312-39 Practice Test 15 — 15 Questions

Question 1

Which TWO steps are part of the 'Preparation' phase of the incident response process?

Accepted Answer

Training personnel. Having tools and policies in place is what preparation is all about.

Answer

Writing the final report

Answer

Containment of the breach

Answer

Root cause analysis

Question 2

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

Accepted Answer

Extracting fields using Regex during the ingestion pipeline. Normalization is typically achieved through parsing and schema mapping to a common model like ECS or CEF.

Answer

Deleting all incoming log metadata

Answer

Increasing the network MTU size

Answer

Running a brute-force attack on the log file

Question 3

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Accepted Answer

Network traffic logs showing SMB/RDP connections between workstations. Success/Failure logs and network connection logs are essential for detecting lateral movement attempts.

Answer

System clock synchronization logs

Answer

Application logs for Microsoft Word

Answer

Browser cache logs

Question 4

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Accepted Answer

MSSP. Managed Security Service Provider (MSSP) models allow outsourcing while maintaining operational oversight.

Answer

Virtual SOC

Answer

Internal SOC

Answer

Hybrid Cloud SOC

Question 5

A ticket is assigned to you with high priority. What is the first thing you should do?

Accepted Answer

Verify the alert and scope the incident. Verify the alert's validity to ensure it is not a false positive before proceeding with full containment.

Answer

Call the CISO

Answer

Isolate the host immediately

Answer

Email the user

Question 6

Which TWO types of logs are most useful for detecting lateral movement?

Accepted Answer

Windows Event Log (Logon events). Authentication logs (logons) and network traffic (NetFlow/SMB) are the primary indicators of lateral movement.

Answer

System temperature logs

Answer

Application log

Answer

Printer spooler logs

Question 7

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Accepted Answer

Regulatory compliance requirements (e.g., GDPR, HIPAA). Compliance requirements, storage costs, and incident investigation timelines are the primary drivers for retention.

Answer

The color of the hardware chassis

Answer

The time of day the backup is scheduled

Question 8

You are investigating a suspicious login. Which attribute in the Azure AD sign-in logs helps determine if the user successfully authenticated using MFA?

Accepted Answer

MFA Result. The 'Authentication Requirement' or 'MFA Result' fields in Azure AD logs detail the MFA challenge status.

Answer

Device ID

Answer

Risk State

Answer

Conditional Access Status

Question 9

Which THREE factors should be considered when determining the severity level of an incident?

Accepted Answer

Business impact. Impact, urgency, and the sensitivity of the data define severity.

Answer

The analyst's mood

Answer

The day of the week

Question 10

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

Accepted Answer

TCP. TCP provides a three-way handshake and acknowledgment, making it more reliable than UDP for log delivery.

Answer

UDP

Answer

ICMP

Answer

ARP

Question 11

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Accepted Answer

Process access requests to lsass.exe from an unauthorized or unsigned process. Accessing the memory space of lsass.exe is the standard indicator of credential dumping tools like Mimikatz.

Answer

Failed login attempts to the local administrator account

Answer

Increased CPU usage on the Domain Controller

Answer

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

Question 12

What is the primary benefit of using a centralized logging server compared to local logging?

Accepted Answer

Simplified log correlation and incident response. Centralization simplifies management, enables correlation, and provides a single point of backup.

Answer

Increased disk space on the local server

Answer

Eliminating the need for a security policy

Answer

Faster network traffic speeds

Question 13

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

Accepted Answer

Managing high volumes of 'noise' logs that lack security value. Scalability, data volume/noise, and bandwidth management are the primary operational challenges.

Answer

Reducing the number of employees in the IT department

Answer

Increasing the physical size of the office building

Question 14

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Accepted Answer

Windows Event Log - PowerShell Script Block Logging (Event ID 4104). Script Block Logging (Event ID 4104) captures the full, de-obfuscated script content, making it the gold standard for PowerShell analysis.

Answer

Disk forensic analysis of the user's browser history

Answer

Windows Security Log - Process Creation (Event ID 4688)

Answer

Network firewall traffic logs for port 5985

Question 15

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Accepted Answer

Correlation Rule Threshold. A threshold configuration with a count and a time window is the standard approach for rate-limiting alerts.

Answer

Event Parser Configuration

Answer

Aggregation Key

Answer

Suppression Window