ECCouncil 312-85 Dumps Questions Answers

The "known unknowns" stage in cyber-threat intelligence refers to the phase where an analyst has identified threats but the specific details, implications, or full nature of these threats are not yet fully understood. Michael, in this scenario, has obtained information on threats and is in the process of analyzing this information to understand the nature of the threats better. This stage involves analyzing the known data to uncover additional insights and fill in the gaps in understanding, thereby transitioning the "unknowns" into "knowns." This phase is critical in threat intelligence as it helps in developing actionable intelligence by deepening the understanding of the threats faced.

Normalization in the context of data analysis refers to the process of organizing data to reduce redundancy and improve efficiency in storing and sharing. By filtering, tagging, and queuing, Miley is effectively normalizing the data—converting it from various unstructured formats into a structured, more accessible format. This makes the data easier to analyze, store, and share. Normalization is crucial in cybersecurity and threat intelligence to manage the vast amounts of data collected and ensure that only relevant data is retained and analyzed. This technique contrasts with sandboxing, which is used for isolating and analyzing suspicious code; data visualization, which involves representing data graphically; and convenience sampling, which is a method of sampling where samples are taken from a group that is conveniently accessible.

The question specifies that the vulnerabilities are application threats.

SQL injection and buffer overflow are both classic examples of application-layer attacks that target flaws in code and software design.

SQL Injection: Exploits improper input validation in database queries, allowing attackers to execute malicious SQL statements.

Buffer Overflow: Occurs when a program writes more data into a buffer than it can handle, leading to memory corruption and potential remote code execution.

Why the Other Options Are Incorrect:

B. Man-in-the-middle and physical security attack: MITM is a network attack, and physical attacks are not application-based.

C. DNS and ARP poisoning: These are network-level attacks, not application-level.

D. Footprinting and spoofing: Both are reconnaissance or identity-deception techniques, not application-layer threats.

Conclusion:

Bob identified application threats, namely SQL Injection and Buffer Overflow attacks.

Final Answer: A. SQL injection and buffer overflow attack

Explanation Reference (Based on CTIA Study Concepts):

CTIA categorizes SQL injection and buffer overflow as application-level vulnerabilities exploited through improper input handling and insecure coding.