312-39 Practice Exam 2 — 20 Questions

Question 1

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endpoint. Which TWO of the following are host-based IoCs that should be prioritized for collection and analysis? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unusual registry Run key entries that launch a binary from a user's AppData folder. Host-based IoCs include artifacts found on the endpoint, such as registry modifications, suspicious files, and process behaviors. Registry Run keys launching binaries from AppData and double-extension files in user folders are both host-based and commonly associated with malware persistence and execution. The other options describe network-based observations.

Answer

A sudden increase in outbound DNS queries to a newly registered domain

Answer

A spike in SMTP traffic from an internal mail server to an external IP

Answer

Anomalous TLS certificate presented by an external server during a connection

Question 2

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

Accepted Answer

Event ID 4769 with encryption type 0x17 (RC4) for service accounts that normally use AES.. Kerberoasting detection relies on identifying anomalous TGS requests. A user requesting multiple service tickets for different SPNs in a short window indicates enumeration, while RC4 encryption requests for accounts that normally use AES signal an attempt to obtain easily crackable tickets. Together, these behaviors provide high-fidelity detection with fewer false positives than generic logon or group-change events.

Answer

A service account being added to the Domain Admins group.

Answer

Event ID 4771 for Kerberos pre-authentication failures from a single source.

Answer

Event ID 4624 logon type 3 (network) from a workstation to a domain controller.

Question 3

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Accepted Answer

Regulatory compliance requirements (e.g., GDPR, HIPAA). Option A is correct because regulatory frameworks such as GDPR, HIPAA, PCI DSS, and SOX impose explicit minimum retention periods for audit and security logs, so the SOC must retain logs at least as long as the strictest applicable mandate requires. Option B is correct because log retention is bounded by available storage capacity; the volume of logs generated per day, combined with the retention window, determines the storage and archiving infrastructure needed, and insufficient capacity forces trade-offs such as shorter retention or tiered storage. Option C is correct because the average time to detect an incident (dwell time) defines how far back investigators must be able to look to reconstruct an intrusion; if logs are purged before the typical detection window, the SOC loses the evidence needed for detection, triage, and root-cause analysis. Option D is not relevant because the physical color of hardware chassis has no bearing on log retention policy or security requirements. Option E is not relevant because the scheduled time of day for backups affects backup operations, not the duration for which logs must be retained.

Answer

The color of the hardware chassis

Answer

The time of day the backup is scheduled

Question 4

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (A) are a classic persistence mechanism because an attacker can create a task that re-executes malware at logon, on a schedule, or at system startup, so analysts routinely enumerate them (e.g., schtasks /query or the Task Scheduler library) for suspicious entries. Registry 'Run' keys (C), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, are checked because they cause programs to launch automatically at user logon or system boot, making them a favorite autostart location for implants. Startup folders (D), both the per-user and all-users Startup directories, are also examined since any shortcut or executable placed there executes automatically when the user logs in. System memory dumps (B) are useful for live forensics such as extracting credentials or injected code, but they are not a standard persistence artifact, and Event log files (E) are examined for evidence of activity or tampering rather than being a persistence location themselves.

Answer

System memory dumps

Answer

Event log files

Question 5

A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)

Accepted Answer

Search the email gateway logs for the sender address and subject line.. To scope a phishing incident, the analyst should search email gateway logs for the sender and subject to find all recipients, and check proxy logs for connections to the malicious URL to identify users who clicked. These actions provide a comprehensive view of who was targeted and who interacted with the phishing page. Other actions like antivirus scans or password resets are remediation steps for specific users, not scoping.

Answer

Run an antivirus scan on the reporting user's workstation.

Answer

Interview the reporting user to ask who else might have received the email.

Answer

Reset the password for the reporting user's account.

Question 6

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

Accepted Answer

Immediately isolate the endpoint from the network and escalate to the incident response team as a potential ransomware precursor.. Shadow copy deletion executed through a suspicious parent-child process chain is a well-known ransomware precursor technique. The correct response prioritizes containment by isolating the endpoint and escalating, because the attacker is likely still active. Verifying legitimacy or waiting for scans allows the adversary to proceed with encryption or lateral movement.

Answer

Close the alert as a false positive because vssadmin is a legitimate Windows administrative utility.

Answer

Run a full antivirus scan on the endpoint and wait for the results before taking any other action.

Answer

Contact the end user by phone to ask whether they intentionally ran the command before escalating.

Question 7

A SOC analyst is reviewing DNS logs and sees a host repeatedly querying subdomains like 'a1b2c3d4e5.evil-domain.com' every 60 seconds, with each subdomain being a random 10-character string. The responses are consistently NXDOMAIN. Which attack technique is most likely indicated?

Accepted Answer

Domain Generation Algorithm (DGA) used by malware for C2. The combination of random subdomains under a single parent domain, periodic queries, and NXDOMAIN responses strongly indicates a Domain Generation Algorithm used by malware to locate C2 servers. DGA malware generates many domains and queries them until one resolves, producing exactly this log signature. Other DNS-based attacks like tunneling or fast flux would show different patterns such as data in queries or changing IPs.

Answer

Fast flux DNS used to hide a botnet's C2 infrastructure

Answer

DNS cache poisoning attack against the local resolver

Answer

DNS tunneling for data exfiltration

Question 8

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

Accepted Answer

Sysmon Event ID 3 (Network connection). Sysmon Event ID 3 is specifically designed to log network connections along with the initiating process information. This makes it the most suitable log source for correlating outbound connections with processes during a data exfiltration investigation. Other logs either lack network connection details or do not associate connections with processes.

Answer

Windows Security event log

Answer

Windows Application event log

Answer

Windows PowerShell operational log

Question 9

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

Accepted Answer

Use log deduplication and correlation rules in the SIEM to group repeated SSH failures from the same source into a single alert with a count.. Deduplication and correlation in the SIEM reduce alert volume by grouping repeated events while retaining the original logs for forensic analysis. This approach maintains visibility into attack patterns such as brute-force attempts without overwhelming the ingestion pipeline. It balances operational efficiency with the need for detailed security context, unlike dropping or limiting logs.

Answer

Configure a filter in the SIEM to drop all SSH failure logs from the authentication server.

Answer

Implement log aggregation with rate limiting on the syslog server to cap the number of SSH failure messages per second.

Answer

Disable SSH logging on the authentication server and rely solely on network flow data for anomaly detection.

Question 10

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?

Accepted Answer

Command and Control. Consistent interval beaconing to an uncommon external address, uniform packet sizes, and TLS traits that do not match a normal browser collectively identify the command-and-control phase, where an implanted agent maintains contact with attacker infrastructure. Weaponization and exploitation precede this and occur without such regular outbound patterns, while actions on objectives would manifest as observable impact rather than heartbeat traffic.

Answer

Exploitation

Answer

Weaponization

Answer

Actions on Objectives

Question 11

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

Accepted Answer

Run the sample in a debugger with breakpoints on LoadLibrary and GetProcAddress, then inspect the string arguments passed to those functions. Dynamic resolution through LoadLibrary and GetProcAddress is the standard mechanism behind sparse import tables, so instrumenting those two functions in a debugger recovers the module and procedure names as they are requested. Hash lookups, section size comparisons, and string extraction are triage techniques that do not expose the runtime resolution sequence.

Answer

Parse the PE section table and compare the raw size against the virtual size of each section

Answer

Extract printable ASCII and Unicode strings from the binary and filter for known Windows API names

Answer

Compute the file's MD5 and SHA-256 hashes and submit them to a public multi-engine scanning service

Question 12

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. For automated ingestion of STIX/TAXII indicators to drive incident response, the mandatory configuration is mapping STIX observable types (e.g., ipv4-addr, domain-name, file hashes) to the SIEM's local incident categories and severity levels. Without this mapping, indicators arrive but cannot be triaged, prioritized, or routed into the IR workflow.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 13

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Accepted Answer

MSSP. An MSSP (Managed Security Service Provider) is a third-party provider that delivers outsourced security monitoring and management services — such as 24/7 SOC operations, SIEM monitoring, and incident response — while the client organization retains ownership and control of its security posture and policies. This matches the scenario of outsourcing monitoring while retaining internal control.

Answer

Virtual SOC

Answer

Internal SOC

Answer

Hybrid Cloud SOC

Question 14

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

Accepted Answer

Isolate the workstation from the network using EDR. The immediate priority is to stop the malware from communicating and spreading. Isolating the endpoint via EDR achieves this by cutting off all network traffic from that host while preserving its state for investigation. This is a standard containment procedure that balances security with forensic integrity.

Answer

Run a full antivirus scan on the workstation

Answer

Block the C2 IP address at the perimeter firewall

Answer

Shut down the workstation immediately

Question 15

You are the SOC manager at a financial institution. During a monthly review, you notice that the mean time to detect (MTTD) security incidents has increased from 15 minutes to 3 hours over the past quarter. After investigation, you find that analysts are manually correlating alerts from the SIEM with threat intelligence feeds, which is time-consuming. Which action should you take FIRST to reduce MTTD?

Accepted Answer

Implement automated threat intelligence enrichment in the SIEM to correlate alerts with external feeds.. The increased MTTD is caused by manual correlation of SIEM alerts with threat intelligence feeds. Automating threat intelligence enrichment in the SIEM streamlines this process, providing analysts with enriched alerts that include external context. This reduces manual steps, accelerates triage, and directly lowers MTTD. Other options either add resources without fixing the process, reduce coverage, or suppress alerts, which are not sustainable solutions.

Answer

Reduce the number of threat intelligence feeds to only the most critical ones to simplify correlation.

Answer

Configure the SIEM to generate fewer alerts by raising the severity threshold for threat intelligence matches.

Answer

Increase the number of analysts on each shift to handle the manual correlation workload.

Question 16

A SOC analyst receives an alert about a possible data exfiltration attempt from a database server. The analyst needs to determine if large amounts of data were transferred outbound. Which network monitoring approach would best provide this information?

Accepted Answer

Review NetFlow records for outbound traffic volume from the database server.. NetFlow records capture flow-level metadata, including byte and packet counts, which can reveal unusually large outbound transfers indicative of data exfiltration. Unlike DNS logs, event logs, or antivirus logs, NetFlow directly measures the volume of data moving across the network. This makes it the most appropriate tool for determining if significant amounts of data were sent from the database server to an external destination.

Answer

Inspect DNS query logs for anomalous domain names.

Answer

Analyze Windows Security event logs for account logon events.

Answer

Check the server's antivirus logs for malware detections.

Question 17

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

Accepted Answer

The file has a high entropy value, especially in the code sections.. High entropy in code sections is a strong indicator of packing because packers compress or encrypt the original executable, resulting in randomized data. Tools like PEiD or Detect It Easy can identify known packers, but entropy analysis is a fundamental first step. In contrast, other options like digital signatures or import counts do not directly correlate with packing and may even suggest the opposite.

Answer

The file size is less than 100 KB.

Answer

The file has a large number of imported functions from kernel32.dll.

Answer

The file contains a digital signature from a known vendor.

Question 18

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring alerts, performing initial triage, and filtering out false positives. They validate whether an alert is a genuine security incident and escalate only confirmed incidents to Tier 2. This tier requires foundational skills and follows documented procedures to ensure basic incident filtering.

Answer

Tier 3

Answer

SOC Manager

Answer

Tier 2

Question 19

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endpoint. Which TWO of the following are host-based IoCs that should be prioritized for collection and analysis? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the JA3/JA3S fingerprints of the TLS handshake. JA3/JA3S fingerprinting is a passive technique that creates a fingerprint of the TLS handshake by hashing specific fields in the ClientHello and ServerHello. This allows identification of the client and server applications without decryption. In the scenario, comparing the JA3 hash to known malware families or legitimate applications can quickly indicate whether the traffic is likely C2. It does not disrupt the session and can be performed on network metadata, making it ideal for incident response.

Answer

Use NetFlow records to analyze packet sizes and timings

Answer

Perform SSL/TLS interception using a proxy with a trusted certificate

Answer

Deploy a honeypot to capture similar traffic

Question 20

A SOC team uses AWS Security Hub to centralize findings from GuardDuty, Inspector, and Macie. The team wants to automatically route only high-severity findings to an incident response ticketing system while suppressing informational findings. Which AWS Security Hub capability should the team configure to accomplish this?

Accepted Answer

Security Hub automation rules. Security Hub automation rules apply criteria to incoming findings and can automatically update, suppress, or route them. Matching severity labels HIGH and CRITICAL while suppressing INFORMATIONAL findings lets the team forward only actionable high-severity findings to the ticketing system without manual triage.

Answer

Security Hub Insights

Answer

Security Hub custom actions

Answer

Security Hub finding aggregation