312-39 Practice Test 11 — 15 Questions

Question 1

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Accepted Answer

To reuse common logic in multiple rules.. Building blocks allow you to reuse common logic (e.g., 'Internal IPs') across multiple rules.

Answer

To delete logs from the storage.

Answer

To backup the configuration.

Answer

To generate reports automatically.

Question 2

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the standard repository for aggregating file hash results from multiple antivirus vendors.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 3

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

Accepted Answer

Asset Criticality.. Asset criticality helps determine the priority of an incident in a real-world SOC environment.

Answer

Alert frequency.

Answer

Log source vendor.

Answer

Number of alerts per user.

Question 4

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Accepted Answer

Confirmed evidence of malicious intent or unauthorized access.. High-impact assets and confirmed malicious activity are primary escalation criteria.

Answer

The user likes the alert's name.

Answer

The alert was generated by a junior analyst.

Answer

The SIEM license is expiring soon.

Question 5

In a SIEM, what is the role of a 'Parser'?

Accepted Answer

To extract fields and normalize log data.. Parsers normalize raw log data into a structured format with defined fields.

Answer

To print reports.

Answer

To encrypt log files.

Answer

To scan for viruses.

Question 6

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

Accepted Answer

Browser Hijacking. Installing unauthorized browser extensions is a common technique for persistence and data theft (browser hijacking).

Answer

Man-in-the-Middle (MitM)

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Question 7

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Calculating a cryptographic hash (MD5/SHA256) of the original and the copy confirms that the data has not been altered during the duplication process.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file

Question 8

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The 'Run' and 'RunOnce' keys are the most common locations for malware to ensure automatic execution upon user login.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKCU\Software\Classes

Answer

HKLM\System\CurrentControlSet\Control\Session Manager

Question 9

Which of the following is a key advantage of utilizing a centralized SIEM platform?

Accepted Answer

Unified visibility across disparate security layers.. A unified view allows for correlation across disparate security layers, which is impossible with siloed tools.

Answer

Hardware reduction in the datacenter.

Answer

Elimination of all false positives.

Answer

Automatic remediation of all threats.

Question 10

Which THREE of the following are essential for effective incident response within a SIEM?

Accepted Answer

Automated playbooks or runbooks.. Documentation, playbooks, and integration are critical for response.

Answer

Unlimited coffee supply.

Answer

A large collection of desk chairs.

Question 11

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

Accepted Answer

A known malicious IP address.. A malicious IP or file hash is a classic IoC.

Answer

The SIEM administrator's name.

Answer

The server name.

Answer

The company's office address.

Question 12

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Accepted Answer

Check the asset's 'Business Criticality' and 'Owner' in the CMDB to see if the activity is a scheduled backup.. Validating the legitimacy of the activity is critical. Checking if the user is authorized for cloud backups or if the machine is a known server/backup agent prevents false escalation.

Answer

Block the cloud storage IP address on the corporate firewall.

Answer

Immediately disable the user account in Active Directory.

Answer

Re-image the affected host immediately.

Question 13

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Accepted Answer

Process Tree. The Process Tree in CrowdStrike Falcon visualizes the genealogy of the process that triggered the detection.

Answer

Host Timeline

Answer

Detection Details

Answer

Network Activity

Question 14

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Accepted Answer

To validate and scope the threat. IOCs act as signatures or artifacts that help confirm the presence of a threat.

Answer

To communicate with law enforcement

Answer

To prevent future incidents

Answer

To manage system backups

Question 15

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

To remove the threat from the environment. To remove all traces of the threat (malware, backdoors, compromised accounts) from the environment.

Answer

To identify the root cause

Answer

To restore business operations

Answer

To report to stakeholders