312-39 Practice Test 12 — 15 Questions

Question 1

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Web proxy logs. Firewall logs and web proxy logs are the most critical for determining data exfiltration method and volume. Firewall logs show outbound connections and byte counts, while proxy logs provide application-layer details like URLs and payload sizes. Together, they allow the analyst to identify the channel and quantify the data transferred. Other logs like DNS or authentication may provide context but lack the direct volume and method information.

Answer

DNS query logs

Answer

System performance logs

Answer

Authentication logs

Question 2

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Accepted Answer

Network traffic logs showing SMB/RDP connections between workstations. Option A is correct because network traffic logs capturing SMB (TCP 445) and RDP (TCP 3389) connections between workstations directly reveal lateral movement paths, such as workstation-to-workstation SMB sessions or RDP logins that deviate from normal patterns. Option E is correct because Windows Security Log Event ID 4624 records successful logon events, including Logon Type 3 (Network, typical of SMB) and Logon Type 10 (RemoteInteractive, used by RDP), which are essential for identifying remote access to a host. Option B is not relevant since system clock synchronization logs only concern time accuracy (e.g., NTP/W32Time) and do not record access activity. Option C is not relevant because Microsoft Word application logs capture document or crash events, not remote access techniques. Option D is not relevant because browser cache logs only reflect web browsing artifacts and have no bearing on RDP or SMB lateral movement.

Answer

System clock synchronization logs

Answer

Application logs for Microsoft Word

Answer

Browser cache logs

Question 3

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Accepted Answer

Modification of CloudTrail or logging configurations. Option A is correct because attackers routinely disable or tamper with CloudTrail trails, S3 access logging, or GuardDuty to erase their tracks, so any modification of logging configurations is a high-fidelity compromise indicator. Option D is correct because successful authentications from multiple geographically distant locations in a short window suggest credential theft or session hijacking, indicating account takeover. Option E is correct because creating an IAM user without an MFA device is a classic persistence technique used to establish a backdoor identity that survives password resets. Option B is not a reliable indicator, since free-tier usage is normal for many legitimate accounts and does not by itself signal compromise. Option C is not an indicator at all, as scheduled system reboots are routine maintenance activity rather than malicious behavior.

Answer

Increased usage of free-tier services

Answer

Standard scheduled system reboots

Question 4

What is the main objective of the 'Post-Incident Activity' phase?

Accepted Answer

To identify lessons learned and improve future response. The Post-Incident Activity phase in the NIST SP 800-61 incident response lifecycle exists to review what happened, capture lessons learned, and feed improvements back into preparation, detection, and response processes. Its core output is a post-incident report and updated playbooks, not punitive or destructive actions. This is why 'identify lessons learned and improve future response' is the correct objective.

Answer

To close all firewall ports

Answer

To discipline the employee involved

Answer

To delete all evidence

Question 5

What does the 'False Positive' rate of a SIEM rule indicate?

Accepted Answer

The ratio of legitimate activity flagged as malicious.. A false positive occurs when a SIEM rule flags legitimate activity as malicious. The false positive rate therefore measures the ratio or percentage of alerts that are benign but incorrectly identified as threats. A high false positive rate means analysts waste time investigating non-issues and may develop alert fatigue.

Answer

The speed of alert generation.

Answer

The number of logs ingested.

Answer

The percentage of blocked attacks.

Question 6

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Accepted Answer

Correlation Rule Threshold. A correlation rule threshold defines how many matching events within a specified time window must occur before the rule fires an alert. To trigger only when 5 events occur in 60 seconds, you set the threshold count to 5 and the window to 60 seconds in the correlation rule. This is the exact metric that controls the 'how many, how fast' logic of alert generation.

Answer

Event Parser Configuration

Answer

Aggregation Key

Answer

Suppression Window

Question 7

Which TWO types of logs are most useful for detecting lateral movement?

Accepted Answer

Windows Event Log (Logon events). Windows Event Log logon events (Option C) are correct because lateral movement typically involves remote authentication, so Security log events such as 4624 (successful logon) with Logon Type 3 (network) or Type 10 (RemoteInteractive/RDP), plus 4625 failures and 4648 explicit-credential logons, reveal attacker pivoting between hosts. Network flow logs for SMB/RDP (Option D) are correct because lateral movement commonly uses TCP 445 (SMB) and TCP 3389 (RDP), and flow records showing internal host-to-host connections to these ports expose the movement path even when endpoint logging is incomplete. Option A (system temperature logs) is irrelevant because thermal data reflects hardware health, not authentication or connection activity. Option B (application logs) can occasionally show exploitation or service abuse but are not primarily designed to record logon or network-session evidence of lateral movement. Option E (printer spooler logs) relates to print jobs and the PrintNightmare vector at most, not to the authentication and connection patterns that characterize lateral movement.

Answer

System temperature logs

Answer

Application log

Answer

Printer spooler logs

Question 8

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

Accepted Answer

TXT record. TXT records are commonly associated with DNS tunneling for command and control because they can carry arbitrary text data, including encoded commands and responses, and are often allowed through firewalls. Attackers abuse TXT records to exfiltrate data or receive instructions from a C2 server by encoding payloads in the record's text field. This makes TXT a preferred record type for DNS tunneling.

Answer

A record

Answer

CNAME record

Answer

MX record

Question 9

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

To remove the threat from the environment. The Eradication phase focuses on removing the threat from the environment — deleting malware, disabling compromised accounts, patching the exploited vulnerability, and eliminating attacker persistence mechanisms. It follows containment and precedes recovery, ensuring the adversary's foothold is fully removed before systems are restored to production.

Answer

To identify the root cause

Answer

To restore business operations

Answer

To report to stakeholders

Question 10

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

Accepted Answer

Deny egress to the specific destination IP. Denying egress to the specific destination IP is the most effective immediate containment for an external C2 callback because it blocks the outbound channel the malware uses to communicate with its controller. This directly severs the command-and-control link with minimal collateral impact.

Answer

Allow all, then log

Answer

Enable Intrusion Prevention System (IPS) in 'Alert' mode

Answer

Enable SSL Inspection

Question 11

A SOC analyst is triaging an alert from a Windows server indicating a new service was installed. The service binary is located in `C:\Windows\Temp\svc.exe` and runs as `LocalSystem`. The analyst checks the service creation time and sees it was created 10 minutes ago. The server's change management system shows no approved changes. Which of the following is the MOST likely explanation?

Accepted Answer

A persistence mechanism established by an attacker.. The creation of a new service with a binary in a Temp directory, running as LocalSystem, and without corresponding change management approval is highly indicative of an attacker establishing persistence. Attackers frequently use services for persistence because they can be configured to start automatically and run with high privileges. The lack of legitimate documentation and the suspicious binary location are key red flags that should prompt immediate investigation and containment.

Answer

A legitimate software installation by an administrator.

Answer

A false positive caused by a Windows update.

Answer

A scheduled task created by a known application.

Question 12

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

Accepted Answer

Create an exclusion rule for the specific scanner IP address and vulnerability signatures within the SIEM policy.. Creating an exclusion rule for the specific scanner IP and vulnerability signatures within the SIEM policy suppresses the known-benign false positives while preserving the scanner's log ingestion and visibility. This is the standard tuning approach: filter the noise, not the source, so you retain audit and correlation capability for the scanner's activity.

Answer

Permanently disable the ingestion of logs from the vulnerability scanner.

Answer

Change the log source protocol from Syslog to SNMP.

Answer

Increase the threshold for the correlation rule to a point where the scanner no longer triggers it.

Question 13

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the industry-standard platform for checking a file hash (MD5, SHA-1, SHA-256) against dozens of antivirus engines, sandboxes, and threat intelligence sources simultaneously. Analysts paste the hash and instantly see detection ratios, behavioral reports, and community comments. It is the de facto first stop for file reputation during malware triage.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 14

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to AWS services, including S3, capturing details such as the identity of the caller, the time of the call, the source IP, and the action performed (e.g., GetObject, PutObject, DeleteBucket). Reviewing CloudTrail logs for the S3 bucket in question reveals unauthorized or suspicious API activity.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS IAM Access Analyzer

Question 15

Which TWO of the following are primary components of a SIEM architecture?

Accepted Answer

Log Collector.. In a SIEM architecture, the Log Collector (D) is a primary component because it is responsible for ingesting, normalizing, and aggregating log and event data from disparate sources such as servers, network devices, and security appliances before forwarding it for analysis. The SIEM Management/Analytics Engine (E) is also a primary component, as it correlates and analyzes the collected events, applies rules and behavioral analytics, generates alerts, and provides dashboards and reporting for security monitoring. By contrast, a Desktop Firewall (A) is an endpoint security control, an Email Gateway (B) is a mail security and filtering appliance, and a Network Router (C) is a Layer 3 forwarding device; none of these are core SIEM architectural components, even though they may generate logs that a SIEM consumes.

Answer

Desktop Firewall.

Answer

Email Gateway.

Answer

Network Router.