22 free EC-Council 312-85 CTIA v2 practice questions from the CertStash pack of 88, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 22 free here, all 88 in the pack, and each step includes the one before it.
Get all 88 questions (US$39) · Download the first 10 as a PDF
Question 1
Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.
Daniel comes under which of the following types of threat actor?
Show answer and explanation
Correct answer: D. Organized hackers
Daniel is driven purely by profit: he steals social security numbers, employee PII and credit card data, then sells it on the black market. Organized hackers are profit-motivated criminals who steal money and data and trade the stolen information for financial gain, often operating as structured groups that rent or sell attack infrastructure. The scenario gives no sign of a government sponsor, a specific competitor being targeted for business secrets, or any trusted internal access, so the financial black-market motive places Daniel among organized hackers.
Why the other options are wrong
- A. Industrial spies steal trade secrets and intellectual property from competitors for corporate advantage, not personal and card data for black-market resale.
- B. State-sponsored hackers work for a government to pursue national or geopolitical objectives, not to sell stolen card data for personal profit.
- C. An insider threat abuses legitimate access granted by the organization, and Daniel is an outside professional hacker with no such access.
Question 2
An attacker instructs bots to use camouflage mechanism to hide his phishing and malware delivery locations in the rapidly changing network of compromised bots. In this particular technique, a single domain name consists of multiple IP addresses.
Which of the following techniques is used by the attacker?
Show answer and explanation
Correct answer: D. Fast-Flux DNS
Fast-flux DNS lets a single domain name resolve to many IP addresses belonging to compromised bots, with the DNS records rotated rapidly using short time-to-live values. Each lookup can return a different set of infected hosts, which act as proxies in front of the real phishing or malware delivery servers. This camouflage hides the true hosting location, frustrates IP-based blocking and makes takedown difficult. The stem describes exactly this: bots hiding delivery locations inside a rapidly changing network, with one domain mapped to multiple IP addresses.
Why the other options are wrong
- A. A DNS zone transfer replicates a zone's records from a primary to a secondary name server and does not hide malicious hosts behind rotating bots.
- B. Dynamic DNS updates a hostname to follow a changing IP address of a host, rather than rotating one domain across many bot IP addresses at once.
- C. DNS interrogation is querying name servers to gather information about a target, not a technique for concealing malware delivery infrastructure.
Question 3
Kathy wants to ensure that she shares threat intelligence containing sensitive information with the appropriate audience. Hence, she used traffic light protocol (TLP).
Which TLP color would signify that information should be shared only within a particular community?
Show answer and explanation
Correct answer: C. Green
Under the Traffic Light Protocol maintained by FIRST, TLP:GREEN means limited disclosure: recipients may share the information with peers and partner organizations within their community, but not through publicly accessible channels. That matches Kathy's goal of restricting the intelligence to a particular community. TLP:RED limits information to the individual recipients only, TLP:AMBER limits it to the recipient's own organization and its clients on a need-to-know basis, and TLP:WHITE, renamed TLP:CLEAR in TLP 2.0, places no restriction on disclosure.
Why the other options are wrong
- A. TLP:RED restricts information to the named individual recipients, so it cannot be passed on even within their own organization, let alone a community.
- B. TLP:WHITE (TLP:CLEAR in TLP 2.0) carries no disclosure restriction, so it does not limit sharing to a particular community.
- D. TLP:AMBER restricts sharing to the recipient's own organization and its clients on a need-to-know basis, not to a wider community.
Question 4
Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google search operators. He wants to identify whether any fake websites are hosted at URLs similar to the organization’s URL.
Which of the following Google search queries should Moses use?
Show answer and explanation
Correct answer: A. related: www.infothech.org
In Google's advanced search syntax, related: is the operator for finding websites Google considers similar to a specified URL. Querying related: www.infothech.org is how Moses would look for lookalike or similar sites that could be fake copies of the organization's website used for phishing or brand abuse. This kind of advanced search operator use, often called Google hacking or Google dorking, is a standard OSINT collection technique in threat intelligence work. The other operators each concern the one URL given, not other sites resembling it.
Why the other options are wrong
- B. The info: operator is for retrieving information about the one specified page, not a list of other websites that resemble it.
- C. The link: operator is for finding pages that link to the specified URL, not websites that are similar to it.
- D. The cache: operator is for viewing Google's stored copy of the specified page, which reveals nothing about other lookalike sites.
Question 5
A team of threat intelligence analysts is performing threat analysis on malware, and each of them has come up with their own theory and evidence to support their theory on a given malware.
Now, to identify the most consistent theory out of all the theories, which of the following analytic processes must threat intelligence manager use?
Show answer and explanation
Correct answer: C. Analysis of competing hypotheses (ACH)
Analysis of competing hypotheses (ACH), developed by Richards Heuer, is a structured analytic technique for choosing among several explanations of the same events. The analyst lists every hypothesis, builds a matrix of the available evidence against each one, and works to refute hypotheses rather than confirm them, so the surviving theory is the one most consistent with the evidence. When several analysts each defend their own theory about a piece of malware, ACH gives the manager an objective way to weigh all of them and reduce confirmation bias.
Why the other options are wrong
- A. Threat modelling identifies assets, threats and vulnerabilities in a system to plan defenses, and it does not weigh rival theories against evidence.
- B. Application decomposition and analysis is a threat modelling step that breaks an application into components and data flows, not a method for comparing hypotheses.
- D. Automated technical analysis processes artifacts with tools to extract technical details, and it provides no structured way to compare competing theories.
Question 6
Miley, an analyst, wants to reduce the amount of collected data and make the storing and sharing process easy. She uses filtering, tagging, and queuing techniques to sort out the relevant and structured data from the large amounts of unstructured data.
Which of the following techniques was employed by Miley?
Show answer and explanation
Correct answer: B. Normalization
Normalization in threat intelligence processing converts large volumes of collected data into a consistent, structured form. Techniques such as filtering out irrelevant records, tagging data with attributes and queuing it for further processing separate the relevant, structured data from unstructured noise. The result is a smaller data set that is easier to store, search and share across tools and partners. Miley's goals of reducing the collected data and simplifying storage and sharing, together with her use of filtering, tagging and queuing, describe normalization.
Why the other options are wrong
- A. Sandboxing runs suspicious files in an isolated environment to observe their behavior, which does not filter or structure collected data.
- C. Data visualization presents analyzed data as charts and graphs, and it does not reduce or restructure the raw data being stored.
- D. Convenience sampling selects a subset of data that is easiest to reach, rather than filtering, tagging and queuing the whole collection.
Question 7
Bob, a threat analyst, works in an organization named TechTop. He was asked to collect intelligence to fulfil the needs and requirements of the Red Team present within the organization.
Which of the following are the needs of a Red Team?
Show answer and explanation
Correct answer: B. Intelligence on latest vulnerabilities, threat actors, and their tactics, techniques, and procedures (TTPs)
A red team emulates real adversaries to test how well the organization's defenses hold up. To make those exercises realistic, it needs intelligence on the latest vulnerabilities it can attempt to exploit, the threat actors likely to target the organization, and those actors' tactics, techniques and procedures (TTPs). With this information the red team can mirror the behavior of genuine attackers rather than generic attacks. The option naming latest vulnerabilities, threat actors and their TTPs covers all three of these needs.
Why the other options are wrong
- A. Intelligence on rising attacks against a particular software or operating system vulnerability helps defenders prioritize patching, not adversary emulation.
- C. Intelligence extracted from attacks on similar organizations is a narrower, incident-based view, whereas the red team needs the broader intelligence on current vulnerabilities, threat actors and their TTPs to emulate likely adversaries.
- D. Intelligence on risks tied to strategic business decisions is strategic intelligence for executives and management, not red team operators.
Question 8
Michael, a threat analyst who works in an organization named TechTop, was asked to conduct a cyber-threat intelligence analysis. After obtaining information regarding threats, he has started analyzing the information and understanding the nature of the threats.
What stage of the cyber-threat intelligence is Michael currently in?
Show answer and explanation
Correct answer: C. Known unknowns
An organization's awareness of threats moves through stages: unknown unknowns, known unknowns and known knowns. In the known unknowns stage, the organization has obtained information about threats and is aware of them, but still has to analyze that information to understand their nature. Michael has already gathered threat information and is now analyzing it to understand what the threats are, which places him in the known unknowns stage. Only after that analysis is complete does the threat become a known known.
Why the other options are wrong
- A. Unknown unknowns describes threats the organization has no information about and is not yet aware of, while Michael already holds threat information.
- B. Unknowns unknown is not a recognized stage, so it cannot describe where Michael is in his analysis.
- D. Known knowns is reached only after analysis, when the threat and its nature are fully understood, so Michael has not arrived there yet.
Question 9
Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS server logs the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering techniques has Enrique used for data collection?
Show answer and explanation
Correct answer: A. Data collection through passive DNS monitoring
Passive DNS monitoring captures DNS data as it flows through the infrastructure instead of sending new queries. A recursive DNS server that handles inter-server DNS communication logs the responses it receives from authoritative name servers, the logged data is replicated, and it is stored in a central database. Analysts can then search this historical record of domain-to-IP resolutions to uncover malicious activity over DNS, such as domains tied to malware or command and control. Enrique's collection process matches this description exactly.
Why the other options are wrong
- B. DNS interrogation actively queries name servers for records about a target, rather than logging responses received by a recursive server into a central database.
- C. A DNS zone transfer copies an entire zone file from a primary name server, and it does not involve logging recursive server responses over time.
- D. Dynamic DNS automatically updates the records for a host whose IP address changes, which is not a collection technique for analyzing DNS abuse.
Question 10
John, a professional hacker, is trying to perform APT attack on the target organization network. He gains access to a single system of a target organization and tries to obtain administrative login credentials to gain further access to the systems in the network using various techniques.
What phase of the advanced persistent threat lifecycle is John currently in?
Show answer and explanation
Correct answer: C. Expansion
The APT lifecycle runs through preparation, initial intrusion, expansion, persistence, search and exfiltration, and cleanup. In the expansion phase, the attacker who already controls one system works to widen access across the network, chiefly by obtaining administrative credentials and moving laterally to other machines. John has a foothold on a single system and is now trying to harvest admin logins to reach further systems, which is exactly the expansion phase. Persistence and data theft come later, once that broader access is in place.
Why the other options are wrong
- A. Initial intrusion is gaining the first foothold in the network, which John has already completed before seeking administrative credentials.
- B. Search and exfiltration is the later phase of locating and stealing target data, and John is still working to widen his access.
- D. Persistence follows expansion and focuses on keeping long-term access through backdoors and similar mechanisms, not on harvesting credentials to reach more systems.
What people say about the full 312-85 pack 5.0 from 1
I passed my ECCouncil 312-85 exam yesterday with a score of 94%. I used the exam guide by certstash and it cleared all my problems regarding the exam. Thank you certstash.
Question 11
An analyst wants to disseminate the information effectively so that the consumers can acquire and benefit from the intelligence.
Which of the following criteria must an analyst consider in order to make the intelligence concise, to the point, accurate, and easily understandable and must consist of a right balance between tables, narrative, numbers, graphics, and multimedia?
Show answer and explanation
Correct answer: B. The right presentation
Effective dissemination requires delivering intelligence with the right presentation. This criterion means the intelligence is concise, to the point, accurate and easily understood by its consumers, and that it uses a suitable balance of tables, narrative, numbers, graphics and multimedia. Good presentation lets each consumer absorb the intelligence quickly and act on it, rather than struggling with dense or poorly organized material. The stem describes exactly these qualities of format and clarity, so the analyst must consider the right presentation.
Why the other options are wrong
- A. The right time concerns delivering intelligence while it is still useful for decisions, not how it is formatted.
- C. The right order concerns how findings are sequenced and prioritized, not the balance of tables, narrative, graphics and multimedia.
- D. The right content concerns whether the intelligence is relevant to the consumer's requirements, not how it is laid out and presented.
Question 12
Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular login patterns from locations where the organization does not have business relations. This indicates that somebody is trying to steal confidential information.
Which of the following key indicators of compromise does this scenario present?
Show answer and explanation
Correct answer: D. Geographical anomalies
Geographical anomalies are an indicator of compromise in which account activity originates from locations that make no sense for the user or the business. Classic signs are multiple logins to the same account from different locations within a short time span, which is physically impossible for one person, and logins from countries where the organization has no business relations. Steve observed both patterns, which suggests stolen credentials being used by an attacker trying to reach confidential information.
Why the other options are wrong
- A. Unusual outbound network traffic concerns abnormal volumes or destinations of data leaving the network, while Steve observed login locations.
- B. Unexpected patching of systems refers to patches applied without authorization, which has nothing to do with login locations.
- C. Unusual privileged account activity concerns abnormal actions by administrative accounts, and the scenario describes where logins come from, not elevated privileges.
Question 13
Sam works as an analyst in an organization named InfoTech Security. He was asked to collect information from various threat intelligence sources. In meeting the deadline, he forgot to verify the threat intelligence sources and used data from an open-source data provider, who offered it at a very low cost. Though it was beneficial at the initial stage, relying on such data providers can produce unreliable data and noise putting the organization network at risk.
What mistake did Sam make that led to this situation?
Show answer and explanation
Correct answer: A. Sam used unreliable intelligence sources.
Using unreliable intelligence sources is one of the common mistakes organizations make when building threat intelligence capability. Some open-source data providers offer feeds at very low cost, and while they may look beneficial at first, relying on them without verification can introduce unreliable data and noise that put the organization's network at risk. Sam skipped verifying the sources to meet a deadline and took data from a cheap open-source provider, which led directly to unreliable data and noise. His mistake was using unreliable intelligence sources.
Why the other options are wrong
- B. Using data without context means failing to relate data to the organization's environment, whereas the problem here is the untrustworthy provider.
- C. Failing to use standard formats affects how threat data is represented and exchanged, not whether the provider's data is reliable.
- D. Lacking proper technology to consume information is a tooling problem, but Sam's failure was choosing an unverified, low-cost data provider.
Question 14
Which of the following components refers to a node in the network that routes the traffic from a workstation to external command and control server and helps in identification of installed malware in the network?
Show answer and explanation
Correct answer: B. Gateway
A gateway is the network node that routes traffic from internal workstations to external networks. Because traffic from an infected workstation to an external command and control (C2) server must pass through the gateway, its logs and traffic records show which internal hosts are communicating with suspicious external destinations. Analysts can use this to identify workstations with installed malware. None of the other devices routes traffic between the internal network and the outside world.
Why the other options are wrong
- A. A repeater only regenerates and retransmits a signal to extend cable reach, and it does not route traffic to external networks.
- C. A hub forwards incoming frames out of all its ports within a local segment, and it does not route traffic to external C2 servers.
- D. A network interface card connects a single host to the network and does not route traffic between the internal network and outside servers.
Question 15
In which of the following storage architectures is the data stored in a localized system, server, or storage hardware and capable of storing a limited amount of data in its database and locally available for data usage?
Show answer and explanation
Correct answer: C. Centralized storage
Centralized storage keeps data in a single localized system, server or storage hardware. Because everything resides in one location, the database can hold only a limited amount of data, and that data is locally available to users and applications that need it. This makes centralized storage simple to manage and control, but it limits capacity and creates a single point of failure. The stem describes localized hardware, limited capacity and local availability, which are the characteristics of centralized storage.
Why the other options are wrong
- A. Distributed storage spreads data across multiple systems and locations instead of keeping it in one localized server.
- B. Object-based storage organizes data as objects with metadata and unique identifiers, which describes how data is organized and addressed rather than localized, limited-capacity storage.
- D. Cloud storage keeps data on remote infrastructure run by a provider, offering scalable capacity rather than a local, limited store.
Question 16
Walter and Sons Company has faced major cyber attacks and lost confidential data. The company has decided to concentrate more on the security rather than other resources. Therefore, they hired Alice, a threat analyst, to perform data analysis. Alice was asked to perform qualitative data analysis to extract useful information from collected bulk data.
Which of the following techniques will help Alice to perform qualitative data analysis?
Show answer and explanation
Correct answer: C. Brainstorming, interviewing, SWOT analysis, Delphi technique, and so on
Qualitative data analysis works with non-numerical information such as opinions, expert judgment, observations and descriptions, and aims to understand meaning and context rather than measure quantities. Techniques used for it include brainstorming, interviewing, SWOT analysis and the Delphi technique, all of which draw on human insight and structured discussion to interpret what the collected data means. Quantitative analysis, by contrast, relies on numbers and statistics. Because Alice was asked specifically for qualitative analysis of the bulk data, brainstorming, interviewing, SWOT analysis and the Delphi technique are the appropriate methods.
Why the other options are wrong
- A. Regression and variance analysis are statistical techniques used for quantitative data analysis.
- B. Numerical calculations, statistical modeling and measurement describe quantitative analysis, not qualitative analysis.
- D. Finding links between data describes a general analytic goal such as link analysis, not the set of qualitative techniques asked for.
Question 17
What is the correct sequence of steps involved in scheduling a threat intelligence program?
1. Review the project charter
2. Identify all deliverables
3. Identify the sequence of activities
4. Identify task dependencies
5. Develop the final schedule
6. Estimate duration of each activity
7. Identify and estimate resources for all activities
8. Define all activities
9. Build a work breakdown structure (WBS)
Show answer and explanation
Correct answer: A. 1-->9-->2-->8-->3-->7-->4-->6-->5
Scheduling a threat intelligence program follows standard project scheduling practice. The analyst first reviews the project charter (1) to confirm scope and objectives, then builds a work breakdown structure (9) and identifies all deliverables (2). Next comes defining all activities (8), identifying their sequence (3), identifying and estimating the resources each activity needs (7), and identifying task dependencies (4). Durations are then estimated for each activity (6), and only after all of these inputs exist is the final schedule developed (5). Each step depends on the output of the step before it, which gives the order 1, 9, 2, 8, 3, 7, 4, 6, 5.
Why the other options are wrong
- B. This order sequences activities and develops the schedule before the charter is reviewed or any activities are defined.
- C. This order develops the final schedule before the work breakdown structure is built and before activities, resources and durations are defined.
- D. This order produces the final schedule at step 5 and leaves the work breakdown structure and activity definition until the very end.
Question 18
Karry, a threat analyst at an XYZ organization, is performing threat intelligence analysis. During the data collection phase, he used a data collection method that involves no participants and is purely based on analysis and observation of activities and processes going on within the local boundaries of the organization.
Identify the type of data collection method used by Karry.
Show answer and explanation
Correct answer: B. Passive data collection
Passive data collection gathers information without involving any participants. It relies purely on observing and analyzing the activities and processes taking place within the local boundaries of the organization, such as monitoring traffic and system activity, rather than interacting with people or external targets. Because nothing is sent to or requested from a subject, the collection does not alert or influence what is being observed. Karry's method involved no participants and was based only on observation of internal activities, so it is passive data collection.
Why the other options are wrong
- A. Active data collection involves direct interaction with participants or targets, such as interviews, surveys or querying systems, which Karry avoided.
- C. Exploited data collection does not describe gathering data purely by observing internal activities and processes without participants; that describes passive collection.
- D. Raw data collection describes the unprocessed state of the data gathered, not a method defined by observation without participants.
Question 19
During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary’s information, such as Modus operandi, tools, communication channels, and forensics evasion strategies used by adversaries.
Identify the type of threat intelligence analysis performed by John.
Show answer and explanation
Correct answer: D. Tactical threat intelligence analysis
Tactical threat intelligence analysis focuses on the tactics, techniques and procedures (TTPs) of adversaries. It extracts information about how attackers operate, including their modus operandi, the tools they use, their communication channels and the strategies they follow to evade forensic investigation. This intelligence is consumed by security professionals who use it to tune defenses and protect organizational resources against the methods attackers employ. John has extracted exactly these attacker methods and tools, so he is performing tactical threat intelligence analysis.
Why the other options are wrong
- A. Operational threat intelligence analysis concerns specific impending attacks against the organization, such as the identity, intent and timing of a threat actor, rather than general attacker TTPs.
- B. Technical threat intelligence analysis deals with specific indicators of compromise such as IP addresses, domains and file hashes, not modus operandi or evasion strategies.
- C. Strategic threat intelligence analysis produces high-level information on risks, trends and financial impact for executives, not details of attacker tools and channels.
Question 20
Alison, an analyst in an XYZ organization, wants to retrieve information about a company’s website from the time of its inception as well as the removed information from the target website.
What should Alison do to get the information he needs?
Show answer and explanation
Correct answer: B. Alison should use https://archive.org to extract the required website information.
The Internet Archive at https://archive.org runs the Wayback Machine, which stores snapshots of websites captured over many years. An analyst can enter a domain and browse archived versions of its pages from the earliest capture onward, including content that has since been changed or removed from the live site. Alison needs information from the website's inception as well as information that has been deleted, and archive.org is the resource that keeps this historical record.
Why the other options are wrong
- A. SmartWhois looks up domain and IP registration details, not past versions of a website's content.
- C. Web Data Extractor harvests data such as email addresses, URLs and metadata from pages that are currently online, so it cannot retrieve removed content.
- D. Google's search cache held only a recent copy of a page, not its history back to the site's inception.
Question 21
Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to protect their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack.
Which of the following online sources should Alice use to gather such information?
Show answer and explanation
Correct answer: C. Hacking forums
Hacking forums are online communities where attackers discuss and share their methods. Monitoring them gives analysts information about how attacks are launched, the techniques and tools used to carry them out and the procedures followed to cover tracks afterward. This makes them a valuable source for spotting emerging threats early and preparing defenses against them. Alice needs exactly this information about attack methods, tools and track-covering procedures, so she should gather it from hacking forums.
Why the other options are wrong
- A. Financial services sources reveal information about an organization's finances and transactions, not attack methods or tools.
- B. Social network settings relate to privacy configuration on social media and do not describe attack techniques or track-covering procedures.
- D. Job sites reveal details about an organization's staff, roles and technologies in use, not how attacks are performed.
Question 22
In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?
Show answer and explanation
Correct answer: D. Unstructured form
Bulk data collection is described in two forms: structured and unstructured. In the unstructured form, large amounts of data are first gathered from multiple sources in many different formats, and only afterward is the collection processed into a usable state to achieve threat intelligence. In the structured form, by contrast, the data is collected in a uniform, predefined format so it is ready for analysis from the start. The stem describes collecting first from varied sources and formats and processing later, which is the unstructured form.
Why the other options are wrong
- A. In the structured form, data is collected in a uniform, predefined format rather than in multiple formats that need later processing.
- B. A hybrid form is not one of the bulk data collection forms, which are structured and unstructured.
- C. A production form is not one of the bulk data collection forms, which are structured and unstructured.
That was 22 of 88.
The full EC-Council 312-85 CTIA v2 pack has all 88 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 43 free as one PDF by email. Get the Half Pack →