312-39 Practice Exam 2 — 20 Questions

Question 1

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

INetSim. INetSim is designed to simulate common internet services, including DNS, to study malware network behavior in an isolated environment.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 2

What is the purpose of 'Dashboards' in a SIEM?

Accepted Answer

To visualize data and monitor trends.. Dashboards visualize data to help analysts identify trends and monitor health.

Answer

To block network traffic.

Answer

To install software patches.

Answer

To store all log data.

Question 3

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

Accepted Answer

The rate of attempts compared to the attacker's potential speed.. The time window must be long enough to capture slow-and-low attacks but short enough to avoid excessive false positives.

Answer

The number of log sources in the SIEM.

Answer

The time of day the rule runs.

Answer

The disk space available in the SIEM.

Question 4

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

Accepted Answer

VirusTotal. VirusTotal aggregates results from multiple AV vendors, providing a comprehensive report on a file hash.

Answer

Google Search

Answer

Microsoft Update

Answer

WHOIS

Question 5

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Accepted Answer

Suspicious sender address. Unusual sender addresses and urgent language are classic phishing indicators.

Answer

The email is sent during business hours

Answer

The email has a subject line

Answer

The email is from the CEO

Question 6

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

Accepted Answer

Restrict the search to a specific time range and relevant indexes.. Filtering by time range and limiting fields are standard practices to optimize SIEM performance.

Answer

Use wildcard searches on all fields.

Answer

Add more fields to the search result.

Answer

Increase the search timeout.

Question 7

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Actionable intelligence must be context-rich, relevant to the infrastructure, and integrated into existing workflows.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 8

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Identifying long-duration connections and baseline deviations in data volume are the most effective ways to spot slow exfiltration.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall

Question 9

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Accepted Answer

Threat Hunter and Tier 2/3 Analyst. Threat hunters and Tier 2/3 analysts need frequent communication to pivot between tactical and strategic investigations.

Answer

SOC Manager and IT Support

Answer

Tier 1 Analyst and Compliance Officer

Answer

SOC Manager and HR

Question 10

Which SIEM feature is used to group related events into a single incident?

Accepted Answer

Event correlation logic.. Correlation engines or incident management modules group events based on shared attributes.

Answer

Log rotation.

Answer

Dashboard visualization.

Answer

Data ingestion.

Question 11

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

Accepted Answer

Configure an Offense rule using the 'when the event matches any of these building blocks' condition and apply a 'count of unique Source IP is greater than or equal to 3' filter within the temporal window.. Using a Building Block (BB) allows for reusable logic. Combining a threshold condition with a 'unique count' filter on source IP addresses ensures the rule only fires when the specific cross-IP threshold is met.

Answer

Use a simple threshold rule set to trigger only on the 5th failure without defining distinct source IP criteria.

Answer

Create a rule using the 'when the event matches any of these building blocks' condition combined with an 'and when at least 5 events are seen with the same username in 1 minute' filter.

Answer

Enable the 'Flow-based Anomaly' detection setting in the system configuration to automatically detect brute-force patterns.

Question 12

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

Accepted Answer

Alert Triage and Prioritization. Triage and prioritization involve categorizing and assessing the urgency of alerts to focus on the most critical threats.

Answer

Vulnerability Assessment

Answer

Correlation Rule Development

Answer

Incident Eradication

Answer

Log Retention Analysis

Question 13

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Accepted Answer

To maintain persistent communication. The goal is to maintain communication between the compromised system and the attacker's infrastructure.

Answer

To escalate privileges

Answer

To steal data

Answer

To gain initial access

Question 14

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

Accepted Answer

Increase the threshold for the number of failed attempts within the lookback window.. Risk-based alerting and threshold tuning are standard practices to reduce noise in SIEM correlation rules.

Answer

Delete the correlation rule and recreate it.

Answer

Enable packet capture on all domain controllers.

Answer

Change the rule severity to 'Informational'.

Question 15

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. Collectors gather data from various sources and forward it to the main processing engine.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 16

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Triage involves verification, context gathering, and determining impact.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 17

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Accepted Answer

An automated process or script is likely involved.. Rapid-fire failures usually indicate a script or bot, rather than a human user.

Answer

The server is overheating.

Answer

A user is having a bad day.

Answer

The SIEM is broken.

Question 18

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Aligning to threat frameworks (like MITRE ATT&CK) and testing against historical data are the pillars of effective use case engineering.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 19

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Baseline behavioral profiling and using multiple conditions (cross-correlation) help reduce noise by ensuring that only significant deviations trigger an alert.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.

Question 20

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. Updating the 'Assigned to' or 'Assignment group' fields while using the 'Work notes' to trigger a business rule notification is the standard workflow.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'