it can drive more advantages in less funds. In the process of selecting a TI platform, it wants to incorporate a feature that ranks elements such as intelligence sources, threat actors, attacks, and digital assets of the organization, so that it can put in more funds toward the resources which are critical for the organization's security.
Which of the following key features should SecurityTech Inc. consider in their TI plan for selecting the TI platform?
Incorporating a scoring feature in a Threat Intelligence (TI) platform allows SecurityTech Inc. to evaluate and prioritize intelligence sources, threat actors, specific types of attacks, and the organization's digital assets based on their relevance and threat level to the organization. This prioritization helps in allocating resources more effectively, focusing on protecting critical assets and countering the most significant threats. A scoring system can be based on various criteria such as the severity of threats, the value of assets, the reliability of intelligence sources, and the potential impact of threat actors or attack vectors. By quantifying these elements, SecurityTech Inc. can make informed decisions on where to invest its limited funds to enhance its security posture most effectively. Reference:
'Designing and Building a Cyber Threat Intelligence Capability' by the SANS Institute
'Threat Intelligence: What It Is, and How to Use It Effectively' by Gartner
Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google search operators. He wants to identify whether any fake websites are hosted at the similar to the organization's URL.
Which of the following Google search queries should Moses use?
The 'related:' Google search operator is used to find websites that are similar or related to a specified URL. In the context provided, Moses wants to identify fake websites that may be posing as or are similar to his organization's official site. By using the 'related:' operator followed by his organization's URL, Google will return a list of websites that Google considers to be similar to the specified site. This can help Moses identify potential impersonating websites that could be used for phishing or other malicious activities. The 'info:', 'link:', and 'cache:' operators serve different purposes; 'info:' provides information about the specified webpage, 'link:' used to be used to find pages linking to a specific URL (but is now deprecated), and 'cache:' shows the cached version of the specified webpage. Reference:
Google Search Operators Guide by Moz
Google Advanced Search Help Documentation
Sam works as an analyst in an organization named InfoTech Security. He was asked to collect information from various threat intelligence sources. In meeting the deadline, he forgot to verify the threat intelligence sources and used data from an open-source data provider, who offered it at a very low cost. Through it was beneficial at the initial stage but relying on such data providers can produce unreliable data and noise putting the organization network into risk.
What mistake Sam did that led to this situation?
Sam's mistake was using threat intelligence from sources that he did not verify for reliability. Relying on intelligence from unverified or unreliable sources can lead to the incorporation of inaccurate, outdated, or irrelevant information into the organization's threat intelligence program. This can result in 'noise,' which refers to irrelevant or false information that can distract from real threats, and potentially put the organization's network at risk. Verifying the credibility and reliability of intelligence sources is crucial to ensure that the data used for making security decisions is accurate and actionable. Reference:
'Best Practices for Threat Intelligence Sharing,' by FIRST (Forum of Incident Response and Security Teams)
'Evaluating Cyber Threat Intelligence Sources,' by Jon DiMaggio, SANS Institute InfoSec Reading Room
Tim is working as an analyst in an ABC organization. His organization had been facing many challenges in converting the raw threat intelligence data into meaningful contextual information. After inspection, he found that it was due to noise obtained from misrepresentation of data from huge data collections. Hence, it is important to clean the data before performing data analysis using techniques such as data reduction. He needs to choose an appropriate threat intelligence framework that automatically performs data collection, filtering, and analysis for his organization.
Which of the following threat intelligence frameworks should he choose to perform such task?
Threat Grid is a threat intelligence and analysis platform that offers advanced capabilities for automatic data collection, filtering, and analysis. It is designed to help organizations convert raw threat data into meaningful, actionable intelligence. By employing advanced analytics and machine learning, Threat Grid can reduce noise from large data sets, helping to eliminate misrepresentations and enhance the quality of the threat intelligence. This makes it an ideal choice for Tim, who is looking to address the challenges of converting raw data into contextual information and managing the noise from massive data collections. Reference:
'Cisco Threat Grid: Unify Your Threat Defense,' Cisco
'Integrating and Automating Threat Intelligence,' by Threat Grid
Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.
Daniel comes under which of the following types of threat actor.
Daniel's activities align with those typically associated with organized hackers. Organized hackers or cybercriminals work in groups with the primary goal of financial gain through illegal activities such as stealing and selling data. These groups often target large amounts of data, including personal and financial information, which they can monetize by selling on the black market or dark web. Unlike industrial spies who focus on corporate espionage or state-sponsored hackers who are backed by nation-states for political or military objectives, organized hackers are motivated by profit. Insider threats, on the other hand, come from within the organization and might not always be motivated by financial gain. The actions described in the scenario---targeting personal and financial information for sale---best fit the modus operandi of organized cybercriminal groups. Reference:
ENISA (European Union Agency for Cybersecurity) Threat Landscape Report
Verizon Data Breach Investigations Report
Exam domains verified against: Official Eccouncil 312-85 exam guide, last checked September 2026.
Foundational concepts covering what intelligence is and how cyber threat intelligence fits into organizational security strategy. Learn the threat intelligence lifecycle from collection through dissemination and the frameworks that guide intelligence programs.
Understand different categories of cyber threats from nation-state actors to criminal groups, and how attacks unfold through the cyber kill chain. Recognise indicators of compromise and advanced persistent threat tactics.
Assess your organization's threat landscape and translate that into intelligence requirements. Plan a threat intelligence programme, build the team, establish management buy-in, and set up intelligence sharing relationships to enable ongoing programme review.
Sample question from this domain above: Q2
Know the full range of collection sources from open source to classified networks. Manage collection operations to avoid gaps or redundancy. Process raw data into usable intelligence through acquisition and exploitation techniques.
Apply structured analysis techniques to spot patterns and validate judgements. Conduct threat analysis, evaluate the quality of your conclusions, and use tools to automate routine analysis. Document findings in runbooks and knowledge bases.
Sample question from this domain above: Q5
Format intelligence findings for specific audiences and communicate through appropriate channels. Participate in threat intelligence sharing networks and platforms while understanding the legal and regulatory landscape that governs intelligence sharing.
Common questions about the exam itself
