312-39 Practice Test 19 — 15 Questions

Question 1

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Accepted Answer

Updating correlation rules based on new IOCs. A Threat Intelligence analyst's core function is to collect, analyze, and operationalize threat data, which includes translating new indicators of compromise (IOCs) into detection content such as SIEM correlation rules, IDS signatures, and blocklists. Updating correlation rules based on new IOCs directly connects intelligence to detection, closing the loop between research and SOC operations. This is the defining responsibility that distinguishes the role from other SOC functions.

Answer

Hardening server images

Answer

Managing SOC budget

Answer

Writing compliance reports

Question 2

A SOC team is building detection rules for cloud infrastructure. They want to identify potentially malicious activities in AWS that could indicate an account compromise. Which TWO of the following AWS API calls should be monitored as high-priority indicators of compromise? (Choose two.)

Accepted Answer

CreateUser. CreateUser and PutBucketPolicy are high-priority indicators because they represent actions that attackers commonly take to establish persistence or exfiltrate data. CreateUser can be used to create backdoor accounts, while PutBucketPolicy can expose sensitive data. These API calls are less frequent in normal operations and have significant security implications, making them valuable for detection.

Answer

DescribeInstances

Answer

ListBuckets

Answer

GetCallerIdentity

Question 3

During an incident, a SOC analyst needs to preserve volatile evidence from a compromised Linux server before the incident response team arrives. The server is still running and the attacker may still be active. Which action should the analyst take first to capture the most volatile data?

Accepted Answer

Capture the contents of physical memory using a tool such as LiME or AVML. The order of volatility requires capturing the most perishable evidence first. Physical memory contains running processes, network connections, and potentially encryption keys that vanish on shutdown or over time. Memory acquisition with tools like LiME or AVML preserves these artifacts before any disk imaging, shutdown, or remediation action is taken.

Answer

Create a forensic image of the entire disk using dd

Answer

Run a full antivirus scan and quarantine detected threats

Answer

Shut down the server to prevent further attacker activity

Question 4

A SOC analyst is proactively hunting for evidence of Pass-the-Hash lateral movement in a Windows environment. The analyst has access to endpoint telemetry and wants to identify the specific authentication behavior that distinguishes Pass-the-Hash from legitimate NTLM authentication. Which indicator should the analyst prioritize?

Accepted Answer

Successful NTLM authentication to a remote host where the source workstation has no corresponding interactive logon or credential prompt. Pass-the-Hash allows authentication with a stolen NTLM hash without the plaintext password. The strongest indicator is a successful remote NTLM authentication where the source host shows no interactive logon or credential prompt, because the hash was used directly. Failed logons, Kerberos RC4 requests, and explicit credential events do not capture this specific behavior.

Answer

Failed NTLM authentication attempts with status code 0xC000006A across multiple hosts

Answer

Kerberos TGT requests with encryption type 0x17 from a workstation to a domain controller

Answer

Event ID 4648 indicating explicit credentials were used for a remote logon

Question 5

A SOC analyst is reviewing proxy logs and notices a series of HTTP POST requests to 'update.accounts-check.com' with large, encoded payloads occurring outside business hours. The domain was registered two days ago and has a low reputation. Which type of attack activity is most likely occurring?

Accepted Answer

Data exfiltration over HTTP. The large, encoded HTTP POST requests to a newly registered, low-reputation domain outside business hours are characteristic of data exfiltration. Attackers use HTTP POST to upload stolen data to C2 servers, often encoding it to avoid detection. The timing and domain reputation add context. Other options like drive-by downloads or XSS involve different traffic patterns and are not supported by the evidence.

Answer

Drive-by download attack

Answer

Cross-Site Scripting (XSS) data theft

Answer

Server-Side Request Forgery (SSRF)

Question 6

A SOC analyst is reviewing a packet capture from a suspected compromised host. The analyst observes a series of DNS queries for long, random-looking subdomains of a single domain, followed by TXT record responses containing encoded data. Which type of attack is most likely occurring?

Accepted Answer

DNS tunneling for command and control. The pattern of long, random subdomains and TXT record responses is a strong indicator of DNS tunneling. Attackers encode data in the subdomain of a query (e.g., exfiltrated data) and receive commands or exfiltrated data in TXT responses. This allows them to bypass firewalls that allow DNS traffic. Other DNS attacks like cache poisoning, amplification, or fast flux do not involve this type of data encoding and would present different traffic patterns.

Answer

DNS cache poisoning

Answer

Fast flux DNS

Answer

DNS amplification attack

Question 7

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

Accepted Answer

Create suppression rules for alerts originating from known-good internal system administration scanners. Suppression rules scoped to known-good internal scanners eliminate the predictable, high-volume false positives those tools generate without weakening detection for genuine threats. This preserves signature fidelity for real attack traffic while directly reducing analyst triage load, which is the stated goal of balancing efficacy and workload. It is a targeted, documented tuning action rather than a blunt global change.

Answer

Update all signatures to the most restrictive settings available

Answer

Disable all low-severity alerts in the IDS management console

Answer

Set the IDS to 'Alert Only' mode for all signatures

Question 8

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

Accepted Answer

Extracting fields using Regex during the ingestion pipeline. Option D is correct because SIEM ingestion pipelines commonly use regular expressions (Regex) to parse raw, heterogeneous log lines and extract fields (timestamps, source IPs, usernames, event IDs) into a consistent structure during ingestion. Option E is correct because applying a standardized schema such as Common Event Format (CEF) or Elastic Common Schema (ECS) maps vendor-specific fields to a uniform naming and typing convention, which is the essence of log normalization. The unmarked options do not belong: deleting incoming log metadata (A) destroys context rather than normalizing it, increasing network MTU size (B) is a Layer 3/4 network tuning change unrelated to log parsing, and running a brute-force attack on a log file (C) is neither a normalization technique nor a legitimate SIEM practice.

Answer

Deleting all incoming log metadata

Answer

Increasing the network MTU size

Answer

Running a brute-force attack on the log file

Question 9

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

Accepted Answer

Remove the malicious file and rotate credentials. After identifying a web shell on a compromised server, the immediate priority is to remove the attacker's persistence mechanism and invalidate any credentials they may have harvested. Removing the malicious file eliminates the web shell itself, while rotating credentials ensures that any passwords, API keys, or session tokens stolen by the attacker can no longer be used. This combination addresses both the active threat and the potential for lateral movement or re-entry using compromised accounts.

Answer

Flush DNS

Answer

Restart the web service

Answer

Update the OS

Question 10

A ticket is assigned to you with high priority. What is the first thing you should do?

Accepted Answer

Verify the alert and scope the incident. The first step in incident response is always to verify that the alert is genuine and to determine the scope of the incident. This prevents wasted effort on false positives and ensures the response is proportionate to the actual threat. Only after verification and scoping should escalation, containment, or communication actions be taken.

Answer

Call the CISO

Answer

Isolate the host immediately

Answer

Email the user

Question 11

During malware analysis, a SOC analyst observes that a suspicious executable creates a new file in %TEMP% with a random name, then that file spawns a child process. The analyst wants to determine the exact parent-child process lineage and capture the command line used at launch. Which Windows artifact or tool provides this directly?

Accepted Answer

Sysmon Event ID 1 (Process Create). To establish parent-child lineage and capture the exact command line, the analyst needs a telemetry source that records both. Sysmon Event ID 1 includes ParentImage, ParentCommandLine, Image, CommandLine, and ProcessGuid, enabling full reconstruction of the process tree. Security 4688 may lack command lines, and Prefetch and Amcache provide execution evidence but not lineage or arguments.

Answer

Amcache.hve

Answer

Prefetch files in C:\Windows\Prefetch

Answer

Windows Security Event ID 4688 without command-line auditing enabled

Question 12

Which THREE of the following factors should be considered when designing a new SIEM use case?

Accepted Answer

Data availability and quality.. Option B (Data availability and quality) is correct because a SIEM use case can only detect what the ingested telemetry supports; if the required log sources are not collected, normalized, and reliable, the correlation rule will produce false negatives or excessive false positives. Option D (Complexity of the detection logic) is correct because overly complex correlation rules are harder to tune, maintain, and troubleshoot, and they consume more SIEM processing resources, so the detection logic must be designed to balance fidelity with operational feasibility. Option E (Business risk and threat modeling) is correct because use cases should be prioritized based on the organization's critical assets, threat landscape, and MITRE ATT&CK-style adversary behaviors, ensuring detection efforts address the risks that actually matter to the business. Option A (The physical weight of the server) is not relevant because SIEM use case design concerns detection content and data sources, not hardware logistics. Option C (The color scheme of the SIEM dashboard) is not relevant because dashboard aesthetics are a presentation concern and do not affect the effectiveness or design of a detection use case.

Answer

The physical weight of the server.

Answer

The color scheme of the SIEM dashboard.

Question 13

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

Accepted Answer

Implementing TLS-based log forwarding. TLS-based log forwarding encrypts log data in transit, ensuring confidentiality and integrity. It uses certificates for authentication and encryption, protecting against eavesdropping and tampering. This is the most secure method among the options.

Answer

Utilizing SNMPv1 traps

Answer

Encapsulating logs in cleartext UDP packets

Answer

Using standard port 514 without encryption

Question 14

A SOC analyst is reviewing logs from a cloud environment and needs to determine if an Amazon S3 bucket was made publicly accessible. The analyst wants to identify the specific API call that changed the bucket's access control list (ACL). Which AWS service should the analyst check?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls, including PutBucketAcl, which is used to change an S3 bucket's ACL. The CloudTrail event includes the caller's identity, the bucket name, and the request parameters, allowing the analyst to determine if and how the bucket was made public. This directly answers the investigation question.

Answer

Amazon S3 Access Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 15

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Accepted Answer

Azure Policy. Azure Policy is the governance service that lets you define, assign, and enforce rules (policy definitions) over Azure resources, ensuring they remain compliant with organizational standards and preventing unauthorized or non-compliant changes. It evaluates resource properties against policy rules and can deny non-compliant deployments, audit existing resources, or auto-remediate drift. This directly matches the requirement to automatically enforce security settings and prevent unauthorized changes.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

Azure Key Vault