312-85 Dumps With Exact Questions and Answers

The attack described, where multiple connection requests from different geo-locations are received by a server within a short time span leading to stress and reduced performance, is indicative of a Distributed Denial-of-Service (DDoS) attack. In a DDoS attack, the attacker floods the target's resources (such as a server) with excessive requests from multiple sources, making it difficult for the server to handle legitimate traffic, leading to degradation or outright unavailability of service. The use of multiple geo-locations for the attack sources is a common characteristic of DDoS attacks, making them harder to mitigate.

The Blueliv Threat Exchange Network is a collaborative platform designed for sharing and receiving threat intelligence among security professionals and organizations. It provides real-time information on global threats, helping participants to enhance their security posture by leveraging shared intelligence. The platform facilitates the exchange of information related to cybersecurity threats, including indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs) of threat actors, and other relevant data. This makes it an ideal choice for Kim, who is looking to gather and share threat information to develop security policies for his organization. In contrast, Cuckoo Sandbox is a malware analysis system, OmniPeek is a network analyzer, and PortDroid is a network analysis application, none of which are primarily designed for intelligence sharing.

The focus of John’s testing is understanding the motives, methods, and identity of potential attackers. This type of approach aligns with Intelligence-Led Security Testing.

Intelligence-Led Security Testing uses real-world threat intelligence to simulate realistic cyberattack scenarios. It provides insight into adversary behavior, motivations, and techniques, helping organizations assess their resilience against targeted threats.

Such testing answers the why, how, and who questions of potential attacks and is used to validate security controls based on threat actor profiles and campaigns.

Why the Other Options Are Incorrect:

A. White box testing: The tester has full knowledge of systems and configurations; it focuses on internal vulnerabilities, not adversary motives.

C. Black box testing: The tester has no prior knowledge of the system; it focuses on external attacks, not on intelligence-driven insights about attackers.

Conclusion:

John is performing Intelligence-Led Security Testing, which combines threat intelligence with security assessment to evaluate real-world risks.

Final Answer: B. Intelligence-led security testing

Explanation Reference (Based on CTIA Study Concepts):

In CTIA, intelligence-led testing integrates threat intelligence with penetration testing to replicate realistic adversary scenarios.