312-39 Practice Test 17 — 15 Questions

Question 1

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to examine logs from a Cisco ASA firewall to identify outbound connections that may have transferred sensitive data. Which syslog severity level should the analyst configure on the ASA to capture connection-related events while minimizing log volume?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Severity level 6 (Informational). Cisco ASA syslog severity level 6 (Informational) includes connection-related messages such as built and teardown events, which are vital for tracking outbound connections during a data exfiltration investigation. Higher levels like 7 add excessive debugging noise, while lower levels like 4 or 3 omit these informational events. Therefore, level 6 provides the necessary balance of detail and volume.

Answer

Severity level 4 (Warnings)

Answer

Severity level 7 (Debugging)

Answer

Severity level 3 (Errors)

Question 2

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

Accepted Answer

Rebooting may cause data loss in volatile memory. Disconnecting the host from the network immediately isolates the ransomware, preventing lateral movement and further encryption of shared resources. Rebooting, however, wipes volatile memory (RAM), which contains critical forensic evidence such as encryption keys, running processes, and network connections. Preserving this volatile data is essential for incident response, as it can help decrypt files or identify the attack vector. Therefore, network isolation is prioritized over rebooting to avoid losing this valuable information.

Answer

Rebooting takes too long

Answer

Rebooting resets the firewall

Answer

Rebooting alerts the attacker

Question 3

A SOC analyst is reviewing DNS logs and observes a workstation issuing hundreds of unique subdomain queries under the domain telemetry-sync[.]net, each returning an NXDOMAIN response within seconds. No matching HTTP traffic appears in the proxy logs. Which attack technique is most consistent with this pattern?

Accepted Answer

Domain generation algorithm (DGA) activity. The combination of a high volume of unique subdomain queries, automated rapid timing, and mostly failed resolutions is the signature of domain generation algorithm activity, where malware cycles through algorithmically produced domains seeking a live command-and-control endpoint. DNS tunneling and exfiltration both require successful resolution and encoded payloads, and fast flux manipulates IP rotation rather than subdomain generation.

Answer

Fast flux DNS used to hide phishing infrastructure

Answer

DNS exfiltration of sensitive files

Answer

DNS tunneling used for command and control

Question 4

In a SIEM, what is the role of a 'Parser'?

Accepted Answer

To extract fields and normalize log data.. A parser in a SIEM is the component that ingests raw log events from heterogeneous sources (firewalls, servers, applications) and breaks each event into structured fields (timestamp, source IP, user, event type) using regex, delimiters, or key-value extraction. It then normalizes those fields into a common schema (e.g., ECS or CIM) so correlation rules and dashboards can query across all sources consistently. Without parsing/normalization, the SIEM would only have unstructured text and could not reliably correlate events.

Answer

To print reports.

Answer

To encrypt log files.

Answer

To scan for viruses.

Question 5

Which THREE actions are part of the 'Recovery' phase?

Accepted Answer

Monitoring for reinfection. The 'Recovery' phase of incident response focuses on returning affected systems to normal operation safely after the threat has been contained and eradicated. Option D (Restoring from clean backups) is correct because recovery commonly involves rebuilding or restoring systems from known-good backups that are free of the attacker's artifacts. Option E (Validating system integrity) is correct because before returning systems to production, analysts must verify that no malicious code, unauthorized changes, or persistence mechanisms remain. Option A (Monitoring for reinfection) is correct because after restoration, heightened monitoring confirms the threat has not returned and that recovery was successful. Option B (Increasing the analyst's pay) is incorrect because compensation is an HR matter, not an incident response recovery action. Option C (Deleting the original ticket) is incorrect because incident documentation and tickets must be retained for auditing, lessons learned, and legal purposes, not deleted during recovery.

Answer

Increasing the analyst's pay

Answer

Deleting the original ticket

Question 6

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Accepted Answer

Incident Review dashboard. The Incident Review dashboard in Splunk Enterprise Security is the primary triage workspace where notable events are displayed alongside their associated threat intelligence, risk scores, and MITRE ATT&CK annotations. When investigating a brute-force-then-successful-login pattern, analysts use Incident Review to see the full context of the notable event, including which ATT&CK technique (e.g., T1110 Brute Force, T1078 Valid Accounts) the correlation search mapped it to. This dashboard is purpose-built for first-responder verification and incident workflow.

Answer

Threat Intelligence dashboard

Answer

Access Anomalies dashboard

Answer

User Activity Monitoring

Question 7

A SOC analyst is investigating a security incident in an AWS environment. The analyst needs to determine which AWS API calls were made by a specific IAM user over the past week. Which AWS service should the analyst use to retrieve this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that logs all API activity in an AWS account, capturing details such as the caller identity, timestamp, source IP, and request parameters. By querying CloudTrail event history or delivering logs to S3, a SOC analyst can filter by IAM user and time range to see exactly which API calls were made. Other services like GuardDuty or Security Hub provide derived findings but not the raw audit trail needed for this investigation.

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Answer

AWS Config

Question 8

Which THREE tools are typically used for forensic memory analysis?

Accepted Answer

Volatility. Volatility (A) is the canonical open-source framework for parsing RAM captures, using profiles/symbol tables to extract processes, network connections, and injected code from memory images. Rekall (C) is a memory forensics framework derived from Volatility that provides similar plugins for analyzing physical memory dumps and live memory. MemProcFS (D) is a memory forensics tool that exposes a RAM dump as a virtual file system, enabling direct inspection of processes, drivers, and registry hives in memory. Nmap (B) is a network port scanner used for host discovery and service enumeration, not memory analysis, and Wireshark (E) is a packet capture/analysis tool for network traffic, so neither operates on memory images.

Answer

Nmap

Answer

Wireshark

Question 9

A SOC team is reviewing Azure activity logs and notices a series of role assignments being created for a service principal. The assignments grant Owner permissions at the subscription scope. The team needs to identify the exact operation name and the caller's IP address to determine if this is malicious. Which Azure log should they query?

Accepted Answer

Azure Activity Log. The Azure Activity Log is the correct source because it logs all control plane operations at the subscription level, including role assignment creations. It includes the operation name, caller identity, and caller IP address. By filtering for role assignment write operations, the SOC team can identify the exact operation and source IP, enabling them to determine if the service principal's actions are unauthorized.

Answer

Azure Monitor Metrics

Answer

Azure Network Watcher Flow Logs

Answer

Azure AD Sign-in Logs

Question 10

A SOC analyst is tasked with improving the incident response process. The analyst proposes several changes to the current workflow. Which TWO changes would most directly enhance the efficiency of incident handling? (Choose two.)

Accepted Answer

Implementing automated playbooks for common incident types. Automated playbooks and a formal escalation matrix directly streamline incident response by reducing manual effort and clarifying communication paths. Automation speeds up containment and remediation, while an escalation matrix ensures timely involvement of the right experts. The other options either increase workload, reduce visibility, or add unnecessary overhead, which would not improve efficiency.

Answer

Requiring all analysts to manually document every alert, including false positives

Answer

Reducing the number of log sources to decrease alert volume

Answer

Increasing the number of SIEM correlation rules without tuning

Question 11

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Accepted Answer

Threat Hunter and Tier 2/3 Analyst. Threat hunters and Tier 2/3 analysts need frequent communication to pivot between tactical and strategic investigations.

Answer

SOC Manager and IT Support

Answer

Tier 1 Analyst and Compliance Officer

Answer

SOC Manager and HR

Question 12

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

Accepted Answer

Alert aggregation. Alert aggregation (A) is correct because grouping related alerts from the same host, user, or campaign into a single incident reduces the number of individual notifications analysts must triage, directly lowering fatigue. Suppression of known-good patterns (C) is correct because whitelisting or suppressing alerts triggered by verified benign activity (e.g., scheduled scans, trusted admin tools) eliminates recurring false positives that waste analyst time. Rule tuning based on historical data (D) is correct because adjusting detection thresholds, correlation logic, and signatures using past alert outcomes (true/false positive rates) raises the signal-to-noise ratio and improves alert fidelity. Removing SOC Tier 1 analysts (B) is not a technique for improving alert quality—it eliminates a triage layer and worsens response capability rather than reducing fatigue. Increasing the volume of log ingestion (E) does not improve alert quality; without better correlation and tuning, more logs typically produce more noise and more fatigue.

Answer

Removing the SOC Tier 1 analysts

Answer

Increasing the volume of log ingestion

Question 13

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

Accepted Answer

Document the exception in the SIEM's rule documentation.. When a SIEM alert is confirmed as a false positive due to legitimate administrative activity, the correct action is to document the exception in the SIEM's rule documentation. This ensures that the rule is refined to reduce future false positives, and provides an audit trail for why the alert was closed without escalation. Documenting the exception helps maintain the integrity of the detection logic and supports continuous tuning of the SIEM.

Answer

Delete the user account.

Answer

Disable the user's access entirely.

Answer

Ignore the alert and proceed.

Question 14

During triage of a SIEM alert indicating multiple failed VPN authentications followed by a successful login for the same account within five minutes, the analyst must classify the event. Which classification is MOST appropriate at this stage?

Accepted Answer

Suspicious true positive requiring further investigation, because the pattern matches brute force or credential stuffing.. Repeated authentication failures immediately followed by a success is a recognized indicator of brute force or credential stuffing. The appropriate triage classification is a suspicious true positive that requires enrichment, such as checking source IP reputation and confirming with the user. Dismissing it as a typo or informational event would ignore a plausible account compromise.

Answer

Benign true positive, because the user simply mistyped their password before succeeding.

Answer

False positive, because the SIEM rule thresholds are too low and generate noise.

Answer

Informational, because successful authentication means no security impact occurred.

Question 15

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

Accepted Answer

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/. syslog-ng destination paths support template macros such as $HOST, $YEAR, $MONTH, $DAY, and $PROGRAM, which are expanded at runtime for each message. Using /var/log/$HOST/$YEAR/$MONTH/ dynamically creates per-host directories, satisfying the requirement to separate logs by hostname without manual configuration.

Answer

Defining separate log paths for every individual IP address

Answer

Configuring the global log_level to debug

Answer

Using hardcoded static path strings only