312-39 Practice Test 16 — 15 Questions

Question 1

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

Accepted Answer

User identity and department information.. Option A is correct because user identity and department information are classic contextual enrichment fields that let a SIEM correlate an alert to a specific person, role, and business unit, which helps assess intent and blast radius. Option B is correct because asset criticality and ownership provide business context that determines how urgently an alert should be triaged and who must be notified, directly influencing risk scoring. Option D is correct because threat intelligence reputation scores enrich indicators (IPs, domains, hashes) with known maliciousness, letting the SIEM prioritize alerts tied to known-bad infrastructure. Option C does not belong because data center weather is not a standard security-relevant contextual attribute for alert enrichment. Option E does not belong because the security team's lunch menu has no bearing on alert triage, risk, or investigation.

Answer

The weather in the data center.

Answer

The lunch menu of the security team.

Question 2

Which TWO pieces of information are critical to include in an initial incident ticket?

Accepted Answer

Affected systems/users. Option A, affected systems/users, is correct because an initial incident ticket must scope the blast radius—identifying which hosts, applications, or user accounts are impacted so responders can prioritize containment and assess business impact. Option D, source of the alert, is correct because documenting where the detection originated (e.g., SIEM correlation rule, EDR alert, IDS signature, or user report) establishes the evidence trail and helps analysts validate the finding and tune detection logic. The remaining options do not belong: the analyst's salary (B) is irrelevant HR data, the server rack color (C) is a physical detail with no bearing on triage, and the CEO's name (E) is not needed unless they are specifically an affected user or stakeholder, which the option does not state.

Answer

The salary of the analyst

Answer

The color of the server rack

Answer

Name of the CEO

Question 3

Which THREE elements are essential in an incident notification email to senior management?

Accepted Answer

Business impact assessment. A is correct because a business impact assessment tells senior management how the incident affects operations, revenue, customers, or compliance, which is the primary concern for executive decision-making. C is correct because a high-level summary gives leadership a concise, non-technical understanding of what happened, when it was detected, and its current status without overwhelming them with operational detail. E is correct because expected next steps and a timeline set expectations for containment, eradication, recovery, and communication, enabling management to allocate resources and manage stakeholder messaging. B is not appropriate because the attacker's personal phone number is irrelevant, likely unavailable, and not actionable for management. D is not appropriate because a full raw packet dump is highly technical, voluminous, and belongs in forensic evidence handling rather than an executive notification email.

Answer

The personal phone number of the attacker

Answer

The full raw packet dump

Question 4

A SOC manager at a financial services company is preparing an audit defense for a recent data breach. The auditor asks for documented proof of how the SOC's daily operational activities align with the organization's overall business objectives and risk appetite. Which component of a SOC governance framework should the manager present to satisfy this request?

Accepted Answer

A SOC charter that defines the mission, scope, authority, and reporting lines approved by executive leadership. A SOC charter is the foundational governance document that ties the SOC's purpose, scope, and authority to executive-approved business objectives and risk appetite. Auditors use it to verify that monitoring activities are intentional and sponsored at the highest level. Operational artifacts such as rule lists, rosters, or scan reports describe activity but cannot demonstrate strategic alignment or executive accountability.

Answer

A vulnerability scan report listing unpatched systems across the corporate network

Answer

A raw export of SIEM correlation rules and their last-modified timestamps

Answer

A weekly shift roster showing analyst coverage across all three SOC tiers

Question 5

A SOC analyst receives a Microsoft Defender for Endpoint alert indicating a suspicious PowerShell script executed on a finance workstation. The script attempted to download a file from an external IP. The alert severity is 'High'. According to the incident detection and triage process, what should the analyst do FIRST?

Accepted Answer

Validate the alert by reviewing the script's content, parent process, and user context.. The initial step in incident detection and triage is to validate the alert by examining the script's content, parent process, and user context. This determines whether the alert is a true positive and informs subsequent actions. Validation prevents premature containment or escalation, which can disrupt operations or waste resources. Only after validation should the analyst consider containment, evidence collection, or escalation based on the confirmed threat.

Answer

Collect and preserve volatile evidence such as memory and network connections before any containment.

Answer

Escalate the alert to the incident response team immediately due to its high severity.

Answer

Immediately isolate the workstation from the network to prevent potential lateral movement.

Question 6

An analyst is reviewing a packet capture and observes periodic, fixed-interval HTTPS sessions from an internal host to a single external IP, each transferring roughly the same small number of bytes. The destination has no reputation data, and the certificate is self-signed. Which IOC category and interpretation best fits this observation?

Accepted Answer

Network-based IoC indicating beaconing to a command and control server. Regular, fixed-interval sessions of near-constant size to an unknown IP with a self-signed certificate indicate beaconing to C2. Because the evidence is observed in network traffic, it is a network-based IoC. The other categories either misclassify the evidence source or describe activity that would produce entirely different artifacts.

Answer

File-based IoC indicating a ransomware encryption routine

Answer

Email-based IoC indicating a phishing campaign

Answer

Host-based IoC indicating a scheduled software update

Question 7

A SOC analyst receives an alert for suspicious PowerShell execution on a workstation. During triage, the analyst observes the command line: `powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. The endpoint's EDR shows the parent process as `winword.exe`. Which of the following BEST describes the immediate triage priority?

Accepted Answer

Immediately isolate the workstation from the network and initiate the incident response process.. The scenario presents a classic malware execution chain: a Microsoft Word document spawning a hidden, encoded PowerShell command. This is a high-fidelity indicator of compromise, and the immediate triage priority is to contain the threat by isolating the affected workstation. Decoding the payload, tracing the email, or running antivirus scans are subsequent steps that, while important, do not address the urgent risk of an active adversary on the network.

Answer

Run a full antivirus scan on the workstation to remove the malicious payload.

Answer

Decode the Base64 string to understand the payload, then decide whether to isolate the host.

Answer

Check the user's recent email activity to identify the source of the document and then block the sender.

Question 8

A SOC analyst is reviewing a phishing alert where the user reported an email with a malicious attachment. The analyst confirms the attachment's hash matches a known malware family in the threat intelligence platform. The user states they did not open the attachment. What is the MOST appropriate triage outcome?

Accepted Answer

Classify as a suspicious true positive, verify no execution occurred on the endpoint, and search for other recipients of the same email.. A known-malicious attachment that was reportedly not opened represents a suspicious true positive rather than a confirmed compromise. The analyst should validate the non-execution claim using endpoint telemetry and hunt for other recipients to determine campaign scope. This approach keeps the investigation accurate and proportionate to the evidence.

Answer

Quarantine the user's mailbox and reset their password to prevent credential theft.

Answer

Escalate as a confirmed incident because the malicious attachment reached the user's mailbox.

Answer

Close the alert as benign because the user did not open the attachment.

Question 9

A SOC analyst is triaging a potential phishing incident. An employee reported a suspicious email with an attachment. The analyst has retrieved the email and attachment. Which TWO of the following actions are MOST appropriate during the initial triage to determine if the attachment is malicious? (Choose two.)

Accepted Answer

Open the attachment in a sandboxed environment to observe its behavior.. During initial triage of a suspicious email attachment, the analyst should focus on safe analysis methods. Submitting the hash to a threat intelligence platform provides quick reputation data without execution risk. Sandboxing the attachment allows dynamic observation of its behavior in an isolated environment. These actions help determine maliciousness while preserving evidence and avoiding infection of production systems.

Answer

Execute the attachment on the analyst's workstation to see if it triggers antivirus.

Answer

Delete the email from the user's mailbox immediately.

Answer

Forward the email to all employees as a warning.

Question 10

A SOC is designing a log management pipeline to ingest Windows Event Logs, Syslog from network devices, and application logs into a SIEM. The team needs to ensure that timestamps are consistent across all sources for accurate correlation. Which TWO practices are most effective for achieving time synchronization and accurate event ordering? (Choose two.)

Accepted Answer

Configure all log sources to use NTP with authenticated time sources to maintain accurate clocks.. Accurate time synchronization and normalization are essential for correlating events across heterogeneous log sources. NTP with authentication ensures clocks are aligned, while normalizing to UTC provides a consistent reference. Together, they enable the SIEM to order events correctly and correlate activity across Windows, syslog, and application logs, which is critical for incident detection and forensic analysis.

Answer

Configure log sources to send logs only when their clocks are within 1 second of the SIEM's clock.

Answer

Use the SIEM's internal ingestion timestamp as the primary event time for all logs.

Answer

Enable high-precision timestamps with nanosecond granularity on all log sources.

Question 11

A SOC analyst is proactively hunting for beaconing activity that indicates command-and-control (C2) communication. The analyst wants to identify network flows that show regular, periodic connections to external IPs. Which TWO data sources and analysis methods should the analyst use to detect this behavior? (Choose two.)

Accepted Answer

Proxy logs analyzed for repeated requests to the same external domain at consistent intervals. Beaconing is characterized by regular, periodic connections to the same external destination. Proxy logs and NetFlow both provide timestamped records that can be aggregated to reveal consistent intervals and repeated destinations. Packet capture certificate analysis, noisy WFP events, and NXDOMAIN monitoring target different behaviors and do not efficiently expose the periodic callback pattern.

Answer

DNS server debug logs analyzed for NXDOMAIN responses to random subdomains

Answer

Full packet capture analyzed for unique TLS certificate subjects on every connection

Answer

Windows Security event log 5156 analyzed for allowed connections to external IPs

Question 12

A SOC analyst is reviewing a threat intelligence report that includes indicators of compromise. The analyst wants to proactively use these IOCs to detect future attacks. Which action best leverages the IOCs for detection?

Accepted Answer

Add the IOCs to the SIEM as correlation rules and monitor for matches in real time.. The most effective way to proactively use IOCs is to operationalize them in detection systems. Adding them to the SIEM as correlation rules allows continuous monitoring and immediate alerting when an indicator is observed. This transforms threat intelligence into actionable detection, enabling the SOC to respond quickly to known threats.

Answer

Share the IOCs with other organizations through an ISAC and wait for them to report hits.

Answer

Store the IOCs in a spreadsheet and manually search for them during incident response.

Answer

Block all traffic to and from the IOC IP addresses at the firewall only.

Question 13

A SOC analyst is triaging a security alert generated by the SIEM. The alert indicates that a workstation attempted to connect to a known malicious IP address on port 443. The analyst verifies that the workstation's user recently received a phishing email. Which of the following should the analyst do FIRST to contain the potential incident?

Accepted Answer

Isolate the workstation from the network.. The correct first step is to isolate the workstation. This immediately stops any ongoing malicious communication and prevents the threat from spreading. Other actions like antivirus scans or user contact are important but secondary to containment. Blocking the IP at the firewall may help but is not as thorough as isolating the endpoint. Isolation is a fundamental containment tactic in incident response.

Answer

Run a full antivirus scan on the workstation.

Answer

Block the malicious IP at the firewall.

Answer

Contact the user to ask if they opened the phishing email.

Question 14

During an incident response, a SOC analyst examines a Windows host and finds that the 'Image Path Name' for a service named 'UpdaterSvc' points to 'C:\Windows\Temp\svc.exe'. The service is set to start automatically and runs as LocalSystem. The file 'svc.exe' is unsigned and has a creation timestamp from yesterday. Which persistence technique is most likely in use?

Accepted Answer

New Windows service creation. The service configuration with an ImagePath to an unsigned binary in a Temp directory, set to auto-start as LocalSystem, is a strong indicator of persistence through Windows service creation. Attackers frequently create malicious services to maintain elevated access across reboots. This technique is detectable by monitoring the Services registry key and service creation events. Other persistence methods like Run keys or scheduled tasks would leave different artifacts.

Answer

Scheduled task with a hidden trigger

Answer

Windows Management Instrumentation (WMI) event subscription

Answer

Registry Run key

Question 15

A SOC analyst is triaging a SIEM alert for a potential data exfiltration attempt. The alert shows a large outbound transfer to an unknown IP address from a database server. The analyst needs to determine if this is malicious or benign. Which of the following actions is MOST appropriate to perform FIRST?

Accepted Answer

Check the reputation of the destination IP using threat intelligence feeds.. The most appropriate first action is to check the reputation of the destination IP using threat intelligence. This provides immediate context on whether the IP is known for malicious activity, helping to quickly determine if the alert is a true positive. Other actions like blocking or contacting the administrator are either containment or verification steps that should follow initial validation. This approach balances speed and accuracy in triage.

Answer

Block the outbound connection at the firewall to stop the exfiltration.

Answer

Analyze the volume and frequency of the transfer compared to baseline traffic.

Answer

Contact the database administrator to ask if the transfer was authorized.