312-39 Practice Test 18 — 15 Questions

Question 1

A SOC analyst is investigating a potential insider threat. The SIEM generated an alert for unusual file access on a file server by a user who normally works in a different department. The analyst needs to gather more context. Which of the following is the MOST appropriate action to take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the user's recent login history and accessed files to establish a pattern.. For insider threat triage, the most appropriate action is to review the user's recent login history and accessed files to establish a pattern. This helps determine if the unusual file access is part of a legitimate business need or malicious activity. Other actions like disabling the account or confronting the user are premature without validation and could have negative consequences. Context gathering is key.

Answer

Confront the user directly about the suspicious activity.

Answer

Disable the user's account immediately to prevent further access.

Answer

Check if the user has recently transferred to a new role that requires access.

Question 2

A SOC analyst has acquired a forensic image of a compromised Windows host. To establish a defensible timeline of attacker activity, the analyst needs to place file system timestamps into a consistent, sortable sequence. Which step is essential before correlating timestamps across artifacts?

Accepted Answer

Normalize all timestamps to a common time zone and note clock offsets between the host and the analyst's reference time. A reliable timeline requires all timestamps to be expressed in a common time zone with documented corrections for clock skew between the suspect host and a trusted reference. Hash recalculation, rebooting the image, and format conversion do not address temporal consistency and, in the case of rebooting, actively contaminate the evidence.

Answer

Reboot the acquired image so that the operating system refreshes its internal clock before analysis

Answer

Recalculate file hashes for every artifact so that timestamp changes can be detected

Answer

Convert all timestamps to the Windows FILETIME format regardless of the source operating system

Question 3

Which THREE components are essential to include in a SOC Incident Response plan?

Accepted Answer

Defined roles and responsibilities. A is correct because a SOC Incident Response plan must define roles and responsibilities (e.g., incident commander, tier-1/tier-2 analysts, forensics, legal liaison) so each responder knows their authority and tasks during an incident. C is correct because a communication escalation matrix specifies who is notified, in what order, and through which channels (e.g., phone, email, ticketing) as severity increases, ensuring timely stakeholder and management engagement. E is correct because Standard Operating Procedures provide the repeatable, step-by-step playbooks for detection, triage, containment, eradication, and recovery, which are the operational backbone of any IR plan. B is not relevant because physical security building permits are facility-management concerns, not incident response planning components. D is not relevant because a list of office vacation days is an HR/scheduling matter and does not contribute to detecting, responding to, or recovering from security incidents.

Answer

Physical security building permits

Answer

List of office vacation days

Question 4

A SOC analyst is building a proactive threat detection rule to identify DNS tunneling. Which characteristic of DNS traffic is most indicative of potential DNS tunneling activity?

Accepted Answer

Frequent DNS queries with long subdomain names containing encoded data. DNS tunneling frequently encodes data in subdomain names, resulting in long, random-looking strings. This is because attackers need to transmit data in the query itself. Legitimate DNS queries typically use shorter, human-readable subdomains. Thus, frequent queries with long, encoded subdomains are a strong indicator of tunneling activity. Other options are less specific and can occur in normal traffic.

Answer

DNS responses with a TTL value of zero

Answer

High volume of DNS queries to a single domain

Answer

DNS queries using TCP instead of UDP

Question 5

A SOC analyst is investigating suspicious activity in a Google Cloud environment where a service account may have been compromised. The analyst needs to identify evidence of unauthorized use of that service account. (Choose two.)

Accepted Answer

Cloud Audit Logs Data Access entries showing API calls made by the service account to read or modify data. Cloud Audit Logs are the authoritative source for service account activity. Admin Activity entries reveal IAM and configuration changes, while Data Access entries reveal reads and writes on data resources. Together they show both privilege changes and data operations performed by the compromised identity, which is the evidence needed to confirm unauthorized use.

Answer

Security Command Center asset inventory listing IAM policies attached to the service account

Answer

VPC Flow Logs showing the source IP addresses of connections to the service account's resources

Answer

Cloud Monitoring uptime check results for services associated with the service account

Question 6

During an incident response engagement, a SOC analyst needs to acquire volatile memory from a running Windows 10 endpoint before isolating it from the network. The analyst must ensure the memory image is forensically sound and preserves the order of volatility. Which of the following should the analyst do FIRST?

Accepted Answer

Capture the contents of physical memory using a validated tool such as WinPmem or Magnet RAM Capture. The order of volatility dictates that the most perishable evidence, such as physical memory, be collected first. Capturing RAM with a validated tool preserves critical artifacts like running processes, network connections, and encryption keys before any containment or remediation alters the system. Other actions, such as network isolation or antivirus scanning, change system state and can destroy volatile evidence, so they must be performed after memory acquisition.

Answer

Create a forensic disk image of the system drive, then extract memory from the image

Answer

Disconnect the endpoint from the network to prevent lateral movement, then acquire memory

Answer

Run a full antivirus scan to identify the malware, then capture memory

Question 7

Which TWO factors are most critical when calculating the ROI of a SOC?

Accepted Answer

Cost of potential data breach incidents. Option A (Cost of potential data breach incidents) is correct because ROI for a SOC is fundamentally about avoided losses — the expected financial impact of breaches (incident response, regulatory fines, legal fees, customer notification, and business disruption) represents the benefit side of the ROI equation, so it must be quantified. Option B (Total cost of security personnel and tools) is correct because ROI requires the full investment side, including SOC analyst salaries, SIEM licensing, EDR, threat intelligence subscriptions, and training, which together form the denominator of the ROI calculation. Options C, D, and E are not relevant financial factors: social media followers, office square footage, and coffee machines do not measure either the cost of the SOC or the losses it prevents, so they cannot meaningfully contribute to an ROI calculation.

Answer

Number of social media followers

Answer

Office space square footage

Answer

Number of coffee machines in the SOC

Question 8

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Accepted Answer

Frequency analysis on connection flow metadata. A beaconing pattern with a consistent 30-second interval and 5% jitter is best detected through frequency analysis on connection flow metadata, since the regularity of the timing is the defining characteristic. Analyzing flow records (NetFlow, Zeek conn.log) for periodic connections to the same destination reveals the beacon regardless of payload encryption. This approach detects the behavior rather than relying on known signatures or IPs.

Answer

Port-based blocking

Answer

Signature-based IDS alert

Answer

Static IP blocklisting

Question 9

Which TWO steps are part of the 'Preparation' phase of the incident response process?

Accepted Answer

Training personnel. In the Preparation phase of incident response, organizations build the capabilities needed before an incident occurs, which includes training personnel (D) so that responders know their roles, procedures, and tools when an event happens. Developing IR policies (E) is also a Preparation activity because it establishes the governance, definitions, escalation paths, and procedural framework that guide the entire response effort. By contrast, writing the final report (A) and root cause analysis (C) occur in the post-incident/lessons-learned phase, and containment of the breach (B) belongs to the containment, eradication, and recovery phase, so none of those are Preparation steps.

Answer

Writing the final report

Answer

Containment of the breach

Answer

Root cause analysis

Question 10

A SOC analyst is building detection logic for the Execution phase of an intrusion. The team wants to identify host artifacts that reliably indicate a process was launched with malicious intent. Which TWO of the following are the most appropriate host-based artifacts to monitor for this purpose? (Choose two.)

Accepted Answer

Windows Event ID 4688 process creation records including the full command line. Process creation telemetry is the core host-based artifact for detecting malicious execution. Windows Event ID 4688 with command-line auditing and Sysmon Event ID 1 both capture the executable, arguments, and parent-child relationships needed to judge intent. Prefetch, NetFlow, and Run keys serve other purposes and lack the command-line and lineage context required here.

Answer

NetFlow records showing outbound connection volumes per host

Answer

Registry Run key entries persisted at logon

Answer

Prefetch files showing execution counts and last-run timestamps

Question 11

What is the primary purpose of a 'War Room' during a major incident?

Accepted Answer

To centralize real-time communication and coordination. A War Room centralizes real-time communication and coordination among incident responders, enabling rapid decision-making, shared situational awareness, and clear task assignment during a major incident. It is a coordination mechanism, not a storage or concealment function.

Answer

To store physical evidence

Answer

To hide the incident from the public

Answer

To conduct IT maintenance

Question 12

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Accepted Answer

excel.exe. When a user opens an Excel document with a malicious macro, Excel.exe executes the VBA, and any spawned payload (e.g., PowerShell, cmd, or a dropped executable) is a child process of excel.exe. Thus excel.exe is the parent process in the process tree.

Answer

explorer.exe

Answer

wininit.exe

Answer

svchost.exe

Question 13

A SOC analyst is conducting dynamic malware analysis on a suspicious binary in an isolated sandbox. The analyst observes that the malware creates a new file in the Startup folder and modifies a Run key in the registry. Which TWO artifacts should the analyst collect to document the persistence mechanisms for the forensic report? (Choose two.)

Accepted Answer

The full path and filename of the file created in the Startup folder. To document persistence, the analyst must record the exact file path in the Startup folder and the full registry key path with value data under the Run key. These artifacts provide actionable evidence for remediation and satisfy the forensic requirement to describe how the malware maintains execution. The other options are unrelated to persistence mechanisms.

Answer

The MD5 hash of the sandbox host operating system ISO

Answer

The list of all open network ports on the sandbox at the time of analysis

Answer

The screen resolution and color depth of the sandbox desktop

Question 14

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

Accepted Answer

Infrastructure. The Diamond Model of Intrusion Analysis consists of four core features: Adversary, Capability, Infrastructure, and Victim. Infrastructure refers to the physical and logical communication structures (e.g., IP addresses, domain names, email addresses, command-and-control servers) that the adversary uses to deliver capabilities and maintain control. To identify how an adversary communicates with compromised hosts, the analyst must focus on the Infrastructure component, as it encompasses the channels and mechanisms enabling interaction between the adversary and the victim.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 15

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Option B is correct because implementing baseline behavioral profiling for users and entities establishes a normal activity reference, so deviations that trigger alerts are genuinely anomalous rather than expected behavior, which directly reduces false positives. Option C is correct because cross-correlation across different data sources such as EDR and Firewall requires multiple independent indicators to align before an alert fires, raising the confidence of detections and filtering out single-source noise. Option A is incorrect because lowering severity to 'Low' for all rules only changes prioritization and does not reduce the number of false positives generated. Option D is incorrect because removing Time Window constraints weakens temporal correlation, allowing unrelated events to match and typically increasing false positives. Option E is incorrect because single-condition rule logic is overly broad and lacks the contextual constraints needed to distinguish malicious activity from benign events.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.