312-39 Practice Test 1 — 10 Questions

Question 1

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Accepted Answer

The aggregation window is configured incorrectly.. In ArcSight correlation rules, the aggregation window defines the time period over which events are grouped and evaluated. If the window is misconfigured (too short, too long, or with incorrect reset conditions), the rule will not accumulate the required events to trigger, even if the filter logic is correct. This is the most common cause of a rule that matches events but never fires.

Answer

The parser is disabled.

Answer

The user interface is loading slowly.

Answer

The license has expired.

Question 2

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?

Accepted Answer

Security log, Event ID 4688. To retrieve the full command line of a PowerShell process, the analyst should examine Security log Event ID 4688, which records process creation and includes command-line data when the appropriate audit policy is enabled. Other events like 7045, 1000, or 4104 serve different purposes and do not reliably capture the command line. Event ID 4688 is the standard source for process command-line auditing.

Answer

Application log, Event ID 1000

Answer

System log, Event ID 7045

Answer

Windows PowerShell log, Event ID 4104

Question 3

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 4

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

Accepted Answer

Detection and Analysis. Detection and Analysis is the correct phase because it encompasses the activities of identifying that an incident has occurred, determining its type (e.g., malware, phishing, DDoS), and assessing its scope (affected systems, data, users). This phase follows Preparation and precedes Containment, Eradication, and Recovery in the NIST SP 800-61 lifecycle.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 5

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved change window. The analyst needs to determine who made the modification and from which IP address. Which AWS service should the analyst query to retrieve this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the authoritative source for API activity in an AWS account. It logs every API call, including IAM policy attachments, and captures the caller's identity, source IP, and timestamp. By querying CloudTrail event history for the AttachRolePolicy action on the Lambda execution role, the analyst can pinpoint the unauthorized change and its origin, enabling incident response.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 6

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

Accepted Answer

Source IP, destination host, and the involved user account.. During initial triage of a high-severity alert, the most critical information to gather is the source IP, destination host, and involved user account. These three data points establish the who, what, and where of the event, enabling the analyst to quickly assess scope, determine if the activity is malicious, and decide on containment steps. Without them, the alert remains abstract and cannot be correlated with other logs or threat intelligence. This aligns with the EC-Council 312-39 (Certified SOC Analyst) focus on practical incident handling and the 5W1H approach to alert triage.

Answer

The time taken to generate the alert.

Answer

The hardware vendor of the firewall.

Answer

The SIEM software version.

Question 7

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?

Accepted Answer

Logon Type 2. Interactive brute-force attacks against workstations generate Windows Security Event ID 4625 with Logon Type 2, which indicates a user attempted to log on at the physical console. Other logon types correspond to different access methods: Type 3 for network, Type 4 for batch, Type 5 for service, and Type 10 for RDP. Focusing on Type 2 allows the analyst to isolate local interactive password-guessing attempts.

Answer

Logon Type 5

Answer

Logon Type 4

Answer

Logon Type 10

Question 8

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Accepted Answer

Windows Event Log - PowerShell Script Block Logging (Event ID 4104). PowerShell Script Block Logging (Event ID 4104) records the actual script block text that PowerShell executes, including de-obfuscated commands after certain decoding steps, making it the richest source for seeing what an attacker ran. This is especially valuable for fileless attacks where nothing touches disk. Event ID 4688 only shows that powershell.exe launched, not the commands inside it.

Answer

Disk forensic analysis of the user's browser history

Answer

Windows Security Log - Process Creation (Event ID 4688)

Answer

Network firewall traffic logs for port 5985

Question 9

Which THREE factors should be considered when determining the severity level of an incident?

Accepted Answer

Business impact. Severity level in incident response is driven by how much harm the incident can cause and how quickly it must be addressed, so Business impact (B) is correct because it measures the effect on operations, revenue, and services, which directly determines how severe the incident is. Data sensitivity (C) is correct because incidents involving regulated, confidential, or high-value data (e.g., PII, PHI, intellectual property) warrant a higher severity due to legal, compliance, and reputational consequences. Urgency (E) is correct because it reflects how time-critical the response is — for example, an active ransomware spread or ongoing data exfiltration demands immediate action and thus elevates severity. The analyst's mood (A) is a subjective human state and has no bearing on objective incident severity, and the day of the week (D) is irrelevant to the technical and business impact of an incident, even if staffing levels may vary.

Answer

The analyst's mood

Answer

The day of the week

Question 10

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Accepted Answer

Suspicious sender address. Option A (Suspicious sender address) is correct because phishing emails frequently use spoofed, look-alike, or mismatched domains (e.g., 'micros0ft.com' or a display name that doesn't match the actual SMTP envelope sender), which is a primary technical indicator analysts examine in email headers via SPF, DKIM, and DMARC checks. Option E (Urgent/threatening tone) is correct because social-engineering lures commonly pressure recipients with deadlines, account-suspension threats, or fear of consequences to bypass careful scrutiny and trigger immediate clicks or credential entry. Option B is not a reliable indicator since legitimate and malicious emails alike are often sent during business hours to blend in. Option C is not an indicator at all, as virtually every email has a subject line. Option D is not inherently suspicious; while CEO impersonation (BEC) occurs, mail genuinely from the CEO is normal, so the sender's authenticity must be verified rather than the title alone treated as a red flag.

Answer

The email is sent during business hours

Answer

The email has a subject line

Answer

The email is from the CEO