312-39 Practice Test 2 — 10 Questions

Question 1

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Accepted Answer

Increased DNS request volume (DNS Tunneling). Exfiltration is characterized by large, anomalous outbound transfers and the use of unusual protocols.

Answer

Multiple failed login attempts

Answer

System clock synchronization errors

Answer

Installation of new system drivers

Question 2

Which component of a SIEM is responsible for identifying patterns in real-time?

Accepted Answer

Correlation engine.. The correlation engine evaluates incoming events against defined logic to trigger alerts.

Answer

Log parser.

Answer

Reporting module.

Answer

Storage engine.

Question 3

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Accepted Answer

Frequency analysis on connection flow metadata. Beaconing with jitter is a hallmark of C2 communication designed to evade simple threshold-based detection.

Answer

Port-based blocking

Answer

Signature-based IDS alert

Answer

Static IP blocklisting

Question 4

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based scheduling is a core feature for managing alert relevance in SIEMs.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 5

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Accepted Answer

Incident Review dashboard. The Incident Review dashboard allows analysts to view the MITRE ATT&CK tactics and techniques associated with notable events.

Answer

Threat Intelligence dashboard

Answer

Access Anomalies dashboard

Answer

User Activity Monitoring

Question 6

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Accepted Answer

4104. Event ID 4104 is generated when a script block is executed, providing insight into obfuscated PowerShell commands.

Answer

1102

Answer

4688

Answer

4624

Question 7

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

Accepted Answer

OleDump. OleDump is a specialized tool used to analyze OLE files (like Office docs) to extract VBA macros and embedded objects.

Answer

Burp Suite

Answer

Wireshark

Answer

Autopsy

Question 8

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Accepted Answer

The aggregation window is configured incorrectly.. Event aggregation settings can prevent rules from firing if the conditions are too restrictive.

Answer

The parser is disabled.

Answer

The user interface is loading slowly.

Answer

The license has expired.

Question 9

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

Accepted Answer

Create an exclusion rule for the specific scanner IP address and vulnerability signatures within the SIEM policy.. Creating a suppression rule or an exclusion filter based on the scanner's IP address and specific signature IDs allows you to silence known noise while keeping the events in the logs for audit purposes.

Answer

Permanently disable the ingestion of logs from the vulnerability scanner.

Answer

Change the log source protocol from Syslog to SNMP.

Answer

Increase the threshold for the correlation rule to a point where the scanner no longer triggers it.

Question 10

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

Accepted Answer

Remove the malicious file and rotate credentials. After identifying the web shell, removing the file and resetting the web application credentials is the critical next step.

Answer

Flush DNS

Answer

Restart the web service

Answer

Update the OS