312-39 Practice Test 13 — 15 Questions

Question 1

Which TWO items are part of the 'Lessons Learned' process?

Accepted Answer

Identifying what went well. The 'Lessons Learned' process is a post-incident review activity whose goal is to improve future response, so option C ('Identifying what went well') is correct because documenting successful actions, effective tools, and good decisions preserves institutional knowledge that can be repeated in future incidents. Option E ('Identifying process improvements') is also correct because the review must produce actionable recommendations—such as updating playbooks, tuning detection rules, or closing control gaps—to prevent recurrence or reduce impact. Options A, B, and D do not belong: firing an employee is a punitive HR action rather than a constructive review outcome, changing a building security code is a specific physical-security remediation that may or may not result from a review but is not itself part of the Lessons Learned process, and buying snacks is unrelated to incident analysis or improvement.

Answer

Firing the employee who made the mistake

Answer

Changing the building security code

Answer

Purchasing new snacks for the SOC

Question 2

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Accepted Answer

Verify if the connection was successful or blocked by the firewall.. Standard triage prioritizes verification before containment to avoid unnecessary disruption. Confirming whether the firewall blocked the connection determines if the host is actually compromised or if the alert is a false positive. Only after confirming a successful malicious connection should escalation to isolation occur.

Answer

Isolate the host immediately.

Answer

Reimage the affected workstation.

Answer

Contact the user's manager.

Question 3

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a packer/compiler detection tool that analyzes PE headers, section entropy, and signatures to identify whether a file is packed and with which packer. High entropy in sections like UPX0 or unusual section names are classic packing indicators.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 4

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Accepted Answer

Process Tree. In CrowdStrike Falcon, the Process Tree view visualizes the parent-child relationships of processes on an endpoint, letting the analyst trace the lineage of a suspicious file back to its originating parent process. This is the correct view for understanding how a detection was spawned and identifying the root process that launched it.

Answer

Host Timeline

Answer

Detection Details

Answer

Network Activity

Question 5

Which component of a SIEM is responsible for identifying patterns in real-time?

Accepted Answer

Correlation engine.. The correlation engine in a SIEM is responsible for identifying patterns in real-time by correlating events across multiple sources using rules, thresholds, and logic. It matches normalized events against detection rules to generate alerts when patterns indicating security incidents occur. This is the analytical core that turns raw logs into actionable detections.

Answer

Log parser.

Answer

Reporting module.

Answer

Storage engine.

Question 6

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. In ServiceNow Security Incident Response (SIR), the standard way to notify a specific person such as the security manager while escalating a ticket is to add an @mention in the Work notes (or Additional comments). ServiceNow automatically sends a notification to the mentioned user, creating an auditable record on the ticket. This keeps communication within the incident record rather than in external channels.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'

Question 7

A SOC analyst is triaging a SIEM alert for a possible data exfiltration. The alert triggered because a large volume of data (5 GB) was transferred from an internal database server to an external IP address over the past hour. The analyst checks the database server's logs and sees that the transfer was initiated by a scheduled backup job that normally runs at 2 AM, but it is currently 10 AM. The backup job uses a service account that has access to the database. Which of the following is the MOST likely explanation for this alert?

Accepted Answer

The service account credentials were compromised and used by an attacker to exfiltrate data.. The most likely explanation is that the service account was compromised and used for data exfiltration. The unusual timing, large data transfer, and external destination are strong indicators of malicious activity. While other explanations are possible, they are less probable without supporting evidence. The analyst should immediately investigate the service account's activity and the external IP to confirm and respond.

Answer

The database server was misconfigured and sent data to the wrong external IP.

Answer

The backup job was manually triggered by an administrator for an ad-hoc backup.

Answer

The SIEM alert is a false positive because backup jobs often transfer large amounts of data.

Question 8

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

Accepted Answer

Regular Expressions (Regex). Regular Expressions (Regex) is the most effective technique for parsing unstructured logs into structured JSON because regex allows pattern-based extraction of fields from free-form text, such as timestamps, IP addresses, usernames, and event codes. SIEM platforms like Splunk, Elastic, and Sentinel commonly use regex-based field extractions to map raw log data to a normalized taxonomy.

Answer

Manual data entry

Answer

Disabling field mapping

Answer

Using a fixed-width parser

Question 9

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

Accepted Answer

Threat Intelligence Feed or Lookup Table.. Threat Intelligence Feeds and Lookup Tables are the standard SIEM features for importing external lists of indicators of compromise (IOCs), including malicious IPs. These features allow the SIEM to enrich events, correlate against known bad actors, and trigger alerts when traffic matches an entry. Lookup Tables specifically enable importing CSV or other structured data for real-time matching, while Threat Intelligence Feeds automate the ingestion and updating of such lists from external sources.

Answer

Global Rule Deletion.

Answer

Log Rotation Policy.

Answer

System Backup.

Question 10

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

Accepted Answer

Correlation rule using user and location attributes.. A correlation rule in a SIEM can join events based on user and location attributes to detect impossible travel or simultaneous logins from disparate geographies. This leverages the SIEM's ability to correlate multiple log sources and apply logic across events. It is the standard method for detecting credential misuse.

Answer

Vulnerability scanning.

Answer

Log compression.

Answer

Full packet capture.

Question 11

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is a static analysis tool that parses the Portable Executable (PE) file format and displays its headers, import table, export table, sections, and embedded strings without running the binary. Since the analyst wants to inspect imports, strings, and headers without executing code, PEview is the correct choice. It reads the on-disk structure of the executable directly, making it safe for malware triage.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 12

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

Accepted Answer

Modify the device-side agent parser or the FlexConnector map file to extract the 'SessionID' field.. In ArcSight ESM, correlation rules can only aggregate on fields that are parsed and available in the event schema. If 'SessionID' is not parsed, you must first modify the device-side agent parser or the FlexConnector map file to extract the field. Only then can the rule reference it for aggregation.

Answer

Create a new 'Active List' to store the unparsed data.

Answer

Use the 'regex' operator within the rule condition itself.

Answer

Enable 'Event Forwarding' on the ESM manager.

Question 13

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Accepted Answer

Number of affected systems. Option B (Number of affected systems) is correct because the scope of an alert directly drives prioritization: an event touching many hosts indicates potential lateral movement or a widespread compromise and warrants higher urgency than an isolated single-endpoint hit. Option D (Asset Value/Business Criticality) is correct because triage weighs the criticality of the impacted asset, so an alert on a domain controller, database server, or regulated system outranks the same alert on a test workstation. Option E (Threat Intelligence Reputation Score) is correct because indicators matched against threat intel feeds carry a reputation score (e.g., known malicious IP, hash, or domain), letting analysts rank alerts by confidence that the activity is truly malicious. Option A (The color scheme of the SIEM dashboard) is not a prioritization attribute; it is a cosmetic UI setting with no bearing on risk. Option C (The time of day the alert was generated) is not a standard triage priority factor, since an alert's severity does not inherently change based on when it fired.

Answer

The color scheme of the SIEM dashboard

Answer

The time of day the alert was generated

Question 14

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

Accepted Answer

bytes_sent. The bytes_sent field is the correct focus because it directly quantifies the volume of data transmitted from the source to the external IP, which is the primary indicator of exfiltration volume. In Splunk, network flow logs and proxy logs typically include bytes_sent (or bytes_out) as a field representing outbound data transfer. Analyzing this field allows the analyst to identify anomalous large transfers to external IPs.

Answer

session_duration

Answer

source_port

Answer

packets_received

Question 15

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

Accepted Answer

Check the SIEM ingestion error logs for agent authentication issues.. When logs are missing but the agent is running and network is clear, the next logical step is to check the SIEM ingestion error logs for agent authentication issues. Authentication failures (e.g., expired certificates, wrong API keys, or account lockouts) commonly prevent log ingestion even when the agent appears healthy. This is a targeted diagnostic step before more drastic measures.

Answer

Reinstall the OS on the server.

Answer

Increase the server CPU.

Answer

Delete the server from the SIEM asset list.