312-39 Exam Questions and Answers

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

What is the purpose of normalizing logs in a SIEM?

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?