312-39 Practice Test 1 — 10 Questions

Question 1

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Accepted Answer

Use of removable media or virtual volumes. Shimcache (AppCompatCache) tracks file execution; if the volume is gone, it suggests a removable drive or virtual volume was used by the attacker.

Answer

Memory corruption

Answer

Log manipulation

Answer

System update failure

Question 2

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

Accepted Answer

Security Event ID 4624 (Logon Type 9). Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.

Answer

Registry key creation in RunOnce

Answer

Prefetch file modification

Answer

DNS query logs

Question 3

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Accepted Answer

Scanning for open ports and services. Reconnaissance involves gathering information to identify vulnerabilities before launching an attack.

Answer

Deploying a remote access trojan

Answer

Exploiting a software vulnerability

Answer

Encrypting data for ransom

Question 4

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

Accepted Answer

A compromised host attempting to reach a C2. Sinkholes are used by security researchers to intercept traffic from infected hosts that are trying to contact a C2 domain.

Answer

An attempted DDoS attack

Answer

A network misconfiguration

Answer

A successful data exfiltration

Question 5

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Accepted Answer

Unauthorized access attempt. This behavior is a classic indicator of a brute-force attack or credential stuffing attempt.

Answer

Data exfiltration indicator

Answer

Network anomaly signature

Answer

System resource exhaustion

Question 6

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Accepted Answer

netstat -tulnp. The 'netstat -tulnp' or 'ss -tulnp' command shows the process ID alongside the listening socket.

Answer

top

Answer

ps aux

Answer

lsmod

Question 7

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

Accepted Answer

Generating cryptographic hashes for log files. Cryptographic hashing of log files at intervals provides an verifiable proof of log integrity.

Answer

Storing logs on a local partition

Answer

Clearing the logs daily

Answer

Setting file permissions to read-only

Question 8

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

Accepted Answer

powershell.exe -enc JABz.... LotL techniques use built-in system tools like PowerShell or WMI to execute malicious actions, avoiding the need for custom malware.

Answer

malware.exe

Answer

mimikatz.exe

Answer

netcat.exe

Question 9

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Accepted Answer

Windows Scheduled Tasks. Persistence often relies on modifying startup folders, registry keys, or scheduled tasks.

Answer

Network interface throughput

Answer

Browser history logs

Question 10

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Accepted Answer

Isolate the host from the network. Identifying a process running from a suspicious location like Temp is a high-confidence IoC for malware.

Answer

Delete the file

Answer

Update antivirus signatures

Answer

Restart the server