312-39 Practice Test 10 — 10 Questions

Question 1

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

Accepted Answer

Check threat intelligence feeds to see if the IP is flagged as malicious.. Cloud provider IPs are commonly used by attackers (and also by legitimate scanners and services), so the correct triage step is to enrich the source IP with threat intelligence feeds to determine whether it is a known malicious actor. This contextual enrichment is a core SOC triage practice before deciding to escalate, close, or tune. It avoids both blind escalation and blind dismissal.

Answer

Escalate to the ISP immediately.

Answer

Disable the rule for all cloud traffic.

Answer

Ignore the alert as cloud IPs are always false positives.

Question 2

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

Accepted Answer

Generating cryptographic hashes for log files. Generating cryptographic hashes for log files creates a tamper-evident seal: any modification to the log changes its hash, which can be detected by recomputing and comparing. This is the most robust method because it provides integrity verification even if an attacker gains write access to the logs. Hashing should be done immediately after log rotation and stored separately from the logs themselves.

Answer

Storing logs on a local partition

Answer

Clearing the logs daily

Answer

Setting file permissions to read-only

Question 3

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

Accepted Answer

Alert Triage and Prioritization. Alert triage and prioritization involves reviewing incoming alerts, assessing their severity, and categorizing them to focus on the most critical issues first. Mapping alerts to MITRE ATT&CK techniques helps analysts understand the adversary's tactics and prioritize based on the stage of the attack, which directly reduces alert fatigue by filtering out low-priority or duplicate alerts. This is a core triage activity, not a vulnerability assessment, rule development, eradication, or log retention task.

Answer

Vulnerability Assessment

Answer

Correlation Rule Development

Answer

Incident Eradication

Answer

Log Retention Analysis

Question 4

What is the primary benefit of using a centralized logging server compared to local logging?

Accepted Answer

Simplified log correlation and incident response. A centralized logging server aggregates logs from many sources into one location, enabling correlation of events across hosts, applications, and time zones — which is essential for detecting multi-stage attacks and accelerating incident response. Local logging scatters evidence across individual machines, making cross-system correlation slow or impossible during an investigation. Centralization also supports retention, tamper resistance, and compliance reporting from a single platform.

Answer

Increased disk space on the local server

Answer

Eliminating the need for a security policy

Answer

Faster network traffic speeds

Question 5

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Accepted Answer

Increased DNS request volume (DNS Tunneling). Option D is correct because DNS tunneling is a classic data exfiltration technique: malware encodes stolen data into DNS queries (often TXT, NULL, or CNAME records) sent to an attacker-controlled authoritative name server, so a sudden spike in DNS request volume—especially long or high-entropy subdomain labels—signals data being smuggled out through port 53. Option E is correct because exfiltration inherently requires outbound transfer, and a high volume of outbound traffic to an unfamiliar or foreign IP address (particularly over common ports like 80/443 or via protocols such as FTP/SMTP) indicates data being sent to an external command-and-control or collection server. Option A does not belong because multiple failed logins indicate a brute-force or password-guessing attempt (an access/authentication attack), not the transfer of data out of the environment. Option B does not belong because system clock synchronization errors point to NTP misconfiguration or time drift, which is a reliability/availability issue rather than evidence of data theft. Option C does not belong because installing new system drivers is a host configuration or persistence/rootkit-related change, not an indicator of outbound data exfiltration.

Answer

Multiple failed login attempts

Answer

System clock synchronization errors

Answer

Installation of new system drivers

Question 6

Which SIEM feature is used to group related events into a single incident?

Accepted Answer

Event correlation logic.. Event correlation logic is the SIEM feature that groups related events into a single incident by applying rules that match patterns across multiple log sources over time. For example, a correlation rule might trigger when five failed logins from the same IP are followed by a successful login within 10 minutes, producing one incident rather than five separate alerts. This reduces alert fatigue and gives analysts a coherent attack narrative.

Answer

Log rotation.

Answer

Dashboard visualization.

Answer

Data ingestion.

Question 7

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

Accepted Answer

Volatility. Volatility is the standard open-source memory forensics framework used to analyze RAM dumps and identify artifacts such as injected code, running processes, and network connections. When a suspicious PowerShell script may have injected malicious code into a process, volatile memory analysis with Volatility can reveal hidden or injected modules that disk-based tools would miss. Nmap, Autopsy, Wireshark, and Procmon serve different purposes and cannot perform memory forensics.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Answer

Procmon

Question 8

What is the purpose of normalizing logs in a SIEM?

Accepted Answer

To provide a common format for cross-vendor correlation.. Normalizing logs in a SIEM means parsing and transforming raw log data from diverse sources (firewalls, IDS, OS, applications) into a consistent, standardized schema (e.g., Common Event Format (CEF), Log Event Extended Format (LEEF), or a custom taxonomy). This common format allows the SIEM to correlate events across different vendors and technologies—for example, linking a firewall deny log with an IDS alert and an authentication failure—by ensuring fields like source IP, destination IP, and event type have the same names and data types. Without normalization, cross-vendor correlation would be impossible because each source uses its own field names and structures.

Answer

To compress log size for storage efficiency.

Answer

To hide sensitive information.

Answer

To increase the ingestion speed.

Question 9

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

Accepted Answer

Investigate the destination server's logs to see if the attack succeeded.. An alert for possible SQL injection with harmless payload strings may still indicate a probing attempt or a false positive, so the analyst must verify whether the attack actually succeeded before taking action. Reviewing the destination server's logs (web server, database, WAF) confirms whether the payload reached the database and whether any data was exfiltrated or modified, which determines the appropriate response.

Answer

Reimage the database server.

Answer

Close the alert as 'Benign'.

Answer

Block the source IP on the edge firewall.

Question 10

A SOC analyst is reviewing logs from a Linux server and notices that the /var/log/messages file is growing rapidly and consuming disk space. The analyst needs to ensure that logs are rotated daily and compressed, and that only the last 7 days of logs are retained. Which logrotate configuration directive should be used to achieve the retention requirement?

Accepted Answer

rotate 7. The rotate directive controls how many rotated log files are kept. Setting rotate 7 with daily rotation retains 7 days of logs, as each day a new rotation occurs and the oldest is deleted. The compress option would further reduce space. Other directives like daily set frequency, maxage sets age-based deletion, and size sets size-based rotation, but rotate is the specific directive for retention count.

Answer

maxage 7

Answer

daily

Answer

size 7M