312-39 Practice Exam 3 — 20 Questions

Question 1

A SOC analyst is reviewing a SIEM alert that fired on a suspicious PowerShell execution. The command line includes an encoded parameter and a download cradle. The analyst confirms the endpoint is a developer workstation used for legitimate automation. Which action best balances security and business continuity while still validating the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Decode the PowerShell command, review the parent process, and check the endpoint for related network connections. Decoding the encoded PowerShell command and reviewing parent process and network connections provides concrete evidence to determine whether the activity is legitimate automation or malicious. This validation step preserves business continuity for the developer while enabling confident escalation if needed. Premature containment or blanket policy changes can disrupt operations and destroy evidence.

Answer

Close the alert as benign because the workstation belongs to a developer

Answer

Immediately disable the user's Active Directory account and isolate the workstation

Answer

Block all PowerShell execution on the workstation via Group Policy

Question 2

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 3

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

Accepted Answer

Implement multi-stage correlation rules that require high-confidence indicators to fire. Multi-stage correlation rules require multiple high-confidence indicators to align before generating an alert, which directly reduces false positives and improves the Signal-to-Noise ratio. By chaining events (e.g., a suspicious login followed by unusual data access), the SIEM fires only on genuinely suspicious behavior rather than on isolated low-fidelity events. This is the standard SOC practice for tuning detection content to combat alert fatigue.

Answer

Increase the retention period for all raw log data

Answer

Lower the threshold for all IDS alerts to catch more threats

Answer

Outsource all monitoring to a managed security provider

Question 4

A SOC analyst is investigating a suspected compromise of an AWS Lambda function. The analyst needs to determine what code was executed and which IAM role the function assumed during the suspicious activity. Which AWS service should the analyst use to review the function's configuration and execution role?

Accepted Answer

AWS Lambda console or GetFunction API. The Lambda console and GetFunction API are correct because they expose the function's configuration, including the execution role and the code package. An analyst can retrieve the role ARN and download the code to review what was executed. CloudTrail, CloudWatch Logs, and X-Ray provide runtime or API-level data but not the function's configured role or code.

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 5

You are a SOC analyst at a company that uses Microsoft 365. You receive an alert that a user's mailbox is being accessed from an unusual location. You need to review the mailbox audit logs to determine which operations were performed and by whom. Which Microsoft 365 tool should you use to search these logs?

Accepted Answer

Microsoft 365 compliance center audit log search. The Microsoft 365 compliance center audit log search queries the unified audit log, which captures mailbox operations such as MailItemsAccessed, SendAs, and SendOnBehalf. This is the authoritative source for investigating suspicious mailbox access and determining which operations were performed and by whom. Other tools like Defender for Cloud Apps or Microsoft Entra ID sign-in logs provide complementary data but lack the granular mailbox audit events needed here.

Answer

Azure Active Directory sign-in logs

Answer

Exchange admin center mail flow rules

Answer

Microsoft Defender for Cloud Apps activity log

Question 6

A SOC analyst is investigating a suspected compromised Windows 10 workstation. The analyst wants to determine which removable USB storage devices were connected to the host and correlate that activity with a suspicious data exfiltration alert. Which artifact or registry location should the analyst examine FIRST to enumerate historically connected USB mass storage devices?

Accepted Answer

The SYSTEM hive, under ControlSet00X\Enum\USBSTOR. USBSTOR under the SYSTEM hive is the canonical persistent record of USB mass storage devices attached to a Windows system, storing device instance IDs with vendor, product, and revision strings. It survives device removal and reboots, allowing retrospective enumeration. MountPoints2 supplements this per-user, while Policy\Secrets and SAM hold credential and account data unrelated to device history.

Answer

The NTUSER.DAT hive, under Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

The SECURITY hive, under Policy\Secrets

Answer

The SAM hive, under SAM\Domains\Account\Users

Question 7

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Accepted Answer

Use of removable media or virtual volumes. Shimcache (AppCompatCache) records metadata about executables that were present on the system, including the volume path from which they executed. An entry referencing a volume that no longer exists (e.g., a drive letter or GUID not currently mounted) strongly suggests the executable ran from removable media (USB drive) or a virtual/mounted volume that has since been detached. This is a classic indicator of tool execution from external media.

Answer

Memory corruption

Answer

Log manipulation

Answer

System update failure

Question 8

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

Answer

Cloud Trace

Answer

Deployment Manager

Answer

Cloud Billing

Question 9

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

Accepted Answer

Create a custom DSM and map the event IDs to existing QIDs.. When events are parsed but not mapped to a QID, QRadar cannot normalize them for correlation and offense generation. The correct next step is to create a custom DSM (Device Support Module) or modify the existing one to map the event IDs to appropriate QIDs. This ensures the events are properly categorized and can contribute to offenses.

Answer

Increase the storage allocation for the log source.

Answer

Upgrade the firmware on the log source.

Answer

Restart the Event Processor service.

Question 10

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Immediately after imaging the original media, the examiner must compute a cryptographic hash (e.g., SHA-256 or MD5) of both the original and the forensic copy and compare them. Matching hashes prove the copy is a bit-for-bit duplicate and that the original was not altered during acquisition, establishing the chain of custody and evidentiary integrity. This is the foundational step for admissibility in legal proceedings.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file

Question 11

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Accepted Answer

To validate and scope the threat. The primary function of an IoC is to validate that a compromise has occurred and to scope its extent — confirming the threat is real and determining which systems, accounts, or network segments are affected. IoCs act as matchable artifacts that turn a suspicion into a confirmed, bounded incident, enabling targeted containment.

Answer

To communicate with law enforcement

Answer

To prevent future incidents

Answer

To manage system backups

Question 12

Which of the following describes 'Event Correlation' in a SIEM?

Accepted Answer

Linking related events to identify security threats.. Event correlation in a SIEM is the process of analysing multiple log events from disparate sources and linking them together based on shared attributes (same user, same IP, same timeframe) to detect patterns that individually appear benign but collectively indicate a threat. It is the analytical engine behind use cases like detecting brute-force followed by successful login. It is not a storage, reporting, or maintenance function.

Answer

Compressing logs for storage.

Answer

Generating reports for management.

Answer

Updating the SIEM software.

Question 13

Which THREE of the following are common challenges in SIEM correlation rule development?

Accepted Answer

High rates of false positives.. Option A (High rates of false positives) is correct because correlation rules that are too broad or poorly tuned generate large volumes of benign alerts, overwhelming analysts and causing alert fatigue, which is a well-known SIEM tuning challenge. Option D (Poor log data quality) is correct because correlation depends on normalized, time-synchronized, and complete log sources; missing fields, inconsistent formats, or absent logs from key devices break rule logic and produce unreliable detections. Option E (Difficulty in finding skilled SIEM engineers) is correct because effective rule development requires expertise in query languages, log source parsing, threat detection logic, and tuning, and organizations frequently struggle to hire and retain personnel with these specialized skills. Options B (The SIEM is too colorful) and C (The SIEM is too small to fit in a rack) are not legitimate challenges in correlation rule development, as they describe superficial or physical characteristics rather than technical or operational issues affecting rule creation and accuracy.

Answer

The SIEM is too colorful.

Answer

The SIEM is too small to fit in a rack.

Question 14

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Accepted Answer

/etc/logrotate.conf. The logrotate utility reads its global configuration from /etc/logrotate.conf, which defines default retention (rotate count), compression, frequency, and permissions, and also includes per-application drop-in files from /etc/logrotate.d/. This is the canonical file administrators edit to control retention and compression behavior system-wide.

Answer

/var/log/messages

Answer

/etc/rsyslog.conf

Answer

/etc/sysctl.conf

Question 15

During triage of a suspected intrusion, a SOC analyst observes that a user account belonging to the finance department successfully authenticated from an IP address geolocated in a country where the company has no operations, at 03:00 local time. The account had no prior logins from that region. Which phase of the attack lifecycle does this most directly represent?

Accepted Answer

Initial Access via valid accounts. An out-of-geography, off-hours successful login to a legitimate account is a valid-accounts Initial Access event. The attacker has entered the environment using stolen credentials. The other phases require additional evidence such as privilege changes, internal pivoting, or data transfers that are not present in the described log.

Answer

Exfiltration over a command and control channel

Answer

Lateral Movement via remote services

Answer

Privilege Escalation via exploitation for privilege escalation

Question 16

Which TWO metrics are essential for measuring the efficiency of an incident response team?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) (B) is essential because it directly quantifies how quickly the incident response team detects, acknowledges, and begins mitigating incidents, making it a core efficiency indicator of response speed and effectiveness. Incident volume per analyst (E) is also essential because it measures team throughput and workload distribution, showing how many incidents each analyst handles and helping assess capacity, staffing, and productivity. The other options do not belong: emails sent to stakeholders (A) is a communication activity, not an efficiency metric; average analyst salary (C) is a cost/HR figure unrelated to response performance; and building security badge access logs (D) are physical security data, not incident response efficiency measurements.

Answer

Number of emails sent to stakeholders

Answer

Average salary of analysts

Answer

Building security badge access logs

Question 17

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

Accepted Answer

Memory dump, then disk image. The correct order is memory dump first, then disk image, because memory is the most volatile evidence and is lost on shutdown or reboot. Capturing RAM before touching the disk preserves running processes, network connections, encryption keys, and malware that only exists in memory. Disk imaging afterward captures the persistent state without destroying the volatile evidence.

Answer

Reboot, then memory dump

Answer

Disk image, then memory dump

Answer

Suspend, then disk image

Question 18

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Accepted Answer

To reuse common logic in multiple rules.. In IBM QRadar, a Building Block is a reusable rule component that encapsulates common logic — such as a set of log sources, a filter condition, or a threshold — so it can be referenced by multiple correlation rules. This promotes consistency and reduces duplication. When the building block is updated, every rule that references it inherits the change, which is critical for maintaining large rule sets.

Answer

To delete logs from the storage.

Answer

To backup the configuration.

Answer

To generate reports automatically.

Question 19

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

Accepted Answer

WHOIS database. The WHOIS database is the correct source because it stores domain registration records including the registrar, registrant contact information, creation date, expiration date, and name servers. Querying WHOIS for a malicious domain reveals when it was registered, which helps assess whether it's a newly created domain (common in phishing/malware campaigns) or an older compromised domain.

Answer

DNSSEC database

Answer

IP Reputation database

Answer

Passive DNS database

Question 20

Which THREE actions are appropriate during the eradication phase of a malware incident?

Accepted Answer

Patching the underlying vulnerability. Patching the underlying vulnerability (A) is correct because eradication must close the initial attack vector so the malware cannot be re-introduced or re-exploited after cleanup. Scanning the network for other infected hosts (B) is correct because eradication requires identifying and removing all instances of the malware across the environment, not just on the initially discovered system. Removing malicious binaries (D) is correct because deleting the malware files, persistence mechanisms, and associated artifacts is the core action of eradicating the threat from affected systems. Adding the attacker on social media (C) is not an incident response action and could compromise the investigation or create operational security risks. Deleting the entire server (E) is a disproportionate, destructive action that would cause unnecessary data and service loss rather than targeted eradication.

Answer

Adding the attacker on social media

Answer

Deleting the entire server