312-39 Practice Test 2 — 10 Questions

Question 1

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

Accepted Answer

Asset Criticality.. Asset Criticality is the most important metric for prioritizing incidents by business impact because a compromise on a domain controller, database server, or executive workstation carries far greater risk than one on a test machine. SIEM triage workflows weight alerts by the criticality of the affected asset to focus analyst attention where it matters most. This aligns detection response with business risk.

Answer

Alert frequency.

Answer

Log source vendor.

Answer

Number of alerts per user.

Question 2

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should the analyst take?

Accepted Answer

Use a utility such as certutil -hashfile or sha256sum to compute the file's hash. The analyst needs a cryptographic hash without executing the sample. Built-in utilities such as certutil -hashfile on Windows or sha256sum on Linux generate MD5, SHA-1, or SHA-256 values safely and quickly, enabling comparison against threat intelligence. Sandbox execution, hex inspection, and public submissions either execute the file, fail to produce a hash, or expose the sample unnecessarily.

Answer

Submit the binary to a public multi-engine scanning service and read the detection names

Answer

Run the binary in a sandbox and record the hash from the sandbox report

Answer

Open the binary in a hex editor and visually inspect the first bytes

Question 3

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based conditions such as 'only trigger during business hours' are applied in the alert's schedule or suppression settings, where the SIEM evaluates the rule only within defined time windows or suppresses alerts outside them. This is a rule-level configuration that controls when the detection logic is active or when notifications fire. It is separate from data ingestion or user permissions.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 4

Which THREE factors contribute to 'dwell time' in a security incident?

Accepted Answer

Inadequate logging visibility. Dwell time is the interval between an attacker's initial compromise and the moment the intrusion is detected, so any factor that delays detection extends it. Option A, inadequate logging visibility, is correct because without sufficient endpoint, network, and authentication logs (e.g., missing Windows Event ID 4624, DNS query logs, or EDR telemetry) defenders cannot see the malicious activity, so the breach goes unnoticed longer. Option D, insufficient automated alerting, is correct because if SIEM correlation rules, IDS/IPS signatures, or EDR detections do not fire and notify analysts in near real time, detection depends on manual review and dwell time grows. Option E, lack of threat intelligence, is correct because without IOCs, TTPs, and context from feeds such as STIX/TAXII or MITRE ATT&CK mappings, defenders are slower to recognize known adversary behavior and to hunt for it proactively. Option B, the number of coffee machines in the SOC, is irrelevant to detection timelines and is not a security control. Option C, the speed of the network, is not a direct contributor; faster links may even aid exfiltration, but they do not by themselves delay or accelerate detection of a compromise.

Answer

The number of coffee machines in the SOC

Answer

The speed of the network

Question 5

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Accepted Answer

Snapshot the persistent disk for forensics. Option B is correct because taking a snapshot of the persistent disk preserves volatile and non-volatile evidence (disk state, logs, files) for forensic analysis before any remediation destroys it, which is a standard incident-response step for a rogue VM. Option C is correct because restricting network ingress/egress rules (e.g., via VPC firewall rules or removing the VM's external IP) contains the threat by isolating the rogue VM and preventing lateral movement or data exfiltration while investigation proceeds. Option A is wrong because upgrading the OS image is a patching action that neither contains the rogue VM nor preserves evidence. Option D is wrong because increasing CPU quota is a performance change unrelated to incident response. Option E is wrong because deleting the VM immediately destroys forensic evidence and may tip off an attacker, so containment and snapshotting must come first.

Answer

Upgrade the VM's OS image

Answer

Increase the VM's CPU quota

Answer

Delete the VM immediately

Question 6

Which document should you reference first to determine the communication path during a high-severity security incident?

Accepted Answer

Incident Response Plan. The Incident Response Plan (IRP) is the authoritative document that defines roles, responsibilities, and communication protocols during a security incident. It explicitly outlines who to contact, escalation paths, and notification timelines for high-severity events, ensuring a coordinated response. Other documents like the Employee Handbook or Network Topology Diagram do not provide incident-specific communication procedures. The Disaster Recovery Plan focuses on restoring IT infrastructure after a disruption, not on incident communication.

Answer

Employee Handbook

Answer

Network Topology Diagram

Answer

Disaster Recovery Plan

Question 7

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Option B is correct because validating a SIEM correlation rule against historical log data in a test or staging environment confirms it detects the intended activity without generating excessive false positives before it is promoted to production. Option C is correct because mapping a use case to a specific MITRE ATT&CK technique ties the detection to a known adversary behavior, giving the rule clear scope, coverage rationale, and measurable detection value. Option A is wrong because deleting all logs after 24 hours destroys the retention needed for correlation, hunting, and forensic investigation. Option D is wrong because disabling firewall logging removes critical network telemetry that many SIEM use cases depend on. Option E is wrong because SIEM use case development requires security operations, detection engineering, or threat intelligence expertise, not marketing staff.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 8

A SOC analyst is reviewing a threat intelligence report that lists a new C2 domain. The SIEM has no prior detection rule for this domain. Which action best uses the diamond model to proactively operationalize this intelligence for future detection?

Accepted Answer

Extract the domain and associated adversary, capability, and victim metadata to build a detection rule that correlates DNS queries with subsequent network connections.. The diamond model structures threat intelligence around adversary, infrastructure, capability, and victim, enabling analysts to pivot and build detection logic. Extracting and correlating these elements into a SIEM rule transforms a single IOC into a durable, context-aware detection that supports proactive hunting and reduces reliance on fragile indicators like IPs. This approach aligns with operationalizing intelligence for sustained visibility.

Answer

Submit the domain to a public blocklist and wait for other organizations to report activity.

Answer

Add the domain to a watchlist and manually review alerts daily.

Answer

Create a firewall block rule for the domain's IP address only.

Question 9

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

Accepted Answer

A private executable memory region inside a legitimate process marked PAGE_EXECUTE_READWRITE. Injected code typically appears as executable private memory with write permissions inside a host process, or as a thread whose start address is outside any mapped module. Both artifacts deviate from normal process structure and are surfaced by memory forensics plugins. Signed DLLs, handle counts, and ordinary waiting threads are normal conditions and do not by themselves demonstrate injection.

Answer

A user-mode process with a single thread that is currently in a wait state

Answer

A signed Microsoft DLL loaded at its expected base address

Answer

A process with a high handle count and many open Registry keys

Question 10

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a handful resolving to short-lived IP addresses. The analyst wants to map this behavior to the most likely stage of the Cyber Kill Chain and the corresponding IOC category. Which of the following best describes this activity?

Accepted Answer

Command and Control (C2) using Domain Generation Algorithm (DGA) domains as network-based IoCs. Algorithmically generated domains with many NXDOMAIN responses and occasional short-lived resolutions indicate a host trying to find its C2 server, which is the Command and Control phase. Because the evidence is DNS traffic, it is a network-based IoC. The other choices misattribute the phase or the IoC category.

Answer

Weaponization using malicious macros as registry-based IoCs

Answer

Exfiltration using DNS tunneling as file-based IoCs

Answer

Reconnaissance using DNS zone transfer attempts as host-based IoCs