312-39 Practice Exam 4 — 20 Questions

Question 1

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Accepted Answer

netstat -tulnp. The command 'netstat -tulnp' lists all TCP (-t) and UDP (-u) listening (-l) sockets, shows numeric addresses (-n), and includes the process ID and program name (-p) that owns each socket. This directly maps a network socket to the rogue process, which is exactly what the analyst needs. The -p flag requires root privileges but provides the critical process-to-socket association.

Answer

top

Answer

ps aux

Answer

lsmod

Question 2

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Accepted Answer

Security Content Engineer. The Security Content Engineer is the role dedicated to authoring, tuning, and maintaining detection content such as SIEM correlation rules, use cases, and parsers. This role owns the health and efficacy of the detection pipeline, which is exactly what the question describes. Other roles focus on response, governance, or management rather than content lifecycle.

Answer

Incident Responder

Answer

Compliance Officer

Answer

SOC Manager

Question 3

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

Accepted Answer

CloudWatch Unified Agent. The CloudWatch Unified Agent (formerly the unified CloudWatch agent) is the AWS-supported agent that runs on on-premises servers and can collect and forward logs (and metrics) to CloudWatch Logs over the public AWS endpoints. It supports both the logs and metrics plugins in a single agent, making it the correct choice for streaming on-premises logs into CloudWatch. The other options are AWS services, not agents installed on a server.

Answer

Simple Queue Service (SQS)

Answer

Kinesis Firehose

Answer

AWS Config

Question 4

A SOC analyst is performing live forensic triage on a Windows Server 2019 host suspected of a credential-dumping attack. The analyst wants to identify whether the LSASS process memory has been accessed by an unauthorized tool in the last 24 hours. Which Windows event log source and event ID should the analyst review?

Accepted Answer

Sysmon operational log, event ID 10. Sysmon event ID 10 (ProcessAccess) captures handle opens to other processes, including the source image, target image, and granted access rights. When Sysmon is configured with a rule for lsass.exe, it provides direct evidence of credential-dumping tools accessing LSASS. Security 4688 and 4624 and System 7045 do not record process-to-process handle operations, so they cannot answer the specific question.

Answer

Security log, event ID 4624

Answer

System log, event ID 7045

Answer

Security log, event ID 4688

Question 5

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. A SIEM collector is a dedicated component that receives log data from various sources (servers, network devices, applications) and forwards it to the central SIEM processing engine. It acts as a log aggregator and forwarder, often using protocols like syslog, SNMP, or agent-based collection. The collector does not perform analysis, encryption, or blocking; those are functions of other SIEM components or security controls.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 6

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the correct answer because it allows an analyst to submit a file hash (MD5, SHA-1, or SHA-256) and instantly cross-reference it against 70+ antivirus engines, URL/domain scanners, and sandbox behavioral analysis tools in a single query. This multi-engine aggregation gives a much higher detection confidence than any single AV product, and it also returns community comments and vendor-specific verdicts. For SOC analysts verifying whether an executable is known-malicious, VirusTotal is the industry-standard first stop.

Answer

Google Search

Answer

Microsoft Update

Answer

WHOIS

Question 7

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made in an AWS account, including the identity of the caller, the action performed, the source IP address, and the timestamp. Querying CloudTrail event history or a CloudTrail Lake/Athena-backed trail lets you pinpoint the exact API call and originating IP for the unauthorized IAM role usage.

Answer

AWS Systems Manager

Answer

AWS Config

Answer

Amazon GuardDuty

Question 8

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

Accepted Answer

HKCU\Software\Classes\CLSID. Option B (HKCU\Software\Classes\CLSID) is correct because per-user COM object registrations under the Classes\CLSID hive can be hijacked or created to point to malicious DLLs, enabling persistence via COM hijacking when a legitimate application instantiates the CLSID. Option C (HKLM\System\CurrentControlSet\Services) is correct because this key stores Windows service definitions, including the ImagePath and ServiceDLL values that attackers modify or add to run malicious code as a service at boot. Option E (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is correct because Run keys are a classic autostart location whose values execute programs at user logon, a very common persistence mechanism. Option A is not a persistence location; the Nls\Language key holds locale/language configuration data. Option D is also not a persistence location; FontSubstitutes merely maps font substitution names and does not execute code.

Answer

HKLM\System\CurrentControlSet\Control\Nls\Language

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

Question 9

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Accepted Answer

The polling interval for the API is set too high.. The polling interval determines how frequently the SIEM queries the cloud provider's API for new log data. If this interval is set too high (e.g., every 15 minutes instead of every minute), logs accumulate between polls and alerts are only generated after the next poll cycle, producing the observed high latency. Reducing the polling interval (or switching to a push/streaming mechanism like webhooks or syslog forwarding) directly decreases alert generation delay.

Answer

The SIEM storage is full.

Answer

The cloud provider is down.

Answer

The SIEM license limit is reached.

Question 10

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Accepted Answer

Run host isolation playbook. Host isolation is the fastest way to stop an active threat from spreading laterally or exfiltrating data, and it preserves the endpoint state for later forensics. In a SOAR playbook, isolation is typically the first automated containment action because it is reversible and low-impact compared to network-wide changes.

Answer

Reset all user passwords

Answer

Perform full forensic imaging

Answer

Update the firewall rule base

Question 11

A SOC is implementing a new use case to detect credential dumping on Windows endpoints. The detection engineering team wants to combine multiple telemetry sources to reduce false positives and improve coverage. Which two data sources should be prioritized to reliably detect credential dumping activity? (Choose two.)

Accepted Answer

Sysmon events for process access to the LSASS process. Credential dumping detection benefits from combining process creation telemetry, which shows what executed and with what arguments, and Sysmon process access events, which show suspicious access to LSASS. Together they provide both the actor and the target, enabling high-fidelity alerts. Network, DHCP, and email logs lack the endpoint process and memory access visibility required for this specific behavior.

Answer

NetFlow records showing outbound traffic volume from the endpoint

Answer

DHCP logs showing IP address leases for the endpoint

Answer

Email gateway logs showing inbound messages with attachments

Question 12

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Accepted Answer

Cloud Storage Data Access logs. Cloud Storage Data Access logs record every read and write operation against objects in a bucket, including the identity, timestamp, and specific object names accessed. To identify which files were exfiltrated, the analyst must review these logs for GET/read operations during the alert window. This is the only option that captures per-object access detail.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring metrics

Answer

Cloud Load Balancing logs

Question 13

Which of these is a common SIEM data ingestion protocol?

Accepted Answer

Syslog.. Syslog is the de facto standard protocol for transmitting event and log messages from network devices, servers, and applications to a central SIEM collector. It operates over UDP or TCP (typically port 514) and supports structured or unstructured messages, making it ideal for heterogeneous log sources. SIEM platforms natively parse syslog formats (RFC 3164 and RFC 5424) to normalize and correlate events. While HTTP can be used for some API-based ingestion, syslog remains the most common and purpose-built protocol for SIEM data collection.

Answer

ICMP.

Answer

HTTP.

Answer

DHCP.

Question 14

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

Accepted Answer

Check the firewall logs for allowed outbound connections to the suspicious IP.. To validate the potential data exfiltration alert, you need to correlate network and endpoint evidence. EDR data reveals the process responsible for the connection, while firewall logs confirm if the traffic was allowed and the volume transferred. Together, they provide a clear picture of whether data left the network. Blocking, scanning, or email review are either containment or less direct investigative steps that do not immediately confirm the true positive.

Answer

Immediately block the suspicious IP address at the perimeter firewall.

Answer

Review the user's recent email activity for signs of phishing.

Answer

Run a full antivirus scan on the affected endpoint.

Question 15

A SOC analyst in an AWS environment receives an alert that an EC2 instance is making unusual outbound DNS queries to a domain associated with command-and-control activity. The analyst needs to identify the full chain of API calls that led to the instance's current state, including any IAM role assumptions or network modifications. Which AWS service should the analyst use to retrieve this information?

Accepted Answer

AWS CloudTrail. CloudTrail is the authoritative source for API activity in AWS, capturing management and data events across services. In this scenario, the analyst needs to correlate the EC2 instance's activity with API calls such as RunInstances, ModifyNetworkInterface, and AssumeRole to understand how the instance was compromised or configured. GuardDuty, AWS Config, and VPC Flow Logs each provide partial visibility but lack the comprehensive API call history that CloudTrail delivers.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon GuardDuty

Question 16

Which TWO of the following are primary components of a cloud-native incident response plan?

Accepted Answer

Containment. Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61. Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Answer

Resource Provisioning

Answer

Budget Optimization

Answer

Hardware Refresh

Question 17

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

Accepted Answer

HTTP/HTTPS proxy logs. Data exfiltration to cloud storage providers such as Dropbox, Google Drive, or OneDrive typically occurs over HTTP/HTTPS, so proxy logs capture the destination URLs, bytes transferred, user identity, and timestamps needed to detect large uploads. Proxy logs are the primary evidence source for identifying which host sent how much data to which external cloud endpoint.

Answer

DHCP logs

Answer

NTP logs

Answer

SNMP logs

Question 18

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Option B is correct because Chain of Custody documentation must identify the person who collected or handled the evidence, establishing accountability for every transfer and ensuring the evidence can be traced to a responsible individual. Option E is correct because the date and time of collection are essential custody metadata that establish when the evidence was seized, helping prove it was not altered or tampered with before analysis. Together, the collector's identity and the collection timestamp are core elements required to demonstrate an unbroken custody trail. Options A, C, and D are incorrect because hard drive casing color, CPU manufacturer, and system temperature are irrelevant hardware or environmental details that do not establish who handled the evidence or when it was collected.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 19

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

Accepted Answer

Provides real-time context to alerts.. Threat intelligence integration enriches SIEM alerts with real-time context such as known malicious IPs, domains, file hashes, and adversary tactics. This context helps analysts quickly determine whether an alert is benign or part of a known campaign, improving triage speed and accuracy. It does not replace human analysts or automate response; it augments detection and investigation.

Answer

Increases the log ingestion rate.

Answer

Replaces the need for a SOC team.

Answer

Automates all incident response.

Question 20

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Accepted Answer

Keep logs for one year, with 3 months immediately available. PCI-DSS requirement 10.7 mandates retaining audit logs for at least one year, with a minimum of three months immediately available for analysis. This ensures that logs are accessible for forensic investigations and compliance audits, while older logs can be archived but must be retrievable.

Answer

Archive all logs in a local text file format only

Answer

Retain logs for exactly 30 days

Answer

Delete logs after they are indexed in the SIEM