312-39 Practice Exam 3 — 20 Questions

Question 1

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Accepted Answer

Number of affected systems. Business criticality, threat intelligence context, and the number of affected hosts are fundamental metrics for determining the priority of an incident.

Answer

The color scheme of the SIEM dashboard

Answer

The time of day the alert was generated

Question 2

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

Accepted Answer

ip.src == 192.168.1.50. The 'ip.src' filter isolates traffic originating from the specified source IP.

Answer

ip.addr == 192.168.1.50

Answer

src.ip == 192.168.1.50

Answer

filter: 192.168.1.50

Question 3

You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?

Accepted Answer

PowerShell Script Block Logging. Script Block Logging (Event ID 4104) is required to capture the full content of executed PowerShell scripts.

Answer

AppLocker

Answer

Credential Guard

Answer

Audit Process Creation

Question 4

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. Modifying the Security Group associated with the instance is the standard practice to isolate it while maintaining the state for forensics.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance

Question 5

Which document is essential for recording every action taken during an incident for legal and audit purposes?

Accepted Answer

Incident Response Log/Journal. An Incident Log (or Journal) is mandatory for maintaining a chronological record of all response actions.

Answer

Change Management Request

Answer

System Configuration Document

Answer

Business Continuity Plan

Question 6

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

Accepted Answer

Comparing source IP against threat intel feeds of VPN exit nodes. Reviewing connection logs for anomalous login times and comparing them against known VPN exit node lists is the primary technique.

Answer

Analyzing DNS queries

Answer

Checking OS version

Answer

Scanning the source IP

Question 7

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

Accepted Answer

wecutil es. wecutil es (enum-subscriptions) is the standard utility for managing and checking WEF subscriptions.

Answer

wmic eventlog

Answer

winrm get config

Answer

gpresult /r

Question 8

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

Accepted Answer

Use a sandboxed/isolated browser environment. A secure sandbox or isolated browser provides a safe environment to observe the link's behavior.

Answer

Open the link in your local browser

Answer

Download the link contents to your desktop

Answer

Forward the email to your personal account

Question 9

Which THREE factors contribute to 'dwell time' in a security incident?

Accepted Answer

Inadequate logging visibility. Dwell time is the duration between the start of an intrusion and its detection.

Answer

The number of coffee machines in the SOC

Answer

The speed of the network

Question 10

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Accepted Answer

Keep logs for one year, with 3 months immediately available. PCI-DSS requires at least one year of retention, with at least three months of logs immediately available for analysis.

Answer

Archive all logs in a local text file format only

Answer

Retain logs for exactly 30 days

Answer

Delete logs after they are indexed in the SIEM

Question 11

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

Accepted Answer

Implementing TLS-based log forwarding. TLS encryption (via Syslog-ng or Rsyslog with TLS) ensures both confidentiality and integrity of the logs.

Answer

Utilizing SNMPv1 traps

Answer

Encapsulating logs in cleartext UDP packets

Answer

Using standard port 514 without encryption

Question 12

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Calculating the time delta between connections is the standard method for identifying the consistent heartbeat of C2 beacons.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 13

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

Accepted Answer

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/. The use of macros like $HOST or $YEAR allows for dynamic directory creation based on incoming log metadata.

Answer

Defining separate log paths for every individual IP address

Answer

Configuring the global log_level to debug

Answer

Using hardcoded static path strings only

Question 14

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. The mapping of threat attributes to incident severity and category is critical for automated workflow triggering.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 15

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Accepted Answer

Perform frequency analysis (stack counting) on the command-line arguments across the environment. Stack counting (frequency analysis) is a standard hunting method to isolate outliers in command-line execution patterns.

Answer

Enable verbose logging on all domain controllers

Answer

Run a full antivirus scan on the affected workstation

Answer

Reimage the host immediately to prevent lateral movement

Question 16

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Accepted Answer

certutil.exe. Certutil.exe is frequently misused to download files or decode malicious payloads, making its use by standard users a red flag.

Answer

mspaint.exe

Answer

calc.exe

Answer

notepad.exe

Question 17

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. Mean Time to Acknowledge (MTTA) specifically measures the time from alert generation to human intervention.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time

Question 18

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Accepted Answer

Standardized handover and documentation. Standardization of playbooks and handoff procedures ensures continuity across different time zones.

Answer

Purchasing a new SIEM license

Answer

Moving all logs to the cloud

Answer

Increasing the number of Tier 3 analysts

Question 19

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Accepted Answer

Updating correlation rules based on new IOCs. Integrating external threat feeds to update correlation rules is a core function of threat intelligence within operations.

Answer

Hardening server images

Answer

Managing SOC budget

Answer

Writing compliance reports

Question 20

Which TWO factors are most critical when calculating the ROI of a SOC?

Accepted Answer

Cost of potential data breach incidents. ROI in a SOC is calculated by comparing the reduction in risk (potential cost of breach) and the operational costs (tools/personnel).

Answer

Number of social media followers

Answer

Office space square footage

Answer

Number of coffee machines in the SOC