SANS 515 Exam fully solved &
updated 2026 Questions and Answers
Supply Chain BackDoor - Correct answer-Combines 1st Stage Delivery and
Exploitation phases
Stuxnet: Host Observables - Correct answer-DLL Injection: Lsass.exe,
winlogon.exe, svchost.exe
Registry Key Modification: new registry: mrxnet, 19790509
Multiple Files Dropped: oem7a.pnf, mdmeric3.pnf, mrxnet.sys, mrxcls.sy
Infected Project File: S7tgtopx.exe
USB Jumping: USB Loader~WTR4141.tmp, Delete after 3 jumps
Sliding Scale of Cyber Security - Correct answer-Architecture, Passive Defense,
Active Defense, Intelligence, Offense
Active Defense Influences - Correct answer-Mao Zedong: On Guerrilla Warfare
General Depuy: The Army's FM 100-5
©COPYRIGHT 2025, ALL RIGHTS RESERVED 1
,Guiding Principles of Mao
1. No provocation of the enemy
2. No military bases on foreign soil
3. No seizure of enemy land
Active Cyber Defense Cycle - Correct answer-Threat Intelligence Consumption ->
Visibility -> Threat Detection -> Incident Response -> Threat & Environment
Manipulation
WinCC - Correct answer-Siemens WinCC SCADA Monitoring was used to sync -
easily detectable on the network
What is intelligence? - Correct answer-Both a Product and a Process: Analyzed
information about a competitive entity that fulfills a requirement
Intelligence Life Cycle - Correct answer-1. Planning and Direction
2. Collection
3. Process and Exploitation
4. Analysis and Production
5. Dissemination and Integration
©COPYRIGHT 2025, ALL RIGHTS RESERVED 2
, 6. Evaluation and Feedback
Field of View Bias - Correct answer-Operational Environment (location of
collection) and Intelligence Requirements yield a "field of view".
What is a threat? - Correct answer-Threat can be established by evaluating
Capability + Intent + Opportunity.
1. Hostile Intent + Capability = impending
2. Capability + Opportunity = potential
3. Hostile Intent + Opportunity = insubstantial
Intended Audience - Correct answer-The intended audience and their goals
determine the type of threat intelligence
1. Strategic
2. Operational
3. Tactical
The ACH Process - Correct answer-1. Hypothesis: Identify all potential hypotheses
2. Evidence: List all evidence and arguments
3. Diagnostics: Use a matrix to apply evidence to the hypotheses
©COPYRIGHT 2025, ALL RIGHTS RESERVED 3
updated 2026 Questions and Answers
Supply Chain BackDoor - Correct answer-Combines 1st Stage Delivery and
Exploitation phases
Stuxnet: Host Observables - Correct answer-DLL Injection: Lsass.exe,
winlogon.exe, svchost.exe
Registry Key Modification: new registry: mrxnet, 19790509
Multiple Files Dropped: oem7a.pnf, mdmeric3.pnf, mrxnet.sys, mrxcls.sy
Infected Project File: S7tgtopx.exe
USB Jumping: USB Loader~WTR4141.tmp, Delete after 3 jumps
Sliding Scale of Cyber Security - Correct answer-Architecture, Passive Defense,
Active Defense, Intelligence, Offense
Active Defense Influences - Correct answer-Mao Zedong: On Guerrilla Warfare
General Depuy: The Army's FM 100-5
©COPYRIGHT 2025, ALL RIGHTS RESERVED 1
,Guiding Principles of Mao
1. No provocation of the enemy
2. No military bases on foreign soil
3. No seizure of enemy land
Active Cyber Defense Cycle - Correct answer-Threat Intelligence Consumption ->
Visibility -> Threat Detection -> Incident Response -> Threat & Environment
Manipulation
WinCC - Correct answer-Siemens WinCC SCADA Monitoring was used to sync -
easily detectable on the network
What is intelligence? - Correct answer-Both a Product and a Process: Analyzed
information about a competitive entity that fulfills a requirement
Intelligence Life Cycle - Correct answer-1. Planning and Direction
2. Collection
3. Process and Exploitation
4. Analysis and Production
5. Dissemination and Integration
©COPYRIGHT 2025, ALL RIGHTS RESERVED 2
, 6. Evaluation and Feedback
Field of View Bias - Correct answer-Operational Environment (location of
collection) and Intelligence Requirements yield a "field of view".
What is a threat? - Correct answer-Threat can be established by evaluating
Capability + Intent + Opportunity.
1. Hostile Intent + Capability = impending
2. Capability + Opportunity = potential
3. Hostile Intent + Opportunity = insubstantial
Intended Audience - Correct answer-The intended audience and their goals
determine the type of threat intelligence
1. Strategic
2. Operational
3. Tactical
The ACH Process - Correct answer-1. Hypothesis: Identify all potential hypotheses
2. Evidence: List all evidence and arguments
3. Diagnostics: Use a matrix to apply evidence to the hypotheses
©COPYRIGHT 2025, ALL RIGHTS RESERVED 3
