312-39 Practice Test 21 — 15 Questions

Question 1

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the threshold for the number of failed attempts within the lookback window.. Increasing the threshold for the number of failed attempts within the lookback window directly reduces false positives by requiring a higher number of failures before triggering the rule. This is a standard tuning technique in Splunk ES correlation searches, where the threshold and window are configurable parameters. It maintains detection capability for genuine brute-force attacks while filtering out benign patterns like users mistyping passwords a few times.

Answer

Delete the correlation rule and recreate it.

Answer

Enable packet capture on all domain controllers.

Answer

Change the rule severity to 'Informational'.

Question 2

A SOC analyst is reviewing logs from a web server and notices that the logs contain entries with timestamps in the format '2025-04-01T14:23:45+02:00'. The SIEM is configured to display all events in UTC. What is the correct UTC time for this log entry?

Accepted Answer

2025-04-01 12:23:45 UTC. The log entry has a +02:00 offset, indicating the local time is two hours ahead of UTC. To convert to UTC, subtract two hours, resulting in 12:23:45 UTC. This normalization is essential for the SIEM to correctly order and correlate events from multiple sources with different time zones.

Answer

2025-04-01 16:23:45 UTC

Answer

2025-04-01 14:23:45 UTC

Answer

2025-04-01 14:23:45 local time, no conversion needed

Question 3

A SOC analyst is performing a proactive threat hunt for data exfiltration over DNS. The environment uses a corporate DNS resolver at 10.10.10.53. Which data source should the analyst query FIRST to identify high-volume, anomalous DNS TXT queries to external domains?

Accepted Answer

DNS resolver query logs forwarded to the SIEM. DNS resolver query logs are the authoritative, indexed source for DNS query content and volume. They let the analyst aggregate TXT queries per domain and per client, which is the core signal of DNS tunneling exfiltration. Packet capture, firewall denies, and NetFlow each miss the query-level detail needed for a fast, accurate proactive hunt.

Answer

Firewall deny logs for outbound port 53

Answer

Full packet capture (PCAP) stored for the last 7 days on the core switch

Answer

NetFlow records exported from the edge router

Question 4

What is the purpose of 'Dashboards' in a SIEM?

Accepted Answer

To visualize data and monitor trends.. Dashboards in a SIEM provide visual representations of data, such as charts, graphs, and tables, to help analysts monitor trends, detect anomalies, and gain situational awareness. They aggregate and display key metrics and log events in real time, enabling quick identification of security incidents. The primary purpose is visualization and monitoring, not data storage or network control.

Answer

To block network traffic.

Answer

To install software patches.

Answer

To store all log data.

Question 5

A SOC analyst is investigating a potential compromise in an AWS environment. The analyst suspects that an attacker used a set of temporary credentials obtained from an EC2 instance metadata service. Which AWS service should the analyst review to determine which IAM role was assumed and what actions were taken with those credentials?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, including calls made with temporary credentials from an assumed IAM role. The logs contain the role's ARN and session name, enabling the analyst to trace the actions back to the specific role and instance. Other services like GuardDuty, IAM Access Analyzer, or Inspector provide complementary security insights but lack the detailed audit trail required to reconstruct the attacker's actions.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

Amazon Inspector

Question 6

Which THREE items should be included in a standard incident containment report?

Accepted Answer

Current status of affected hosts. Option A is correct because a containment report must document the current status of affected hosts (e.g., isolated, powered off, reimaged, or still active) so responders and management know the present state of the environment. Option B is correct because timestamping containment actions establishes an accurate chronological timeline, which is essential for auditing, legal chain-of-custody, and post-incident review. Option E is correct because recording the technical methods used for containment (such as disabling a switch port, applying an EDR network-isolation policy, blocking an IP at the firewall, or revoking credentials) lets others verify, reproduce, or reverse the actions taken. Option C is not included because an analyst's home address is personal data irrelevant to incident containment. Option D is not included because employee payroll details are unrelated to containment and would introduce unnecessary privacy and compliance risk.

Answer

The analyst's home address

Answer

Employee payroll details

Question 7

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The analyst wants to alert on the specific event that indicates a service ticket was requested with weak RC4 encryption for an account with a Service Principal Name. Which Windows security event ID and field combination should be used?

Accepted Answer

Event ID 4769 with Ticket Encryption Type 0x17 and a non-machine account name in the Service Name field. Kerberoasting is detected by monitoring Kerberos service ticket requests. Event ID 4769 with RC4 encryption (0x17) and a user account SPN is the signature of a tool requesting a crackable ticket. TGT events, logon events, and pre-auth failures do not capture the weak service ticket request, so they cannot reliably detect this technique.

Answer

Event ID 4771 with Failure Code 0x18 and a service account in the Client User Name field

Answer

Event ID 4624 with Logon Type 3 and a service account in the TargetUserName field

Answer

Event ID 4768 with Ticket Encryption Type 0x12 and a user account in the TargetUserName field

Question 8

A SOC analyst is responding to a confirmed ransomware incident on a file server. The analyst must preserve evidence for potential legal action while also containing the threat. Which TWO actions should the analyst perform to maintain forensic soundness during containment? (Choose two.)

Accepted Answer

Capture a forensic image of the affected server's disk before any remediation. To maintain forensic soundness, the analyst must capture a forensic image of the affected disk before any remediation, ensuring a complete and unaltered copy of the evidence. Additionally, documenting the chain of custody with hashes and timestamps ensures the evidence remains admissible and its integrity can be verified. These actions preserve the ability to conduct a thorough investigation and support potential legal proceedings.

Answer

Run a decryption tool from the antivirus vendor to recover files immediately

Answer

Reboot the server into safe mode to stop the encryption process

Answer

Immediately delete the ransomware binaries to prevent further encryption

Question 9

Which of the following is considered a 'Network-based' IoC?

Accepted Answer

Suspicious domain name. A suspicious domain name is a network-based indicator of compromise because it appears in DNS queries, HTTP/TLS SNI, or proxy logs — artifacts observable on the network. Network IoCs include IPs, domains, URLs, and JA3 hashes.

Answer

Mutex name

Answer

Registry key path

Answer

File hash (SHA-256)

Question 10

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

Accepted Answer

Use a sandboxed/isolated browser environment. Analyzing a suspicious link in a sandboxed or isolated browser environment (e.g., Cuckoo Sandbox, Joe Sandbox, Any.Run, or a dedicated VM with no network access to production) prevents any malicious payload from executing on the analyst's real workstation. It allows safe observation of redirects, drive-by downloads, and credential-harvesting pages. This is a core phishing investigation best practice.

Answer

Open the link in your local browser

Answer

Download the link contents to your desktop

Answer

Forward the email to your personal account

Question 11

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

Accepted Answer

Level 3. Level 3 (Defined) in the CMMI-based SOC maturity model is characterized by documented, standardized processes that are consistently applied across the organization, but which still rely heavily on manual execution rather than automation. Since the SOC has documented standard processes but lacks consistent automation, it has achieved Level 3. Automation and continuous optimization are hallmarks of the higher levels (Level 4 Quantitative Managed and Level 5 Optimizing), not Level 3.

Answer

Level 5

Answer

Level 2

Answer

Level 1

Question 12

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

Accepted Answer

A known malicious IP address.. An Indicator of Compromise is an observable artifact that suggests a system may have been breached — a known malicious IP address, a file hash, a domain, a registry key, or a URL associated with attacker infrastructure. A malicious IP is the textbook IoC because it is a concrete, matchable technical artifact used to detect or scope intrusions.

Answer

The SIEM administrator's name.

Answer

The server name.

Answer

The company's office address.

Question 13

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Accepted Answer

certutil.exe. certutil.exe is a legitimate Windows certificate utility that attackers abuse for Living off the Land techniques — downloading files (certutil -urlcache -f), decoding base64 payloads (certutil -decode), and even installing rogue certificates. Its use by a non-administrative user, especially with URL or decode flags, is highly anomalous and warrants immediate investigation.

Answer

mspaint.exe

Answer

calc.exe

Answer

notepad.exe

Question 14

A SOC analyst is reviewing a security incident that involved a compromised user account. The analyst needs to determine the scope of the compromise by identifying all systems the attacker accessed. Which of the following is the most effective method to achieve this?

Accepted Answer

Analyzing authentication logs and correlating with endpoint telemetry. To scope a compromised account, analysts must trace all authentication events and subsequent activities. Authentication logs (e.g., from Active Directory, VPN, or SSO) show where the account was used, and endpoint telemetry (from EDR) shows what was done on those systems. Correlating these data sources builds a complete picture of the attacker's access. Other methods are either too narrow or lack technical detail.

Answer

Interviewing the user about their recent activities

Answer

Reviewing the user's email inbox for phishing messages

Answer

Running a full antivirus scan on the user's primary workstation

Question 15

A SOC analyst is triaging a SIEM alert for a possible insider threat. The alert indicates that a user accessed a file share containing sensitive financial data outside of normal business hours. The analyst needs to gather additional context to determine if this is malicious. Which TWO of the following actions should the analyst perform to enrich the alert? (Choose two.)

Accepted Answer

Review the user's recent file access history for unusual patterns.. The correct actions are to review the user's file access history and verify the login location and IP address. These steps provide context about whether the access is anomalous for the user and if the login is from a trusted location. This information helps determine if the alert is a true positive. Other actions like checking HR records or running vulnerability scans are not appropriate for initial triage.

Answer

Immediately disable the user's account to prevent data theft.

Answer

Run a vulnerability scan on the file server to check for missing patches.

Answer

Check the user's HR record for any recent disciplinary actions.