312-39 Practice Test 20 — 15 Questions

Question 1

During an incident involving a Windows workstation that exhibits beaconing to an external IP every 60 seconds, you need to preserve volatile evidence before the machine is rebooted. Which of the following should you capture FIRST according to order of volatility?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical memory (RAM) using a tool such as WinPmem or DumpIt. The order of volatility dictates that the most perishable evidence be collected first. RAM holds running processes, network connections, and cryptographic keys that disappear on shutdown. In a live beaconing incident, capturing physical memory before any disk-based artifacts preserves the malicious process, its C2 configuration, and potential credentials. Disk logs and registry hives persist and can be collected later without losing their content.

Answer

A full disk image using FTK Imager or dd

Answer

The Windows Security event log (Security.evtx) from C:\Windows\System32\winevt\Logs

Answer

The registry hive files such as SAM, SYSTEM, and SOFTWARE

Question 2

An organization is implementing a proactive detection strategy using the MITRE ATT&CK framework. Which phase of the implementation should the SOC prioritize to maximize detection coverage against common enterprise threats?

Accepted Answer

Map existing log sources to high-prevalence ATT&CK techniques. Mapping existing log sources to high-prevalence ATT&CK techniques is the foundational step that maximizes detection coverage efficiently, because it identifies which techniques the organization can already see and where telemetry gaps exist. It avoids wasted effort on techniques that are rare in the enterprise's threat profile. This prioritization aligns detection engineering with the most likely adversary behaviors.

Answer

Purchase every available threat intelligence feed on the market

Answer

Rewrite all existing SIEM correlation rules from scratch

Answer

Focus only on detecting the 'Command and Control' phase

Question 3

A SOC analyst receives a suspicious PDF attachment from a user. The analyst wants to quickly determine whether the PDF contains JavaScript or an embedded executable without executing it. Which approach is most appropriate?

Accepted Answer

Use a PDF parser such as pdfid or pdf-parser to inspect object types and keywords. Static PDF inspection with pdfid or pdf-parser reveals keywords such as /JavaScript, /JS, /OpenAction, and /EmbeddedFile without executing the file. This is the fastest and safest way to determine whether the PDF contains JavaScript or an embedded executable. Sandbox execution, hash reputation, and metadata extraction do not directly answer the structural question.

Answer

Extract the PDF's metadata using exiftool and review the author field

Answer

Submit the PDF hash to a public malware repository and rely on the detection ratio

Answer

Open the PDF in a sandboxed virtual machine and observe network traffic

Question 4

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

Accepted Answer

Browser Hijacking. Browser hijacking is the class of attack where malicious code or an unwanted extension modifies browser settings — homepage, default search engine, new-tab page, or redirects — without the user's consent. The scenario (changed homepage plus a new unsigned extension) is the textbook signature of browser hijacking. The unsigned extension is the delivery/persistence mechanism, and the homepage change is the observable symptom.

Answer

Man-in-the-Middle (MitM)

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Question 5

What is a 'log source' in the context of a SIEM?

Accepted Answer

Any device or application generating security logs.. A log source is any device, application, or system that generates security-relevant log data, such as firewalls, servers, endpoints, or authentication services. In a SIEM, these sources feed raw events into the collection pipeline for correlation and analysis. Option D correctly identifies this as the origin of log data, not the storage or infrastructure components.

Answer

The database storing the logs.

Answer

The SIEM administrator's computer.

Answer

A physical cable.

Question 6

An analyst notices that a workstation's registry Run key now points to a binary located in the user's AppData\Roaming directory, and the binary is unsigned and has no version information. The change occurred shortly after the user opened an email attachment. Which attacker objective does this artifact most directly support?

Accepted Answer

Persistence across user logons. Modifying a Run key to launch an unsigned binary from AppData establishes automatic execution at user logon, which is the essence of persistence. This mechanism allows the attacker to survive reboots and continue operating after the initial infection, whereas privilege escalation, process hollowing, and lateral movement would each leave distinctly different host or network artifacts.

Answer

Lateral movement to additional hosts

Answer

Privilege escalation through a vulnerable driver

Answer

Defense evasion via process hollowing

Question 7

A SOC analyst is reviewing logs from a web server and notices repeated requests with URLs containing encoded characters like %27 and %20. The analyst suspects a SQL injection attempt. Which log source should the analyst examine to correlate the source IP and the full request, including headers?

Accepted Answer

Web server access logs. Web server access logs are the correct source because they record each HTTP request with the source IP, full URL including encoded characters, and other request details. This allows the analyst to correlate multiple requests from the same IP and identify SQL injection patterns. Error logs, database logs, and firewall logs lack the necessary application-layer context to fully reconstruct the attack.

Answer

Web server error logs

Answer

Firewall logs

Answer

Database server logs

Question 8

You are a SOC analyst monitoring the SIEM dashboard. An alert triggers for multiple failed login attempts from a single external IP address targeting several user accounts. According to the incident response lifecycle, which phase does this activity represent?

Accepted Answer

Detection and Analysis. The failed login attempts from a single external IP targeting multiple accounts are a detected event. The incident response lifecycle places this in the Detection and Analysis phase, where analysts validate alerts and determine if they represent a true incident. Preparation, containment, and post-incident activities occur before or after this phase, not during the initial alert.

Answer

Containment, Eradication, and Recovery

Answer

Preparation

Answer

Post-Incident Activity

Question 9

A SOC analyst is reviewing Microsoft 365 audit logs after a user reported a suspicious email. The analyst wants to determine whether the email was delivered to the user's mailbox and whether the user interacted with a malicious URL in the message. Which Microsoft 365 tool should the analyst use to trace message delivery and inspect URL click events?

Accepted Answer

Microsoft Defender for Office 365 Threat Explorer. Threat Explorer in Microsoft Defender for Office 365 is the correct tool because it combines email delivery status with user interaction data such as URL clicks. The analyst can filter by recipient, sender, or URL to confirm if the message reached the mailbox and whether the user clicked the malicious link. The other tools either lack click telemetry or focus on different data sets.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft 365 Defender Advanced Hunting with DeviceEvents

Answer

Exchange admin center message trace

Question 10

A SOC manager is evaluating the log retention strategy for a new SIEM deployment. Regulatory requirements mandate that all authentication logs be retained for at least one year and be available for immediate search. Which storage tier strategy best meets both the retention and accessibility requirements while optimizing cost?

Accepted Answer

Store logs in a hot tier for 90 days, then transition to a warm tier that supports immediate search for the remaining retention period.. A tiered storage strategy with a hot tier for recent logs and a warm tier for older logs balances cost and accessibility. Hot storage provides fast search for recent data, while warm storage offers immediate search at a lower cost for the remainder of the retention period. This meets both regulatory retention and immediate accessibility requirements.

Answer

Store all authentication logs in a hot tier for one year.

Answer

Archive all logs to tape for one year and retrieve them on demand.

Answer

Store logs in a warm tier for 30 days, then move to a cold tier for the remainder of the year.

Question 11

A SOC manager is documenting the team's escalation workflow. During a high-severity incident, the Tier 1 analyst must notify the Tier 2 analyst who then engages the Incident Response lead. The manager wants to formally define the sequence of notifications and responsibilities. Which document should the manager update?

Accepted Answer

Standard Operating Procedure (SOP) for escalation. The manager needs to document a detailed, repeatable operational workflow for escalating incidents. A Standard Operating Procedure (SOP) is the correct type of document for defining such step-by-step processes and assigning specific responsibilities to team members, ensuring consistency and clarity during high-pressure situations.

Answer

Business Continuity Plan (BCP)

Answer

Incident Response Plan (IRP)

Answer

Service Level Agreement (SLA)

Question 12

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a seemingly legitimate website, but the analyst suspects a phishing attempt. Which action should the analyst take to safely analyze the URL without compromising the corporate network?

Accepted Answer

Use a sandboxed online URL analysis service like URLScan.io or VirusTotal.. Using a sandboxed online URL analysis service allows the analyst to safely visit the URL in an isolated environment, capturing screenshots, redirects, and potential malicious payloads without risking the corporate network. This method provides comprehensive intelligence, including domain reputation and associated indicators. Alternatives like opening in an isolated VM without network or asking a colleague are either ineffective or unsafe. Inspecting the URL text alone is insufficient for dynamic analysis.

Answer

Ask a colleague to click the link from their workstation to see if it is malicious.

Answer

Open the link in a virtual machine with no network access.

Answer

Copy the URL and paste it into a text editor to inspect for obfuscation.

Question 13

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound transfer from an internal server to an external IP, but the firewall logs indicate the connection was allowed. The analyst needs to determine if the transfer was authorized by reviewing application logs. Which log source should the analyst prioritize to identify the user or process that initiated the transfer?

Accepted Answer

Application logs from the server that initiated the transfer. Application logs are the most direct source for identifying the user or process that initiated a data transfer. They capture application-level events, including authentication, file access, and commands, which can reveal whether the transfer was authorized. Firewall and NetFlow logs lack this granularity, and Windows Security logs may not capture the specific action.

Answer

Windows Security Event Logs on the internal server

Answer

Firewall logs showing the allowed connection

Answer

NetFlow records from the network core

Question 14

Which TWO log types are considered critical for forensic analysis after a network intrusion?

Accepted Answer

Firewall traffic logs. Firewall traffic logs (C) are critical because they record allowed and denied connections with source/destination IP addresses, ports, and timestamps, letting investigators reconstruct how an attacker entered, which hosts were targeted, and whether data exfiltration occurred. VPN authentication logs (E) are equally critical since they capture remote-access events such as usernames, source IPs, authentication successes/failures, and session durations, which can reveal compromised credentials or unauthorized remote sessions used during the intrusion. The remaining options are not forensic-relevant to a network intrusion: office wallpaper settings (A) and mouse driver version logs (D) are cosmetic or endpoint configuration data with no network activity, and printer status logs (B) only reflect print job and device health information, none of which establish attacker traffic or access.

Answer

Office wallpaper settings

Answer

Printer status logs

Answer

Mouse driver version logs

Question 15

A SOC analyst receives an alert from the SIEM indicating a potential brute-force attack against a domain controller. The alert shows 20 failed logon attempts (Event ID 4625) for the user 'administrator' within 30 seconds, followed by a successful logon (Event ID 4624) from the same source IP. The analyst wants to determine if this is a true positive and prioritize the response. According to incident triage best practices, what is the MOST appropriate next step?

Accepted Answer

Check the source IP address against threat intelligence and review the account's recent activity for anomalies.. The correct approach is to validate the alert by checking the source IP and account activity. This helps determine if the successful logon is malicious or benign. Triage involves gathering evidence to make an informed decision, not immediately taking containment actions or ignoring the alert. Proper triage ensures that true positives are prioritized and false positives are dismissed efficiently.

Answer

Immediately disable the 'administrator' account to prevent further unauthorized access.

Answer

Ignore the alert because a successful logon after failures is common for users who mistype passwords.

Answer

Escalate the alert to the incident response team immediately without further analysis.