312-39 Practice Test 15 — 15 Questions

Question 1

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Accepted Answer

Set status to 'Closed' with resolution code 'False Positive'. The correct action is to set the ticket status to 'Closed' with a resolution code of 'False Positive'. This documents that the alert was investigated, determined to be benign, and properly resolved, preserving an audit trail and enabling future tuning. Closing with a specific resolution code also feeds metrics for false positive rates and supports continuous improvement of detection rules.

Answer

Assign it to another team to verify

Answer

Ignore the ticket and let it expire

Answer

Delete the incident

Question 2

Which THREE actions should be taken after an indicator of compromise (IOC) is identified to ensure it is effectively used in a proactive detection program?

Accepted Answer

Configure the EDR to perform a 'Sweep' for historical occurrences of the IOC. Option A is correct because running a 'Sweep' in the EDR allows the organization to retroactively search historical endpoint telemetry for past occurrences of the IOC, which is essential for proactive detection and scoping any prior compromise. Option C is correct because validating the IOC against internal sandbox results confirms its malicious nature and reduces false positives before it is operationalized into detection logic. Option D is correct because adding the IOC to a SIEM watchlist enables real-time correlation and alerting against incoming log and event data, turning the IOC into continuous proactive monitoring. Option B is incorrect because publicly sharing an IOC on social media before internal investigation can tip off attackers, expose sensitive incident details, and is not part of a controlled detection program. Option E is incorrect because IOC age alone does not determine relevance; older IOCs can still be valuable for detecting long-dwell threats or recurring adversary infrastructure.

Answer

Share the IOC publicly on social media before internal investigation

Answer

Ignore the IOC if it is older than 30 days

Question 3

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

Accepted Answer

The rate of attempts compared to the attacker's potential speed.. When designing a SIEM rule to detect brute force attacks, the most important factor for the time window is the rate of attempts compared to the attacker's potential speed. Brute force attacks typically involve multiple failed login attempts within a short period. The time window must be set to capture this rate—too short and you miss slow attacks, too long and you get false positives from normal user errors. Aligning the window with the expected attack velocity ensures accurate detection.

Answer

The number of log sources in the SIEM.

Answer

The time of day the rule runs.

Answer

The disk space available in the SIEM.

Question 4

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

Accepted Answer

Isolate device. In Microsoft Defender for Endpoint, the 'Isolate device' action in the Device inventory dashboard cuts the endpoint off from the network while preserving the Defender communication channel, allowing the SOC to investigate and remediate without the malware communicating with its C2 or spreading laterally. This is the standard containment action for a suspected infected workstation.

Answer

Restrict application execution

Answer

Device tagging

Answer

Run antivirus scan

Question 5

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

Accepted Answer

Comparing source IP against threat intel feeds of VPN exit nodes. Comparing the source IP against threat intelligence feeds that catalog known VPN exit nodes, Tor relays, and anonymizing proxies is the most direct attribution technique. If the IP matches a commercial VPN provider's exit range, the analyst knows the true origin is masked and can pivot to other evidence (account metadata, timing, payload artifacts). This is a standard enrichment step in SOC workflows.

Answer

Analyzing DNS queries

Answer

Checking OS version

Answer

Scanning the source IP

Question 6

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) is the Sysinternals tool that captures real-time file system, registry, and network activity, showing exactly which files and registry keys a process touches. It provides detailed event properties including process name, PID, operation, path, result, and detail. This makes it the correct choice for observing a persistent malware process's interactions.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer

Question 7

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Accepted Answer

Perform frequency analysis (stack counting) on the command-line arguments across the environment. Frequency analysis (stack counting) on command-line arguments across the environment reveals whether the encoded PowerShell pattern is rare and anomalous or common and benign. Legitimate admin scripts tend to recur across many hosts with similar arguments, while malicious encoded commands often appear once or in small clusters. This technique is a core threat-hunting method for triaging suspicious command lines.

Answer

Enable verbose logging on all domain controllers

Answer

Run a full antivirus scan on the affected workstation

Answer

Reimage the host immediately to prevent lateral movement

Question 8

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Accepted Answer

Calculate a baseline of normal traffic volume and alert on deviations.. A static threshold like 500MB does not account for normal variations in traffic, leading to false positives or missed exfiltration. Calculating a baseline of normal traffic volume and alerting on deviations (e.g., using standard deviation or machine learning) improves accuracy by adapting to the environment's typical behavior. This is a core SIEM best practice for reducing noise and detecting anomalies.

Answer

Only alert on weekend traffic.

Answer

Disable alerts for file servers.

Answer

Lower the threshold to 50MB.

Question 9

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Accepted Answer

4104. Windows Event ID 4104 is generated by PowerShell's Script Block Logging feature and records the full text of executed script blocks, including obfuscated or dynamically constructed code. This makes it the primary event ID for reconstructing PowerShell-based attacks. Event ID 4104 appears in the 'Microsoft-Windows-PowerShell/Operational' log and is essential for detecting fileless malware and encoded command execution.

Answer

1102

Answer

4688

Answer

4624

Question 10

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (B) are a classic persistence artifact because an attacker can register a task that re-executes malware at logon, on a schedule, or at system startup, and defenders monitor task creation (e.g., Event ID 4698 and the \Windows\System32\Tasks folder) to detect it. Registry Run keys (D), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\...\Run, are monitored because any value placed there causes a program to launch automatically at user logon or system boot, a well-known autostart persistence location. System startup folder files (E), in paths like %AppData%\Microsoft\Windows\Start Menu\Programs\Startup and the all-users equivalent, are monitored because shortcuts or executables dropped there execute automatically at logon. Network interface throughput (A) is a performance/availability metric, not a persistence artifact, and browser history logs (C) reflect user web activity rather than mechanisms that ensure code re-executes after reboot or logon.

Answer

Network interface throughput

Answer

Browser history logs

Question 11

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Alert triage is the process of quickly assessing and prioritizing security alerts, and it includes verifying the alert's veracity (E) to confirm whether it is a true positive or a false positive before escalating. Determining the business impact of the affected asset (A) is essential because it helps analysts prioritize alerts based on the criticality and value of the asset to the organization. Gathering context from threat intelligence (D) is also a common triage step, as it enriches the alert with information about known threat actors, indicators of compromise, and tactics, techniques, and procedures (TTPs) to better understand the threat. Rebuilding the entire network (B) and replacing all passwords in the company (C) are not triage steps; they are drastic remediation actions that would only be considered after a confirmed incident and proper analysis, not during the initial alert triage phase.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 12

Which TWO methods are commonly used to achieve persistence on a Windows host?

Accepted Answer

Registry Run keys. Registry Run keys (option C) are a classic Windows persistence mechanism: entries placed under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run are automatically executed at user logon or system startup, allowing malware to survive reboots. Scheduled tasks (option E) provide persistence via the Task Scheduler service, where a task configured with a logon or startup trigger (or schtasks /create) re-launches the payload automatically, even across reboots. The remaining options do not establish persistence: changing the desktop wallpaper (A) is only a cosmetic modification, clearing the browser cache (B) is a cleanup action that removes data rather than maintaining execution, and disabling the firewall (D) weakens defenses but does not by itself ensure a program runs again after restart.

Answer

Changing the desktop wallpaper

Answer

Clearing browser cache

Answer

Disabling the firewall

Question 13

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Accepted Answer

Obtaining instructions from the threat actor. Option A is correct because the Command and Control (C2) phase is defined by the compromised host receiving tasking and instructions from the threat actor's C2 infrastructure, enabling the attacker to direct post-exploitation activity. Option C is correct because C2 specifically requires establishing and maintaining a persistent communication channel (often over HTTP/HTTPS, DNS, or other protocols) between the implant and the attacker-controlled server so commands and results can flow reliably. Option B is not a C2 goal; exploiting a zero-day vulnerability belongs to the initial exploitation phase that precedes C2. Option D is not a C2 goal; gathering system information is part of reconnaissance or discovery, which occurs before or alongside C2 but is not its defining objective. Option E is not a C2 goal; encrypting files for ransom is the impact/actions-on-objectives stage of ransomware, distinct from establishing command and control.

Answer

Exploiting a zero-day vulnerability

Answer

Gathering system information

Answer

Encrypting files for ransom

Question 14

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

Accepted Answer

Custom-tailored malware and tools. Option A is correct because APT actors develop custom-tailored malware, exploits, and tooling specific to the target environment rather than relying solely on commodity or off-the-shelf malware, which helps them evade signature-based detection. Option B is correct because APTs are defined by a long-term commitment to a specific objective, often persisting for months or years while pursuing espionage, intellectual property theft, or strategic access rather than a one-off hit. Option C is correct because APTs emphasize a high degree of stealth and low-and-slow activity, using techniques like living-off-the-land binaries, long dwell times, and minimal footprint to avoid triggering alerts. Option D is not correct because automated mass-scale scanning is characteristic of opportunistic, untargeted attacks (e.g., worms or botnet scanning), not the deliberate, targeted reconnaissance of an APT. Option E is not correct because immediate data destruction is not a defining APT trait; APTs typically prioritize stealthy, prolonged access and exfiltration, and destructive actions (if any) usually come at the end of the campaign.

Answer

Automated mass-scale scanning

Answer

Immediate data destruction

Question 15

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

Accepted Answer

Increasing alert thresholds.. Option C (Increasing alert thresholds) is correct because raising the trigger values for rules means low-severity or borderline events no longer generate alerts, directly cutting the number of notifications analysts receive. Option E (Suppression of known-safe, noisy activity) is correct because creating suppression rules or exceptions for confirmed benign, high-frequency events (e.g., vulnerability scanners, backup jobs) prevents those events from firing alerts while preserving the underlying log data. Option A (Renaming the alert labels) only changes display text and does not reduce how many alerts are generated. Option B (Changing the password of the SIEM admin) is a security/account-management action with no effect on alert volume. Option D (Deleting all historical logs) destroys audit and forensic data and does not reduce the rate of new alerts being produced.

Answer

Renaming the alert labels.

Answer

Changing the password of the SIEM admin.

Answer

Deleting all historical logs.