312-39 Practice Exam 4 — 20 Questions

Question 1

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Cloud (specifically the Endpoint protection or integrated EDR) provides process-level visibility and alerts for suspicious activity on VMs.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 2

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

Accepted Answer

Cloud Logging. VPC Flow Logs in GCP are integrated directly into Cloud Logging to track network connections.

Answer

VPC Service Controls

Answer

Google Cloud Armor

Answer

Security Command Center

Question 3

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Accepted Answer

Modification of CloudTrail or logging configurations. Unauthorized changes to IAM policies, disabling of logging services, and unexpected creation of resources in unfamiliar regions are top indicators of compromise.

Answer

Increased usage of free-tier services

Answer

Standard scheduled system reboots

Question 4

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates findings from various AWS security services like GuardDuty, Inspector, and Config into a single view.

Answer

AWS Artifact

Answer

AWS Shield

Answer

AWS Trusted Advisor

Question 5

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Accepted Answer

Cloud Storage Data Access logs. Cloud Storage Data Access logs (found in Cloud Logging) contain granular details about which objects (files) were read or modified.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring metrics

Answer

Cloud Load Balancing logs

Question 6

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Accepted Answer

Enable global service events. Enabling global service events and log file integrity ensure that all actions are captured and that logs remain tamper-proof.

Answer

Disable SNS notifications

Answer

Limit logs to one region

Answer

Encrypt logs with a public key

Question 7

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

Accepted Answer

Newly created service name. Host-based IoCs are artifacts found on the endpoint itself, such as files, registry changes, or running processes.

Answer

SMTP server response codes

Answer

Malicious URL visited

Answer

Source IP address of an attack

Question 8

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Recording the exact time of collection and the identity of the person collecting it are fundamental requirements for chain of custody.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 9

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Accepted Answer

The polling interval for the API is set too high.. API polling intervals are the most common source of latency in cloud log ingestion.

Answer

The SIEM storage is full.

Answer

The cloud provider is down.

Answer

The SIEM license limit is reached.

Question 10

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Accepted Answer

Obtaining instructions from the threat actor. C2 allows the attacker to maintain access and send instructions to the compromised host.

Answer

Exploiting a zero-day vulnerability

Answer

Gathering system information

Answer

Encrypting files for ransom

Question 11

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Accepted Answer

Active network connections. Volatile data is lost when power is removed, making it the highest priority for collection.

Answer

Browser history files

Answer

Registry hive files on disk

Answer

Hard drive partition table

Question 12

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

Accepted Answer

Investigate the destination server's logs to see if the attack succeeded.. Triage involves confirming the intent and success of the attack, not just the signature match.

Answer

Reimage the database server.

Answer

Close the alert as 'Benign'.

Answer

Block the source IP on the edge firewall.

Question 13

Which of the following is considered a 'Network-based' IoC?

Accepted Answer

Suspicious domain name. Network-based IoCs include IP addresses, domain names, and URLs associated with malicious activity.

Answer

Mutex name

Answer

Registry key path

Answer

File hash (SHA-256)

Question 14

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a tool that identifies file types and packers based on entropy and signature analysis.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 15

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis focuses on file properties, strings, and structural headers to identify potential malicious intent without execution.

Answer

Memory usage patterns

Answer

Network latency to the server

Question 16

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Accepted Answer

excel.exe. When a malicious macro runs, it often triggers 'cmd.exe' or 'powershell.exe' from the 'excel.exe' process tree.

Answer

explorer.exe

Answer

wininit.exe

Answer

svchost.exe

Question 17

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is specifically designed to view the structure of Portable Executable (PE) files including headers and imports.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 18

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. Using a transparent SSL/TLS proxy (like an intercepting proxy) allows the analyst to decrypt traffic if the certificate is trusted by the client.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 19

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Accepted Answer

Verify if the connection was successful or blocked by the firewall.. Verifying if the connection was successful is essential to confirm if a threat exists.

Answer

Isolate the host immediately.

Answer

Reimage the affected workstation.

Answer

Contact the user's manager.

Question 20

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Accepted Answer

Joins allow matching records between two datasets based on a common field.. Joins allow for the association of different data types based on common entities like IP addresses or hostnames.

Answer

Unions only support structured data.

Answer

Joins consume less memory than unions.

Answer

Unions cannot be used in detection rules.