312-39 Exam Questions and Answers

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Threat Intelligence dashboard

Access Anomalies dashboard

User Activity Monitoring

Incident Review dashboard

The Incident Review dashboard surfaces correlated notables and displays their associated MITRE ATT&CK annotations, letting you confirm the technique mapped to the failed-login-then-success pattern. It satisfies the stem's requirement to verify ATT&CK mapping directly within Splunk Enterprise Security, rather than pivoting to separate analytic or intelligence views.

Why: The Incident Review dashboard in Splunk Enterprise Security is the primary triage workspace where notable events are displayed alongside their associated threat intelligence, risk scores, and MITRE ATT&CK annotations. When investigating a brute-force-then-successful-login pattern, analysts use Incident Review to see the full context of the notable event, including which ATT&CK technique (e.g., T1110 Brute Force, T1078 Valid Accounts) the correlation search mapped it to. This dashboard is purpose-built for first-responder verification and incident workflow.

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Update the Work notes with an @mention to the manager

Mentioning the security manager in the Work notes triggers ServiceNow's native notification engine, which routes an email or in-platform alert directly to that user's account. This satisfies the escalation requirement without altering assignment, state, or priority fields, keeping the ticket's audit trail intact while ensuring the manager is notified.

Delete the ticket and create a new one

Manually email the manager with incident details

Change the State to 'Closed'

Why: In ServiceNow Security Incident Response (SIR), the standard way to notify a specific person such as the security manager while escalating a ticket is to add an @mention in the Work notes (or Additional comments). ServiceNow automatically sends a notification to the mentioned user, creating an auditable record on the ticket. This keeps communication within the incident record rather than in external channels.

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Assign it to another team to verify

Set status to 'Closed' with resolution code 'False Positive'

Setting status to 'Closed' with resolution code 'False Positive' satisfies the triage requirement to document the alert's disposition accurately. The resolution code preserves the reason for closure, enabling trend analysis and tuning of detection rules, while the closed status removes the alert from the active queue so analysts focus on genuine incidents.

Ignore the ticket and let it expire

Delete the incident

Why: The correct action is to set the ticket status to 'Closed' with a resolution code of 'False Positive'. This documents that the alert was investigated, determined to be benign, and properly resolved, preserving an audit trail and enabling future tuning. Closing with a specific resolution code also feeds metrics for false positive rates and supports continuous improvement of detection rules.

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Host Timeline

Detection Details

Process Tree

Falcon's Process Tree view reconstructs the full ancestry of a detection, showing each parent-child relationship from the initiating executable down to the suspicious file. This exposes the parent process needed to judge whether the detection is malicious.

Network Activity

Why: In CrowdStrike Falcon, the Process Tree view visualizes the parent-child relationships of processes on an endpoint, letting the analyst trace the lineage of a suspicious file back to its originating parent process. This is the correct view for understanding how a detection was spawned and identifying the root process that launched it.

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

Allow all, then log

Enable Intrusion Prevention System (IPS) in 'Alert' mode

Enable SSL Inspection

Deny egress to the specific destination IP

Blocking outbound traffic to the identified C2 address severs the callback channel at the network layer, immediately halting beaconing without disrupting other legitimate egress traffic, which satisfies the containment requirement for this specific external destination.

Why: Denying egress to the specific destination IP is the most effective immediate containment for an external C2 callback because it blocks the outbound channel the malware uses to communicate with its controller. This directly severs the command-and-control link with minimal collateral impact.

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

Volatility

Volatility parses raw memory images, reconstructing process lists, injected code regions and network artefacts that disk-only tools miss. It identifies code injected into legitimate processes, which is precisely what the suspicious PowerShell script's in-memory behaviour requires.

Nmap

Autopsy

Wireshark

Procmon

Why: Volatility is the standard open-source memory forensics framework used to analyze RAM dumps and identify artifacts such as injected code, running processes, and network connections. When a suspicious PowerShell script may have injected malicious code into a process, volatile memory analysis with Volatility can reveal hidden or injected modules that disk-based tools would miss. Nmap, Autopsy, Wireshark, and Procmon serve different purposes and cannot perform memory forensics.

Want more Incident Response practice?

All SOC For Cloud Environments questions

Domain 2: SOC For Cloud Environments

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Microsoft Defender for Servers

Microsoft Defender for Servers provides endpoint detection and response, capturing process-level execution telemetry on the VM, including command lines and parent processes. This satisfies the stem's requirement to see process execution details on the suspected cryptomining virtual machine.

Azure Advisor

Azure Network Watcher

Azure Resource Graph

Why: Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

VPC Flow Logs

EBS Snapshot logs

S3 Data Events

GuardDuty's S3 protection analyses CloudTrail management events by default, but detecting unusual object-level activity such as GetObject or PutObject requires S3 Data Events enabled on the target buckets. That data source supplies the object-level telemetry the scenario demands.

Route 53 Resolver query logs

Why: AWS GuardDuty uses S3 Data Events (CloudTrail S3 data events) as the data source to detect unusual S3 bucket access. When you enable S3 Protection in GuardDuty, it analyzes CloudTrail management and data events for S3, such as GetObject, PutObject, and DeleteObject, to identify suspicious activity like anomalous API calls or unusual user behavior. Without S3 Data Events enabled, GuardDuty cannot monitor object-level operations in S3 buckets.

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Cloud Trace

Security Command Center

Security Command Center's IAM findings continuously scan for service accounts granted excessive permissions, surfacing over-privileged identities through its built-in misconfiguration detectors. This directly satisfies the requirement to detect a service account created with excessive permissions in GCP, unlike audit logs or policy analysers that report activity rather than flagging the risky entitlement itself.

Deployment Manager

Cloud Billing

Why: Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

Azure Policy Compliance dashboard

Azure Monitor Metrics

Microsoft Entra ID Sign-in logs

Microsoft Entra ID Sign-in logs record each authentication attempt with geographic location, IP address, and device risk level, giving the investigation data needed. They are the portal location for reviewing suspicious VM sign-in patterns and assessing risk.

Azure Service Health

Why: Microsoft Entra ID (formerly Azure AD) Sign-in logs capture authentication events including the geographic location (via IP geolocation), device details, and risk level (when Identity Protection is enabled). This is the correct place to investigate suspicious VM or user sign-in patterns.

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Modify Security Group to deny all traffic

Replacing the instance's Security Group with one denying all inbound and outbound traffic severs network access while the EBS volume and instance state remain intact, satisfying the stem's requirement to isolate without deleting the volume.

Remove the IAM Role

Disable the VPC

Terminate the instance

Why: The standard cloud-native isolation technique for a compromised EC2 instance is to modify its Security Group to deny all inbound and outbound traffic (or attach a pre-built 'quarantine' SG). This preserves the instance's memory, EBS volumes, and forensic state while cutting off C2 channels and lateral movement. It is non-destructive and reversible, unlike termination or volume deletion.

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Azure Front Door

Azure Policy

Azure Policy evaluates resource properties against defined rules and enforces compliance by denying non-compliant deployments or remediating existing resources. It satisfies the stem's requirement for automatic enforcement preventing unauthorised configuration changes, unlike role-based access control, which governs permissions rather than resource settings.

Azure Bastion

Azure Key Vault

Why: Azure Policy is the governance service that lets you define, assign, and enforce rules (policy definitions) over Azure resources, ensuring they remain compliant with organizational standards and preventing unauthorized or non-compliant changes. It evaluates resource properties against policy rules and can deny non-compliant deployments, audit existing resources, or auto-remediate drift. This directly matches the requirement to automatically enforce security settings and prevent unauthorized changes.

Want more SOC For Cloud Environments practice?

All Cyber Threats Iocs And Attack Methodology questions

Domain 3: Cyber Threats Iocs And Attack Methodology

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Port-based blocking

Frequency analysis on connection flow metadata

Beaconing is defined by timing regularity, not payload content, so analysing connection flow metadata for consistent intervals and low jitter detects it regardless of encryption. This directly matches the 30-second interval with 5% jitter observed.

Signature-based IDS alert

Static IP blocklisting

Why: A beaconing pattern with a consistent 30-second interval and 5% jitter is best detected through frequency analysis on connection flow metadata, since the regularity of the timing is the defining characteristic. Analyzing flow records (NetFlow, Zeek conn.log) for periodic connections to the same destination reveals the beacon regardless of payload encryption. This approach detects the behavior rather than relying on known signatures or IPs.

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

An attempted DDoS attack

A network misconfiguration

A successful data exfiltration

A compromised host attempting to reach a C2

Outbound traffic to a sinkhole IP indicates malware beaconing to command-and-control infrastructure, since sinkholes are DNS or IP addresses that security teams redirect known C2 domains to. The compromised host satisfies the stem's constraint: it is attempting C2 communication, which the sinkhole intercepts and logs.

Why: A sinkhole IP is a controlled address that security teams or law enforcement redirect malicious traffic to, typically to neutralize botnet C2 communications. When an internal host repeatedly attempts to contact a known sinkhole IP, it strongly indicates the host is infected with malware that is trying to reach its command-and-control server. This is a classic indicator of compromise (IoC) for a C2 channel.

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Data exfiltration indicator

Unauthorized access attempt

The failed-then-successful login sequence from an unfamiliar IP is the defining signature of a brute-force or credential-stuffing attack achieving entry, which is precisely what an unauthorised access attempt IoC captures. It satisfies the stem's constraint of identifying the specific IoC category for this authentication pattern, rather than a broader indicator such as anomalous traffic.

Network anomaly signature

System resource exhaustion

Why: Multiple failed login attempts followed by a successful login from an unknown IP is a textbook indicator of unauthorized access — specifically a brute-force or password-spraying attack that eventually succeeded. This pattern is categorized as an unauthorized access attempt IoC because it shows an attacker gained access without authorization. The sequence of failures then success is the key signature.

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

malware.exe

mimikatz.exe

powershell.exe -enc JABz...

Encoded PowerShell commands (-enc) execute obfuscated, base64 payloads using a trusted, pre-installed Windows binary, so no malware is dropped. This native-tool abuse is the defining signature of Living off the Land, satisfying the stem's LotL indicator requirement.

netcat.exe

Why: Living off the Land (LotL) techniques use legitimate, pre-installed system tools to carry out attacks, avoiding the need to drop custom malware. 'powershell.exe -enc JABz...' is a classic LotL indicator: it uses the built-in PowerShell interpreter with a Base64-encoded command (-enc) to obfuscate malicious activity. This allows attackers to execute code without introducing foreign binaries.

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Isolate the host from the network

Isolating the host contains the likely malware before it can spread or communicate with command-and-control infrastructure. A legitimate svchost.exe never executes from a temp folder, indicating process masquerading. Network isolation preserves volatile evidence for later forensic analysis while preventing lateral movement, satisfying the stem's demand for the most immediate containment action.

Delete the file

Update antivirus signatures

Restart the server

Why: The presence of svchost.exe running from a temp folder is a classic indicator of a process masquerading attack, where malware names itself after a legitimate Windows process to evade detection. The most immediate action is to isolate the host from the network to prevent lateral movement, data exfiltration, or command-and-control communication. Containment must precede any remediation or investigation to avoid tipping off the attacker or allowing further damage.

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Deploying a remote access trojan

Exploiting a software vulnerability

Scanning for open ports and services

Reconnaissance is the kill chain's first phase, where adversaries gather information about the target. Scanning for open ports and services fits here, since it identifies exposed attack surface before weaponisation, delivery or exploitation occur. Other phases involve action, not discovery.

Encrypting data for ransom

Why: The Reconnaissance phase of the Cyber Kill Chain (Lockheed Martin's seven-phase model) is the first stage, where the adversary gathers information about the target before launching an attack. Scanning for open ports and services is a classic active reconnaissance technique (e.g., using nmap or masscan) that maps the attack surface and identifies exploitable services. This aligns with the phase's goal of intelligence gathering to inform later weaponization and delivery stages.

Want more Cyber Threats Iocs And Attack Methodology practice?

All Forensic Investigation And Malware Analysis questions

Domain 4: Forensic Investigation And Malware Analysis

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Malwarebytes Nebula

VirusTotal

VirusTotal aggregates results from over seventy antivirus engines and file-analysis tools, letting the analyst submit a hash and immediately see prior community detections without uploading the binary itself. This directly satisfies the requirement to check a file hash's reputation across dozens of engines, which no single-vendor sandbox or SIEM can match.

Nessus

Splunk ES

Why: VirusTotal is the industry-standard platform for checking a file hash (MD5, SHA-1, SHA-256) against dozens of antivirus engines, sandboxes, and threat intelligence sources simultaneously. Analysts paste the hash and instantly see detection ratios, behavioral reports, and community comments. It is the de facto first stop for file reputation during malware triage.

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Wireshark

Netcat

Nmap

INetSim

INetSim simulates common internet services, including DNS, on a local host. It answers the malware's DNS queries with the analysis machine's address, redirecting traffic there for observation. This satisfies the requirement to intercept resolution without touching real DNS infrastructure.

Why: INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Autoruns

TCPView

Process Explorer

Process Monitor

Process Monitor captures real-time file system, registry and process/thread activity in a single unified event stream, letting you filter by process name to see precisely which files and registry keys the persistent malware touches as it executes.

Why: Process Monitor (Procmon) is the Sysinternals tool that captures real-time file system, registry, and network activity, showing exactly which files and registry keys a process touches. It provides detailed event properties including process name, PID, operation, path, result, and detail. This makes it the correct choice for observing a persistent malware process's interactions.

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Procmon

Cuckoo Sandbox

PEview

PEview parses the Portable Executable structure, displaying the import table, embedded strings and section headers directly from disk. It performs no execution, satisfying the static-analysis constraint, unlike dynamic tools such as sandboxes or debuggers that require running the sample.

x64dbg

Why: PEview is a static analysis tool that parses the Portable Executable (PE) file format and displays its headers, import table, export table, sections, and embedded strings without running the binary. Since the analyst wants to inspect imports, strings, and headers without executing code, PEview is the correct choice. It reads the on-disk structure of the executable directly, making it safe for malware triage.

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Process Hacker

Wireshark

Detect It Easy (DIE)

Detect It Easy inspects PE headers, section entropy and packer signatures to flag likely packing or obfuscation. High entropy and unusual section names are the indicators it surfaces, directly answering whether the suspicious file is packed.

HashCalc

Why: Detect It Easy (DIE) is a packer/compiler detection tool that analyzes PE headers, section entropy, and signatures to identify whether a file is packed and with which packer. High entropy in sections like UPX0 or unusual section names are classic packing indicators.

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Calculate a cryptographic hash of both

Hashing both source and copy with the same algorithm (SHA-256) produces matching digests, proving bit-for-bit integrity and that no alteration occurred during acquisition. This satisfies the stem's requirement to verify evidence integrity immediately after copying, establishing the copy's admissibility as an exact duplicate.

Mount the image read-write

Run an antivirus scan

Rename the file

Why: Immediately after imaging the original media, the examiner must compute a cryptographic hash (e.g., SHA-256 or MD5) of both the original and the forensic copy and compare them. Matching hashes prove the copy is a bit-for-bit duplicate and that the original was not altered during acquisition, establishing the chain of custody and evidentiary integrity. This is the foundational step for admissibility in legal proceedings.

Want more Forensic Investigation And Malware Analysis practice?

All Incident Detection And Triage questions

Domain 5: Incident Detection And Triage

What is the purpose of normalizing logs in a SIEM?

To compress log size for storage efficiency.

To hide sensitive information.

To increase the ingestion speed.

To provide a common format for cross-vendor correlation.

Normalisation parses each vendor's proprietary log schema into a shared field structure, such as common timestamps, source IPs and event types. This lets the SIEM correlate events across heterogeneous sources, which raw vendor-specific formats cannot support directly.

Why: Normalizing logs in a SIEM means parsing and transforming raw log data from diverse sources (firewalls, IDS, OS, applications) into a consistent, standardized schema (e.g., Common Event Format (CEF), Log Event Extended Format (LEEF), or a custom taxonomy). This common format allows the SIEM to correlate events across different vendors and technologies—for example, linking a firewall deny log with an IDS alert and an authentication failure—by ensuring fields like source IP, destination IP, and event type have the same names and data types. Without normalization, cross-vendor correlation would be impossible because each source uses its own field names and structures.

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Unions only support structured data.

Joins allow matching records between two datasets based on a common field.

Joins correlate records across SecurityEvent and SigninLogs by matching a shared field, such as account or IP address, which is essential for linking authentication activity to endpoint events during lateral movement. A union merely stacks rows from both tables without relating them, so it cannot satisfy the requirement to correlate the two datasets.

Joins consume less memory than unions.

Unions cannot be used in detection rules.

Why: A join in KQL combines rows from two tables based on a matching key, such as correlating a SecurityEvent's Account field with SigninLogs' UserPrincipalName. This allows the rule to detect lateral movement by linking authentication events with sign-in activity on a common identifier. Union, by contrast, simply appends rows and does not match records.

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

Alert frequency.

Log source vendor.

Asset Criticality.

Asset criticality maps each alert to the business value of the affected system, so triage effort follows potential impact rather than raw severity or volume. It directly satisfies the stem's requirement to prioritise on business impact.

Number of alerts per user.

Why: Asset Criticality is the most important metric for prioritizing incidents by business impact because a compromise on a domain controller, database server, or executive workstation carries far greater risk than one on a test machine. SIEM triage workflows weight alerts by the criticality of the affected asset to focus analyst attention where it matters most. This aligns detection response with business risk.

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

The parser is disabled.

The user interface is loading slowly.

The aggregation window is configured incorrectly.

Correlation rules evaluate events within a defined aggregation window; if that window is too short or misaligned, matching events never co-occur in the same evaluation cycle, so the rule cannot fire even though the filter logic itself is correct.

The license has expired.

Why: In ArcSight correlation rules, the aggregation window defines the time period over which events are grouped and evaluated. If the window is misconfigured (too short, too long, or with incorrect reset conditions), the rule will not accumulate the required events to trigger, even if the filter logic is correct. This is the most common cause of a rule that matches events but never fires.

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

Check threat intelligence feeds to see if the IP is flagged as malicious.

A cloud-provider source IP is not inherently malicious, so reputation must be established before classifying. Querying threat intelligence feeds determines whether that address is flagged, supplying the evidence needed to decide if the brute force alert is genuine or benign.

Escalate to the ISP immediately.

Disable the rule for all cloud traffic.

Ignore the alert as cloud IPs are always false positives.

Why: Cloud provider IPs are commonly used by attackers (and also by legitimate scanners and services), so the correct triage step is to enrich the source IP with threat intelligence feeds to determine whether it is a known malicious actor. This contextual enrichment is a core SOC triage practice before deciding to escalate, close, or tune. It avoids both blind escalation and blind dismissal.

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Isolate the host immediately.

Verify if the connection was successful or blocked by the firewall.

Checking whether the firewall allowed or blocked the outbound connection establishes whether the threat is real or already contained, which determines the urgency and direction of the remaining triage. This verification precedes host isolation or escalation, since a blocked connection requires no containment action.

Reimage the affected workstation.

Contact the user's manager.

Why: Standard triage prioritizes verification before containment to avoid unnecessary disruption. Confirming whether the firewall blocked the connection determines if the host is actually compromised or if the alert is a false positive. Only after confirming a successful malicious connection should escalation to isolation occur.

Want more Incident Detection And Triage practice?

All Log Management questions

Domain 6: Log Management

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Archive all logs in a local text file format only

Retain logs for exactly 30 days

Keep logs for one year, with 3 months immediately available

PCI-DSS requires audit trail history retention of at least twelve months, with the most recent three months immediately available for analysis. Keeping logs for one year with three months online satisfies both the retention duration and the rapid-access constraint that auditors and incident responders demand.

Delete logs after they are indexed in the SIEM

Why: PCI-DSS requirement 10.7 mandates retaining audit logs for at least one year, with a minimum of three months immediately available for analysis. This ensures that logs are accessible for forensic investigations and compliance audits, while older logs can be archived but must be retrievable.

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

UDP

TCP

TCP provides connection-oriented, acknowledged delivery, so the collector retransmits lost segments until the aggregator confirms receipt. This satisfies the stem's requirement for delivery confirmation between collector and aggregator, unlike connectionless UDP, which offers no acknowledgement and silently drops logs under congestion.

ICMP

ARP

Why: TCP is the preferred protocol for centralized log transmission because it is connection-oriented and provides acknowledgements (ACKs) for every segment delivered, guaranteeing that logs arrive at the aggregator intact and in order. This delivery confirmation is essential for compliance and forensic integrity, where lost log entries can create dangerous blind spots. UDP offers no such guarantee, making it unsuitable when reliable delivery is a requirement.

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

Simple Queue Service (SQS)

Kinesis Firehose

CloudWatch Unified Agent

The CloudWatch Unified Agent collects metrics and logs in one package and can stream on-premises log files to CloudWatch Logs via its logs section. It satisfies the forwarding requirement, unlike the older CloudWatch Logs agent or SSM Agent.

AWS Config

Why: The CloudWatch Unified Agent (formerly the unified CloudWatch agent) is the AWS-supported agent that runs on on-premises servers and can collect and forward logs (and metrics) to CloudWatch Logs over the public AWS endpoints. It supports both the logs and metrics plugins in a single agent, making it the correct choice for streaming on-premises logs into CloudWatch. The other options are AWS services, not agents installed on a server.

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

Utilizing SNMPv1 traps

Implementing TLS-based log forwarding

TLS-based forwarding encrypts syslog or log payloads in transit using certificates, providing confidentiality and integrity between the remote web server and the SIEM. Plain TCP or UDP syslog sends cleartext, so TLS satisfies the requirement for the highest protection during transmission.

Encapsulating logs in cleartext UDP packets

Using standard port 514 without encryption

Why: TLS-based log forwarding encrypts log data in transit, ensuring confidentiality and integrity. It uses certificates for authentication and encryption, protecting against eavesdropping and tampering. This is the most secure method among the options.

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/

Template macros expand per-message at runtime, so $HOST resolves to each device's hostname and dynamically builds a separate directory path for every department's logs. This satisfies the stem's requirement to segregate files by hostname without defining a destination per device, unlike static paths or filters that cannot vary output location per sender.

Defining separate log paths for every individual IP address

Configuring the global log_level to debug

Using hardcoded static path strings only

Why: syslog-ng destination paths support template macros such as $HOST, $YEAR, $MONTH, $DAY, and $PROGRAM, which are expanded at runtime for each message. Using /var/log/$HOST/$YEAR/$MONTH/ dynamically creates per-host directories, satisfying the requirement to separate logs by hostname without manual configuration.

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

/var/log/messages

/etc/rsyslog.conf

/etc/sysctl.conf

/etc/logrotate.conf

/etc/logrotate.conf is logrotate's primary configuration file, holding global directives such as rotation frequency, retention count and compression. It satisfies the stem's requirement for defining retention and compression settings, and typically includes per-application stanzas from /etc/logrotate.d/, making it the correct location.

Why: The logrotate utility reads its global configuration from /etc/logrotate.conf, which defines default retention (rotate count), compression, frequency, and permissions, and also includes per-application drop-in files from /etc/logrotate.d/. This is the canonical file administrators edit to control retention and compression behavior system-wide.

Want more Log Management practice?

All Proactive Threat Detection questions

Domain 7: Proactive Threat Detection

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Failed login attempts to the local administrator account

Process access requests to lsass.exe from an unauthorized or unsigned process

LSASS holds credential material, so unauthorised or unsigned processes requesting access to lsass.exe memory is the strongest behavioural indicator of credential dumping tools such as Mimikatz. It targets the specific access pattern rather than generic process or file activity.

Increased CPU usage on the Domain Controller

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

Why: Credential dumping tools such as Mimikatz must open a handle to lsass.exe and read its memory, where Windows caches plaintext credentials, NTLM hashes, and Kerberos tickets. EDR solutions detect this by monitoring process-access API calls (e.g., OpenProcess with PROCESS_VM_READ) targeting lsass.exe from processes that are unsigned, unexpected, or not on an allowlist. This behavioral signal is far more specific than generic system activity and directly maps to the MITRE ATT&CK technique T1003.001 (LSASS Memory).

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

The action executes a binary located in C:\Users\Public\ or C:\Windows\Temp\

User-writable directories such as C:\Users\Public\ and C:\Windows\Temp\ let any unprivileged process drop and execute payloads, so a scheduled task pointing there signals attacker staging rather than a vendor update, which would run from Program Files or a signed system path.

The task is scheduled to run every 24 hours

The task has a generic name like 'Updater'

The task is configured to run at system startup

Why: Legitimate software installers place binaries in Program Files, ProgramData, or vendor-specific directories, whereas malware frequently drops executables in world-writable locations like C:\Users\Public, C:\Windows\Temp, or %AppData% to evade detection and avoid needing administrative rights. A scheduled task whose action points to a binary in one of these paths is a strong persistence indicator because attackers use it to survive reboots without touching protected directories.

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

Infrastructure

The Infrastructure axis of the Diamond Model describes the physical and logical assets adversaries use, including command-and-control servers, domains and channels. Examining it reveals the systems compromised hosts communicate with, directly answering the analyst's requirement.

Capability

Adversary

Victim

Why: The Diamond Model of Intrusion Analysis consists of four core features: Adversary, Capability, Infrastructure, and Victim. Infrastructure refers to the physical and logical communication structures (e.g., IP addresses, domain names, email addresses, command-and-control servers) that the adversary uses to deliver capabilities and maintain control. To identify how an adversary communicates with compromised hosts, the analyst must focus on the Infrastructure component, as it encompasses the channels and mechanisms enabling interaction between the adversary and the victim.

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Check the destination IP against a reputation database

Compare the total volume of data sent to the IP against a global average

Analyze the variance in the time delta between consecutive connections to the destination IP

Beaconing produces periodic connections with low variance in inter-arrival times, whereas normal user traffic is bursty and irregular. Measuring variance in the time delta between consecutive connections to the destination IP exposes that regularity, reliably separating automated callbacks from genuine high-volume activity.

Perform a DNS lookup on the destination IP address

Why: Beaconing malware typically communicates with a command-and-control (C2) server at regular intervals, resulting in low variance in the time deltas between connections. Normal user traffic is more random. Analyzing the variance (or standard deviation) of inter-connection times can reveal this periodicity, making it the most reliable statistical method.

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Enable verbose logging on all domain controllers

Run a full antivirus scan on the affected workstation

Reimage the host immediately to prevent lateral movement

Perform frequency analysis (stack counting) on the command-line arguments across the environment

Stack counting command-line arguments across the estate reveals whether the encoded PowerShell pattern is rare or widespread, satisfying the need to distinguish malicious activity from routine administration. Legitimate administrative scripts recur predictably, whereas attacker tradecraft produces outliers; frequency analysis surfaces those deviations without relying on signature detection.

Why: Frequency analysis (stack counting) on command-line arguments across the environment reveals whether the encoded PowerShell pattern is rare and anomalous or common and benign. Legitimate admin scripts tend to recur across many hosts with similar arguments, while malicious encoded commands often appear once or in small clusters. This technique is a core threat-hunting method for triaging suspicious command lines.

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

Update all signatures to the most restrictive settings available

Create suppression rules for alerts originating from known-good internal system administration scanners

Suppression rules scoped to known-good internal administration scanners remove predictable, benign scan traffic without disabling the signatures themselves, so genuine malicious activity on other hosts still triggers alerts. This cuts analyst triage volume while preserving detection coverage elsewhere.

Disable all low-severity alerts in the IDS management console

Set the IDS to 'Alert Only' mode for all signatures

Why: Suppression rules scoped to known-good internal scanners eliminate the predictable, high-volume false positives those tools generate without weakening detection for genuine threats. This preserves signature fidelity for real attack traffic while directly reducing analyst triage load, which is the stated goal of balancing efficacy and workload. It is a targeted, documented tuning action rather than a blunt global change.

Want more Proactive Threat Detection practice?

All Security Operations And Management questions

Domain 8: Security Operations And Management

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Security Content Engineer

The Security Content Engineer owns detection content, tuning correlation rules to reduce false positives and validating that the SIEM parses and alerts correctly. This role keeps rule logic and platform health aligned, distinct from analysts who triage alerts or architects who design the deployment.

Incident Responder

Compliance Officer

SOC Manager

Why: The Security Content Engineer is the role dedicated to authoring, tuning, and maintaining detection content such as SIEM correlation rules, use cases, and parsers. This role owns the health and efficacy of the detection pipeline, which is exactly what the question describes. Other roles focus on response, governance, or management rather than content lifecycle.

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Event Parser Configuration

Correlation Rule Threshold

Correlation rule thresholds define how many matching events within a specified time window trigger an alert. Setting the count to five and the window to 60 seconds produces exactly the required high-severity alert condition, filtering out lower-frequency noise.

Aggregation Key

Suppression Window

Why: A correlation rule threshold defines how many matching events within a specified time window must occur before the rule fires an alert. To trigger only when 5 events occur in 60 seconds, you set the threshold count to 5 and the window to 60 seconds in the correlation rule. This is the exact metric that controls the 'how many, how fast' logic of alert generation.

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Reset all user passwords

Perform full forensic imaging

Run host isolation playbook

Running the host isolation playbook immediately severs network connectivity for the compromised endpoint, preventing lateral movement and further exfiltration. This directly satisfies the stem's requirement to move from Detection into Containment, since isolating the affected host is the fastest way to limit incident scope before deeper forensic investigation or eradication begins.

Update the firewall rule base

Why: Host isolation is the fastest way to stop an active threat from spreading laterally or exfiltrating data, and it preserves the endpoint state for later forensics. In a SOAR playbook, isolation is typically the first automated containment action because it is reversible and low-impact compared to network-wide changes.

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

MSSP

A Managed Security Service Provider (MSSP) remotely delivers monitoring, detection and response as an outsourced service, while the client retains ownership of its security posture and policies. This satisfies the constraint of outsourcing monitoring yet keeping internal control.

Virtual SOC

Internal SOC

Hybrid Cloud SOC

Why: An MSSP (Managed Security Service Provider) is a third-party provider that delivers outsourced security monitoring and management services — such as 24/7 SOC operations, SIEM monitoring, and incident response — while the client organization retains ownership and control of its security posture and policies. This matches the scenario of outsourcing monitoring while retaining internal control.

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

MTTR

False Positive Rate

Dwell Time

MTTA

MTTA measures the interval from alert detection to an analyst acknowledging and beginning work on it, directly exposing delays between detection and assignment. MTTR would obscure this, since it spans the entire incident lifecycle through to resolution, masking the specific escalation bottleneck the audit identified.

Why: MTTA (Mean Time to Acknowledge) measures the average time between an alert being generated and an analyst acknowledging or being assigned to it, which is exactly the detection-to-assignment interval the SOC wants to optimize. Analyzing MTTA isolates delays in triage routing, queue assignment, or analyst availability. MTTR, by contrast, covers the entire lifecycle through resolution and would mask where the bottleneck actually sits.

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

Level 3

Level 3 requires documented, standardised processes applied across the organisation, yet still permits reliance on manual effort. Since automation is absent, the SOC sits at Level 3 rather than Level 4, where processes are quantitatively measured and managed.

Level 5

Level 2

Level 1

Why: Level 3 (Defined) in the CMMI-based SOC maturity model is characterized by documented, standardized processes that are consistently applied across the organization, but which still rely heavily on manual execution rather than automation. Since the SOC has documented standard processes but lacks consistent automation, it has achieved Level 3. Automation and continuous optimization are hallmarks of the higher levels (Level 4 Quantitative Managed and Level 5 Optimizing), not Level 3.

Want more Security Operations And Management practice?

Browse all 312-39 questions Take a timed practice test

Frequently asked questions

How many questions are on the 312-39 exam?

The 312-39 exam has 100 questions and must be completed in 180 minutes. Always confirm current details on the vendor's official exam page.

What types of questions appear on the 312-39 exam?

Scenario-based questions covering exam objectives with detailed answer explanations.

How are 312-39 questions organised by domain?

The exam covers 8 domains: Incident Response, SOC For Cloud Environments, Cyber Threats Iocs And Attack Methodology, Forensic Investigation And Malware Analysis, Incident Detection And Triage, Log Management, Proactive Threat Detection, Security Operations And Management. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual 312-39 exam questions?

No. These are original exam-style practice questions written against the official EC-Council 312-39 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 328 312-39 questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.

EC-Council · Free Practice Questions · Last reviewed May 2026

312-39 Exam Questions and Answers

48 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

100 exam questions

180 min time limit

8 exam domains

Overview Domain Blueprint Study Guide All QuestionsSample by Domain

Domain 1: Incident Response

All Incident Response questions

Threat Intelligence dashboard

Access Anomalies dashboard

User Activity Monitoring

Incident Review dashboard

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Update the Work notes with an @mention to the manager

Delete the ticket and create a new one

Manually email the manager with incident details

Change the State to 'Closed'

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Assign it to another team to verify

Set status to 'Closed' with resolution code 'False Positive'

Ignore the ticket and let it expire

Delete the incident

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Host Timeline

Detection Details

Process Tree

Network Activity

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

Allow all, then log

Enable Intrusion Prevention System (IPS) in 'Alert' mode

Enable SSL Inspection

Deny egress to the specific destination IP

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

Volatility

Nmap

Autopsy

Wireshark

Procmon

Want more Incident Response practice?

All SOC For Cloud Environments questions

Domain 2: SOC For Cloud Environments

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Microsoft Defender for Servers

Azure Advisor

Azure Network Watcher

Azure Resource Graph

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

VPC Flow Logs

EBS Snapshot logs

S3 Data Events

Route 53 Resolver query logs

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Cloud Trace

Security Command Center

Deployment Manager

Cloud Billing

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

Azure Policy Compliance dashboard

Azure Monitor Metrics

Microsoft Entra ID Sign-in logs

Azure Service Health

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Modify Security Group to deny all traffic

Remove the IAM Role

Disable the VPC

Terminate the instance

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Azure Front Door

Azure Policy

Azure Bastion

Azure Key Vault

Want more SOC For Cloud Environments practice?

All Cyber Threats Iocs And Attack Methodology questions

Domain 3: Cyber Threats Iocs And Attack Methodology

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Port-based blocking

Frequency analysis on connection flow metadata

Signature-based IDS alert

Static IP blocklisting

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

An attempted DDoS attack

A network misconfiguration

A successful data exfiltration

A compromised host attempting to reach a C2

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Data exfiltration indicator

Unauthorized access attempt

Network anomaly signature

System resource exhaustion

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

malware.exe

mimikatz.exe

powershell.exe -enc JABz...

netcat.exe

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Isolate the host from the network

Delete the file

Update antivirus signatures

Restart the server

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Deploying a remote access trojan

Exploiting a software vulnerability

Scanning for open ports and services

Encrypting data for ransom

Want more Cyber Threats Iocs And Attack Methodology practice?

All Forensic Investigation And Malware Analysis questions

Domain 4: Forensic Investigation And Malware Analysis

Malwarebytes Nebula

VirusTotal

Nessus

Splunk ES

Wireshark

Netcat

Nmap

INetSim

Autoruns

TCPView

Process Explorer

Process Monitor

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Procmon

Cuckoo Sandbox

PEview

x64dbg

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Process Hacker

Wireshark

Detect It Easy (DIE)

HashCalc

Calculate a cryptographic hash of both

Mount the image read-write

Run an antivirus scan

Rename the file

Want more Forensic Investigation And Malware Analysis practice?

All Incident Detection And Triage questions

Domain 5: Incident Detection And Triage

What is the purpose of normalizing logs in a SIEM?

To compress log size for storage efficiency.

To hide sensitive information.

To increase the ingestion speed.

To provide a common format for cross-vendor correlation.

Unions only support structured data.

Joins allow matching records between two datasets based on a common field.

Joins consume less memory than unions.

Unions cannot be used in detection rules.

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

Alert frequency.

Log source vendor.

Asset Criticality.

Number of alerts per user.

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

The parser is disabled.

The user interface is loading slowly.

The aggregation window is configured incorrectly.

The license has expired.

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

Check threat intelligence feeds to see if the IP is flagged as malicious.

Escalate to the ISP immediately.

Disable the rule for all cloud traffic.

Ignore the alert as cloud IPs are always false positives.

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Isolate the host immediately.

Verify if the connection was successful or blocked by the firewall.

Reimage the affected workstation.

Contact the user's manager.

Want more Incident Detection And Triage practice?

All Log Management questions

Domain 6: Log Management

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Archive all logs in a local text file format only

Retain logs for exactly 30 days

Keep logs for one year, with 3 months immediately available

Delete logs after they are indexed in the SIEM

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

UDP

TCP

ICMP

ARP

Simple Queue Service (SQS)

Kinesis Firehose

CloudWatch Unified Agent

AWS Config

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

Utilizing SNMPv1 traps

Implementing TLS-based log forwarding

Encapsulating logs in cleartext UDP packets

Using standard port 514 without encryption

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/

Defining separate log paths for every individual IP address

Configuring the global log_level to debug

Using hardcoded static path strings only

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

/var/log/messages

/etc/rsyslog.conf

/etc/sysctl.conf

/etc/logrotate.conf

Want more Log Management practice?

All Proactive Threat Detection questions

Domain 7: Proactive Threat Detection

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Failed login attempts to the local administrator account

Process access requests to lsass.exe from an unauthorized or unsigned process

Increased CPU usage on the Domain Controller

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

The action executes a binary located in C:\Users\Public\ or C:\Windows\Temp\

The task is scheduled to run every 24 hours

The task has a generic name like 'Updater'

The task is configured to run at system startup

Infrastructure

Capability

Adversary

Victim

Check the destination IP against a reputation database

Compare the total volume of data sent to the IP against a global average

Analyze the variance in the time delta between consecutive connections to the destination IP

Perform a DNS lookup on the destination IP address

Enable verbose logging on all domain controllers

Run a full antivirus scan on the affected workstation

Reimage the host immediately to prevent lateral movement

Perform frequency analysis (stack counting) on the command-line arguments across the environment

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

Update all signatures to the most restrictive settings available

Create suppression rules for alerts originating from known-good internal system administration scanners

Disable all low-severity alerts in the IDS management console

Set the IDS to 'Alert Only' mode for all signatures

Want more Proactive Threat Detection practice?

All Security Operations And Management questions

Domain 8: Security Operations And Management

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Security Content Engineer

Incident Responder

Compliance Officer

SOC Manager

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Event Parser Configuration

Correlation Rule Threshold

Aggregation Key

Suppression Window

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Reset all user passwords

Perform full forensic imaging

Run host isolation playbook

Update the firewall rule base

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

MSSP

Virtual SOC

Internal SOC

Hybrid Cloud SOC

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

MTTR

False Positive Rate

Dwell Time

MTTA

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

Level 3

Level 5

Level 2

Level 1

Want more Security Operations And Management practice?