312-39 Practice Test 14 — 15 Questions

Question 1

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

Accepted Answer

A compromised host attempting to reach a C2. A sinkhole IP is a controlled address that security teams or law enforcement redirect malicious traffic to, typically to neutralize botnet C2 communications. When an internal host repeatedly attempts to contact a known sinkhole IP, it strongly indicates the host is infected with malware that is trying to reach its command-and-control server. This is a classic indicator of compromise (IoC) for a C2 channel.

Answer

An attempted DDoS attack

Answer

A network misconfiguration

Answer

A successful data exfiltration

Question 2

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Accepted Answer

Unauthorized access attempt. Multiple failed login attempts followed by a successful login from an unknown IP is a textbook indicator of unauthorized access — specifically a brute-force or password-spraying attack that eventually succeeded. This pattern is categorized as an unauthorized access attempt IoC because it shows an attacker gained access without authorization. The sequence of failures then success is the key signature.

Answer

Data exfiltration indicator

Answer

Network anomaly signature

Answer

System resource exhaustion

Question 3

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Option A is correct because indicators have a limited useful lifetime; automating expiration according to the intelligence aging policy prevents stale IOCs (e.g., old malicious IPs or domains) from generating false positives and keeps detections actionable. Option C is correct because normalizing feeds into the SIEM's schema (mapping fields such as IP, hash, domain, and timestamps to a common taxonomy like STIX/TAXII or the platform's data model) makes indicators correlatable and searchable across heterogeneous sources. Option D is correct because filtering indicators irrelevant to the current technology stack (e.g., macOS malware hashes on an all-Windows estate, or unsupported protocols) reduces noise and ensures analysts focus on threats that can actually affect the environment. Option B is not appropriate because dumping raw feeds into an unindexed archive makes the data unsearchable and unusable for real-time detection, defeating the purpose of actionable intelligence. Option E is incorrect because setting an infinite TTL on IP indicators guarantees indefinite false positives, since IP addresses are frequently reassigned and threat infrastructure changes rapidly.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 4

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Beaconing malware typically communicates with a command-and-control (C2) server at regular intervals, resulting in low variance in the time deltas between connections. Normal user traffic is more random. Analyzing the variance (or standard deviation) of inter-connection times can reveal this periodicity, making it the most reliable statistical method.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 5

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Accepted Answer

AWS Security Hub. AWS Security Hub is a centralized security and compliance service that aggregates findings from multiple AWS services and partner tools, providing a dashboard to identify misconfigurations and security issues across an organization. It runs automated checks against best practices and standards like CIS AWS Foundations and AWS Foundational Security Best Practices.

Answer

AWS Artifact

Answer

AWS Shield

Answer

AWS Trusted Advisor

Question 6

Which document is essential for recording every action taken during an incident for legal and audit purposes?

Accepted Answer

Incident Response Log/Journal. An Incident Response Log (or journal) is the chronological record of every action, decision, timestamp, and evidence-handling step taken during an incident. It is the primary document used for legal defensibility, audit trails, chain-of-custody, and post-incident review. Without it, an organization cannot prove due diligence or reconstruct the timeline for regulators or courts.

Answer

Change Management Request

Answer

System Configuration Document

Answer

Business Continuity Plan

Question 7

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Accepted Answer

Enable global service events. Option A (Enable global service events) is correct because it ensures CloudTrail captures API activity from global services such as IAM, STS, and CloudFront, which are logged only in the us-east-1 region; without it, critical identity and access events would be missing from the audit trail. Option B (Enable Log File Integrity) is correct because it makes CloudTrail produce digest files with SHA-256 hashes and RSA digital signatures, allowing you to verify that log files have not been altered or deleted after delivery, which is essential for a tamper-evident security audit. Option C is wrong because disabling SNS notifications removes timely alerting on log delivery and is not a security best practice. Option D is wrong because limiting logs to one region would exclude API activity from other regions, weakening audit coverage. Option E is wrong because CloudTrail logs should be encrypted with AWS KMS (SSE-KMS) or SSE-S3, not a public key, which would be inappropriate for protecting log confidentiality.

Answer

Disable SNS notifications

Answer

Limit logs to one region

Answer

Encrypt logs with a public key

Question 8

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

Accepted Answer

Restrict the search to a specific time range and relevant indexes.. Restricting the search to a specific time range and relevant indexes is the correct optimization because SIEM queries scan indexed data, and the volume of data scanned is the primary driver of query latency. By narrowing the time window (e.g., last 24 hours instead of 30 days) and targeting only indexes that contain the relevant log sources, the SIEM engine reads far fewer events and returns results much faster. This is the standard performance-tuning technique in Splunk, Elastic, Sentinel, and QRadar.

Answer

Use wildcard searches on all fields.

Answer

Add more fields to the search result.

Answer

Increase the search timeout.

Question 9

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

Accepted Answer

Defines the time period for analyzing events.. A lookback window in a SIEM correlation rule defines how far back in time the engine examines events when evaluating the rule's conditions. It determines the time period over which related events are correlated, such as counting failed logins within the last 10 minutes. Without a lookback window, the rule would have no temporal boundary for matching events.

Answer

Selects the log source vendor.

Answer

Determines the color of the alert.

Answer

Sets the alert expiration date.

Question 10

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Accepted Answer

Joins allow matching records between two datasets based on a common field.. A join in KQL combines rows from two tables based on a matching key, such as correlating a SecurityEvent's Account field with SigninLogs' UserPrincipalName. This allows the rule to detect lateral movement by linking authentication events with sign-in activity on a common identifier. Union, by contrast, simply appends rows and does not match records.

Answer

Unions only support structured data.

Answer

Joins consume less memory than unions.

Answer

Unions cannot be used in detection rules.

Question 11

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

Accepted Answer

System event logs (Event ID 4698). Windows Security event log Event ID 4698 is generated when a scheduled task is created, making it the correct artifact to identify tasks created within the last 24 hours. Filtering the Security log for 4698 and the relevant time window directly answers the hunt question.

Answer

Registry 'Run' keys

Answer

Application event logs

Answer

Security event logs (Event ID 4624)

Question 12

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

Accepted Answer

Get-SmbSession. Get-SmbSession is a PowerShell cmdlet in Windows that lists active SMB sessions on a machine, showing which clients are connected, the user account, and the number of open files. It directly answers the question of viewing active SMB sessions between workstations during a lateral movement investigation.

Answer

wmic

Answer

tasklist

Answer

ipconfig

Question 13

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

Accepted Answer

Managing high volumes of 'noise' logs that lack security value. Option B is correct because centralized log management in a large enterprise ingests telemetry from many sources, and a large proportion of those events are low-value or duplicate 'noise' logs (e.g., routine debug, verbose application chatter) that must be filtered, tuned, or dropped to keep the SIEM useful. Option C is correct because shipping raw log streams from hundreds or thousands of hosts, appliances, and cloud services to a central collector consumes significant network bandwidth, and without compression, batching, or filtering this can saturate WAN or inter-DC links. Option D is correct because the aggregator/indexer tier (e.g., syslog relays, Kafka brokers, Elasticsearch clusters) must be sized and horizontally scaled to absorb peak ingestion rates and query loads, which is a well-known operational challenge. Option A is not a challenge of centralized log management; log centralization is about collection, correlation, and retention, not headcount reduction. Option E is unrelated, since log management concerns logical data storage and network capacity, not the physical dimensions of office space.

Answer

Reducing the number of employees in the IT department

Answer

Increasing the physical size of the office building

Question 14

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

Accepted Answer

Log Aggregator. The Log Aggregator is the central component in a log management architecture that collects log data from multiple sources (e.g., servers, firewalls, applications) and normalizes it into a consistent format before storing it. Normalization ensures that disparate log formats (syslog, JSON, Windows Event Log) can be uniformly searched and analyzed. This is a core function of aggregation, distinguishing it from mere collection or storage.

Answer

End-user Workstation

Answer

Log Source

Answer

Database Engine

Question 15

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

Accepted Answer

UPN. The User Principal Name (UPN) is a unique, user-centric identifier (typically formatted like an email address) that remains consistent across platforms, making it the most reliable field for correlating a single user's activity across SIEM and EDR data sources. Unlike IP addresses or device names, the UPN does not change when the user moves between hosts or networks. This makes it the anchor field for identity-based correlation.

Answer

Timestamp

Answer

Device Name

Answer

Source IP