312-39 Practice Test 22 — 15 Questions

Question 1

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

Accepted Answer

S3 Data Events. AWS GuardDuty uses S3 Data Events (CloudTrail S3 data events) as the data source to detect unusual S3 bucket access. When you enable S3 Protection in GuardDuty, it analyzes CloudTrail management and data events for S3, such as GetObject, PutObject, and DeleteObject, to identify suspicious activity like anomalous API calls or unusual user behavior. Without S3 Data Events enabled, GuardDuty cannot monitor object-level operations in S3 buckets.

Answer

VPC Flow Logs

Answer

EBS Snapshot logs

Answer

Route 53 Resolver query logs

Question 2

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. MTTA (Mean Time to Acknowledge) measures the average time between an alert being generated and an analyst acknowledging or being assigned to it, which is exactly the detection-to-assignment interval the SOC wants to optimize. Analyzing MTTA isolates delays in triage routing, queue assignment, or analyst availability. MTTR, by contrast, covers the entire lifecycle through resolution and would mask where the bottleneck actually sits.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time

Question 3

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Accepted Answer

Active network connections. Option C (Active network connections) is correct because running connections exist only in memory and in the kernel's network state tables; once the system is powered off or the connection closes, that state is lost, so it must be captured first with tools like netstat, ss, or tcpdump. Option E (System RAM contents) is correct because RAM is the most volatile evidence of all—it holds running processes, encryption keys, open files, and network buffers that vanish the instant power is removed, making a memory image (e.g., via FTK Imager or WinPmem) a top priority. The unmarked options are not volatile: browser history files (A) and registry hive files (B) reside on disk and persist after shutdown, and the hard drive partition table (D) is likewise stored on the disk's master boot record or GPT, remaining intact until the drive is modified.

Answer

Browser history files

Answer

Registry hive files on disk

Answer

Hard drive partition table

Question 4

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound data transfer from an internal server to an unknown external IP address. To determine if this is a true positive, the analyst needs to correlate user activity with the network event. Which data source would provide the MOST direct evidence of the user or process responsible for the transfer?

Accepted Answer

Endpoint Detection and Response (EDR) process telemetry. To attribute a network event to a specific user or process, the analyst needs endpoint-level visibility. EDR process telemetry captures the process that opened the network socket, along with its parent process and user context, providing the direct correlation required to determine if the transfer was malicious or legitimate.

Answer

NetFlow records from the core router

Answer

Windows Security Event Logs from the server

Answer

Firewall logs showing the allowed outbound connection

Question 5

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Option B is correct because 'Low and Slow' exfiltration deliberately keeps transfer rates small to evade volume thresholds, so establishing a statistical baseline of normal outbound traffic volumes and alerting on significant deviations (e.g., via NetFlow/IPFIX analysis or SIEM anomaly detection) exposes the subtle, sustained increase that static thresholds miss. Option C is correct because these attacks typically rely on long-lived, low-bandwidth connections (persistent TCP sessions or periodic beaconing) to external IPs, so monitoring connection duration and bytes-per-second to external addresses reveals the abnormal persistence and destination patterns characteristic of stealthy exfiltration. Option A is not effective because a whitelist of the top 1000 websites only restricts destinations and does nothing to detect small, gradual data transfers, which can also be tunneled through allowed sites. Option D is not effective because keyword scanning of outbound email targets content, not the low-volume, long-duration network behavior that defines 'Low and Slow' exfiltration. Option E is not effective because blocking all encrypted traffic is a blunt, disruptive control that neither detects exfiltration nor distinguishes malicious from legitimate TLS, and much exfiltration is itself encrypted.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall

Question 6

A SOC analyst is configuring network monitoring to detect beaconing behavior from a compromised host. Which network traffic characteristic is the most reliable indicator of C2 beaconing?

Accepted Answer

Periodic connections to the same external IP address at regular intervals with consistent packet sizes.. Beaconing is defined by automated, periodic check-ins from an infected host to a C2 server. Regular intervals and consistent packet sizes are hallmarks of this behavior, distinguishing it from normal bursty traffic. Monitoring for such patterns, often using flow data or proxy logs, allows SOC analysts to detect compromised hosts even when the C2 domain or IP is not yet known to be malicious.

Answer

A large volume of outbound traffic to multiple external IP addresses on port 443.

Answer

Inbound connections from external IP addresses to internal hosts on port 3389.

Answer

DNS queries for long, random-looking domain names with high entropy.

Question 7

A SOC analyst in a Microsoft 365 E5 organization is investigating a phishing campaign that successfully compromised a user account. The analyst needs to determine whether the attacker created a mailbox rule that silently forwards incoming mail to an external address. Which Microsoft 365 security feature should the analyst query to retrieve this evidence?

Accepted Answer

Exchange Online Unified Audit Log. Mailbox forwarding rules created by attackers are Exchange configuration changes, and Exchange mailbox auditing writes them to the Unified Audit Log as operations like New-InboxRule with parameters including ForwardTo and the originating client IP. Querying that log is the authoritative way to confirm rule creation and forwarding destination.

Answer

Microsoft Defender for Cloud Apps activity log

Answer

Microsoft 365 Defender incidents queue

Answer

Azure AD sign-in logs

Question 8

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The SIEM ingests Windows Security event logs. Which event ID and condition should the analyst alert on to detect a Kerberoasting attempt?

Accepted Answer

Event ID 4769 with Ticket Encryption Type 0x17 and a service name that is not a known service account.. Kerberoasting involves requesting TGS tickets for service accounts and cracking them offline. Event 4769 records TGS requests. Attackers often request RC4 (0x17) encryption because it is easier to crack. Alerting on RC4 tickets for service accounts that are not expected to use RC4 detects the attack with fewer false positives than monitoring all TGS requests.

Answer

Event ID 4768 with Ticket Options 0x40810010 and a failed pre-authentication.

Answer

Event ID 4624 with Logon Type 3 and a source IP outside the corporate network.

Answer

Event ID 4662 with access mask 0x100 and object type indicating a user account.

Question 9

Which THREE items are essential components of a robust log management policy?

Accepted Answer

Definition of log retention periods. A robust log management policy must define log retention periods (B) because regulatory, legal, and forensic requirements dictate how long logs must be preserved and when they can be securely purged. It must also specify encryption standards for log transmission (C), such as TLS 1.2/1.3 or syslog over TLS, to protect log integrity and confidentiality against interception or tampering in transit. Additionally, a log source inventory list (D) is essential to ensure comprehensive coverage by identifying every device, application, and system that generates logs, preventing blind spots in monitoring and auditing. In contrast, default login credentials (A) are a security vulnerability and should never be part of a policy, and the salary of a SOC analyst (E) is an HR matter unrelated to log management controls.

Answer

Default login credentials for all devices

Answer

The salary of the SOC analyst

Question 10

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) incidents has increased over the past quarter. Which of the following is the most likely cause for this increase?

Accepted Answer

The SOC has expanded its monitoring scope to include new log sources without additional staff.. Mean time to detect measures how long it takes to identify incidents. An increase suggests detection is slowing. Adding new log sources without scaling human or automated resources can dilute analyst attention and create backlogs, delaying detection. The other options describe improvements or changes that would typically enhance detection speed, not degrade it.

Answer

The SOC has automated the triage of low-severity alerts.

Answer

The SOC has recently implemented a new SIEM with more advanced correlation rules.

Answer

The number of false positive alerts has decreased significantly.

Question 11

A SOC analyst is investigating a suspected ransomware incident on a Windows 10 endpoint. The user reported a pop-up demanding payment, and files have been renamed with a .locked extension. The analyst has isolated the endpoint from the network. Which artifact should the analyst examine FIRST to identify the ransomware variant and potential decryption tools?

Accepted Answer

The ransom note file typically left in each affected directory.. Ransom notes are often the most direct source of information about the ransomware variant, including its name, payment instructions, and sometimes a link to a decryption service. They are typically left in encrypted directories and can be quickly examined without deep forensic analysis. While event logs, MFT, and Prefetch files provide valuable context, they do not directly identify the variant or potential decryption tools as reliably as the ransom note itself.

Answer

The Master File Table (MFT) to recover deleted files.

Answer

The Windows Security event log for event ID 4688 (process creation).

Answer

The Prefetch files for recently executed programs.

Question 12

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

Accepted Answer

Newly created service name. Option C (Newly created service name) is a host-based IoC because a new service registered on an endpoint (visible via Windows Service Control Manager, systemd unit files, or registry keys like HKLM\SYSTEM\CurrentControlSet\Services) reflects local system state altered by malware persistence. Option D (MD5 hash of a malicious file) is host-based because the hash identifies a file artifact residing on the host's filesystem, detectable through file integrity monitoring or tools like md5sum and Get-FileHash. In contrast, A (SMTP server response codes) is a network/service-level indicator observed in mail traffic, B (Malicious URL visited) is a network indicator seen in proxy or DNS logs, and E (Source IP address of an attack) is a network indicator captured in firewall, IDS, or packet-capture data — none of which describe artifacts local to an individual host.

Answer

SMTP server response codes

Answer

Malicious URL visited

Answer

Source IP address of an attack

Question 13

A SOC analyst is triaging an alert from an endpoint detection and response (EDR) platform showing that 'rundll32.exe' loaded a DLL from the user's Downloads folder and then established an outbound connection to an unfamiliar IP on port 443. Which TWO actions should the analyst take FIRST to properly triage this alert? (Choose two.)

Accepted Answer

Retrieve the process tree and command-line arguments associated with the rundll32.exe execution.. Triage of a suspicious rundll32 execution begins with evidence collection and enrichment. Pulling the process tree and command line clarifies what was actually executed, while checking the destination IP against threat intelligence and SIEM history establishes whether the connection is malicious. Containment or remediation decisions follow once these facts are known.

Answer

Immediately reimage the endpoint to remove any potential malware before investigating further.

Answer

Submit the alert to the vulnerability management team for patch verification.

Answer

Disable the user's email account to prevent data exfiltration.

Question 14

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

Accepted Answer

TCP. TCP is the preferred protocol for centralized log transmission because it is connection-oriented and provides acknowledgements (ACKs) for every segment delivered, guaranteeing that logs arrive at the aggregator intact and in order. This delivery confirmation is essential for compliance and forensic integrity, where lost log entries can create dangerous blind spots. UDP offers no such guarantee, making it unsuitable when reliable delivery is a requirement.

Answer

UDP

Answer

ICMP

Answer

ARP

Question 15

A SOC analyst is performing dynamic analysis of a suspicious Windows binary in an isolated lab. The analyst wants to observe the sample's interaction with the file system, registry, and network in real time, and also capture the arguments passed to Windows API calls. Which monitoring approach best provides this combined visibility?

Accepted Answer

Deploy an API-monitoring and sandboxing tool such as Cuckoo Sandbox or a similar automated analysis platform that records API calls, file, registry, and network activity. An automated sandbox or API-monitoring platform correlates API calls with their arguments and simultaneously logs file, registry, and network activity, matching all of the analyst's stated requirements in one workflow. Event logs, static disassembly, and packet capture each cover only a subset and cannot provide the combined real-time behavioral view.

Answer

Run the binary and review the Windows Security event log for process creation and object access entries

Answer

Capture full packet capture on the lab network segment and analyze it with a protocol analyzer

Answer

Use a disassembler to statically review the binary's code and identify the API calls it references in the import table