EC-Council 312-85 CTIA v2 Exam Practice Questions
US$39
Every question with the correct answer and why the other options are wrong.
Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.
I passed my ECCouncil 312-85 exam yesterday with a score of 94%. I used the exam guide by certstash and it cleared all my problems regarding the exam. Thank you certstash.
Three of the 88 questions in this pack
Question 1
Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.
Daniel comes under which of the following types of threat actor?
Show answer and explanation
Correct answer: D. Organized hackers
Daniel is driven purely by profit: he steals social security numbers, employee PII and credit card data, then sells it on the black market. Organized hackers are profit-motivated criminals who steal money and data and trade the stolen information for financial gain, often operating as structured groups that rent or sell attack infrastructure. The scenario gives no sign of a government sponsor, a specific competitor being targeted for business secrets, or any trusted internal access, so the financial black-market motive places Daniel among organized hackers.
Why the other options are wrong
- A. Industrial spies steal trade secrets and intellectual property from competitors for corporate advantage, not personal and card data for black-market resale.
- B. State-sponsored hackers work for a government to pursue national or geopolitical objectives, not to sell stolen card data for personal profit.
- C. An insider threat abuses legitimate access granted by the organization, and Daniel is an outside professional hacker with no such access.
Question 2
An attacker instructs bots to use camouflage mechanism to hide his phishing and malware delivery locations in the rapidly changing network of compromised bots. In this particular technique, a single domain name consists of multiple IP addresses.
Which of the following techniques is used by the attacker?
Show answer and explanation
Correct answer: D. Fast-Flux DNS
Fast-flux DNS lets a single domain name resolve to many IP addresses belonging to compromised bots, with the DNS records rotated rapidly using short time-to-live values. Each lookup can return a different set of infected hosts, which act as proxies in front of the real phishing or malware delivery servers. This camouflage hides the true hosting location, frustrates IP-based blocking and makes takedown difficult. The stem describes exactly this: bots hiding delivery locations inside a rapidly changing network, with one domain mapped to multiple IP addresses.
Why the other options are wrong
- A. A DNS zone transfer replicates a zone's records from a primary to a secondary name server and does not hide malicious hosts behind rotating bots.
- B. Dynamic DNS updates a hostname to follow a changing IP address of a host, rather than rotating one domain across many bot IP addresses at once.
- C. DNS interrogation is querying name servers to gather information about a target, not a technique for concealing malware delivery infrastructure.
Question 3
Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP).
Which TLP color would signify that information should be shared only within a particular community?
Show answer and explanation
Correct answer: C. Green
Under the Traffic Light Protocol maintained by FIRST, TLP:GREEN means limited disclosure: recipients may share the information with peers and partner organizations within their community, but not through publicly accessible channels. That matches Kathy's goal of restricting the intelligence to a particular community. TLP:RED limits information to the individual recipients only, TLP:AMBER limits it to the recipient's own organization and its clients on a need-to-know basis, and TLP:WHITE, renamed TLP:CLEAR in TLP 2.0, places no restriction on disclosure.
Why the other options are wrong
- A. TLP:RED restricts information to the named individual recipients, so it cannot be passed on even within their own organization, let alone a community.
- B. TLP:WHITE (TLP:CLEAR in TLP 2.0) carries no disclosure restriction, so it does not limit sharing to a particular community.
- D. TLP:AMBER restricts sharing to the recipient's own organization and its clients on a need-to-know basis, not to a wider community.
1 review for EC-Council 312-85 CTIA v2 Exam Practice Questions
Only logged in customers who have purchased this product may leave a review.
How much of the EC-Council 312-85 CTIA v2 bank is free?
88 questions in the bankEach step includes the one before, so buying only adds new questions.
- You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
- 2225% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
- 43the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
- 88100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
What’s in the EC-Council 312-85 CTIA v2 pack
- 88 questions mapped to the CTIA v2 exam blueprint
- Answers and explanations for every question, including the wrong options
- A questions-only PDF for timed practice runs
- Instant delivery by email the moment you check out
- Free monthly updates for as long as the exam is live
- Pass or your money back
A 312-85 attempt costs US$450. This pack is US$39, paid once.
What makes the CTIA hard
CTIA is a short exam, 50 questions in two hours, which means every question carries two percent of the score and there is no room to write off a domain.
The v2 version follows the intelligence lifecycle from requirements through collection, processing, analysis, dissemination and feedback, and the questions are scenario driven: a SOC receives a report, a CISO wants a risk summary, a team has to choose between feeds, and the task is to pick the analyst action, framework or source that fits.
Data Collection and Processing is the heaviest domain at 24%: OSINT, HUMINT, SIGINT and technical sources, threat feeds, dark web and cloud collection, and structuring data with STIX and TAXII. The remaining topics cover threat intelligence fundamentals, cyber threats and attack frameworks including the kill chain and MITRE ATT&CK, requirements and planning, data analysis, reporting and dissemination, threat hunting, and threat intelligence applied to SOC operations and incident response. EC-Council sets the passing score per exam form between 60% and 85%.
About the exam
312-85 (Certified Threat Intelligence Analyst v2) earns the EC-Council CTIA certification. It covers threat intelligence fundamentals, cyber threats and attack frameworks, intelligence requirements and planning, data collection and processing, data analysis, reporting and dissemination, threat hunting and detection, and threat intelligence in SOC, incident response and risk management. There are no prerequisites with official training; self-study candidates need two years of information security experience and an eligibility application.
Exam topics
- Introduction to threat intelligence
- Cyber threats and attack frameworks
- Requirements, planning, direction and review
- Data collection and processing: 24%
- Data analysis
- Intelligence reporting and dissemination
- Threat hunting and detection
- Threat intelligence in SOC operations, incident response and risk management
50 multiple choice questions, 120 minutes, passing score 70%, US$450 per attempt, ECC Exam Center, Pearson VUE or remote proctoring, certification valid for three years with EC-Council continuing education.
Questions before you buy
How quickly do I receive it?
Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.
Are updates included?
Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.
What if I fail the exam?
We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.
What is your pass rate?
99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.
Can I share it with colleagues?
Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.
Related products
-
EC-Council 312-40 CCSE v2
147 questionsUpdated Nov 20264.5 (2) US$39 -
EC-Council 312-50v13 CEH v13
1,049 questionsUpdated Nov 20264.8 (24) US$39 -
EC-Council 712-50 CCISO
606 questionsUpdated Nov 20265.0 (1) US$39 -
EC-Council ICS/SCADA Cybersecurity
75 questionsUpdated Nov 2026 US$39
Mortimer –
I passed my ECCouncil 312-85 exam yesterday with a score of 94%. I used the exam guide by certstash and it cleared all my problems regarding the exam. Thank you certstash.