312-39 Practice Test — Free Certified SOC Analyst (312-39) Questions with Explanations

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved change window. The analyst needs to determine who made the modification and from which IP address. Which AWS service should the analyst query to retrieve this information?

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a handful resolving to short-lived IP addresses. The analyst wants to map this behavior to the most likely stage of the Cyber Kill Chain and the corresponding IOC category. Which of the following best describes this activity?

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should the analyst take?

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Which document should you reference first to determine the communication path during a high-severity security incident?

A SOC analyst is reviewing a threat intelligence report that lists a new C2 domain. The SIEM has no prior detection rule for this domain. Which action best uses the diamond model to proactively operationalize this intelligence for future detection?

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

A SOC analyst is reviewing DNS logs and sees a host repeatedly querying subdomains like 'a1b2c3d4e5.evil-domain.com' every 60 seconds, with each subdomain being a random 10-character string. The responses are consistently NXDOMAIN. Which attack technique is most likely indicated?

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?