312-39 Practice Test 23 — 15 Questions

Question 1

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The action executes a binary located in C:\Users\Public\ or C:\Windows\Temp\. Legitimate software installers place binaries in Program Files, ProgramData, or vendor-specific directories, whereas malware frequently drops executables in world-writable locations like C:\Users\Public, C:\Windows\Temp, or %AppData% to evade detection and avoid needing administrative rights. A scheduled task whose action points to a binary in one of these paths is a strong persistence indicator because attackers use it to survive reboots without touching protected directories.

Answer

The task is scheduled to run every 24 hours

Answer

The task has a generic name like 'Updater'

Answer

The task is configured to run at system startup

Question 2

A SOC analyst is reviewing EDR telemetry and observes that a user-level process named 'wscript.exe' spawned a child process 'powershell.exe' with the command line 'powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...'. The parent process had been launched from an email attachment. Which attack technique is most strongly indicated by this chain of events?

Accepted Answer

Spearphishing attachment delivering a malicious script that uses PowerShell to execute an encoded payload. The combination of an email attachment launching 'wscript.exe', which then spawns PowerShell with hidden window and encoded command, is a hallmark of a spearphishing attachment delivering a script-based payload. This chain indicates initial access via user execution of a malicious document or script, followed by PowerShell used to run an encoded payload.

Answer

Exploitation of a remote service vulnerability to gain initial access

Answer

Credential dumping from LSASS memory using a known tool

Answer

Use of a scheduled task for persistence and privilege escalation

Question 3

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. The standard cloud-native isolation technique for a compromised EC2 instance is to modify its Security Group to deny all inbound and outbound traffic (or attach a pre-built 'quarantine' SG). This preserves the instance's memory, EBS volumes, and forensic state while cutting off C2 channels and lateral movement. It is non-destructive and reversible, unlike termination or volume deletion.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance

Question 4

During an incident, a SOC analyst needs to preserve volatile memory on a Windows Server 2019 host before shutting it down. The server is running critical services and cannot be taken offline immediately. Which action best preserves the most volatile evidence while minimizing disruption?

Accepted Answer

Run WinPmem to capture physical memory to an external drive, then continue monitoring.. Volatile memory contains critical evidence such as running processes, network connections, and injected code that is lost on shutdown or reboot. Capturing physical memory with a tool like WinPmem preserves this evidence while allowing the server to remain operational. Disk imaging, event log collection, and system restore points do not capture memory-resident artifacts and thus fail to meet the requirement of preserving the most volatile evidence with minimal disruption.

Answer

Capture a full disk image using FTK Imager while the system continues to run.

Answer

Create a restore point using System Restore and then proceed with a disk clone.

Answer

Use Windows Event Forwarding to collect all recent security logs and then restart the server.

Question 5

A SOC analyst is monitoring an Azure environment and receives an alert about a suspicious sign-in from an unfamiliar location. The analyst wants to review the sign-in logs to see the applied conditional access policies and the risk level of the sign-in. Which Azure AD log should the analyst use?

Accepted Answer

Azure AD sign-in logs. Microsoft Entra ID sign-in logs are the correct source because they contain detailed information about each sign-in, including applied conditional access policies and risk levels. They allow the analyst to see why the sign-in was deemed suspicious. Audit logs, Activity logs, and Azure Monitor logs do not directly provide this information without additional configuration.

Answer

Azure Activity log

Answer

Azure Monitor logs

Answer

Azure AD audit logs

Question 6

A security analyst is investigating suspicious activity in a Google Cloud environment. The analyst suspects that a service account key was used from an unauthorized location to access Cloud Storage buckets. The analyst needs to identify the source IP address and the specific API method called. Which GCP service should the analyst use?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs are the correct choice because they capture all API activity in GCP, including the caller's identity, source IP address, and the specific API method. For a suspected compromised service account key, the analyst can filter logs by the service account email and review the caller's IP and method calls to Cloud Storage, enabling detection of unauthorized access.

Answer

VPC Flow Logs

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring

Question 7

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

Accepted Answer

Add the vulnerability scanner's IP to an exclusion list (whitelist).. The best action is to add the vulnerability scanner's IP to an exclusion list (whitelist) so the SIEM rule ignores traffic from a known, authorized source while still detecting the same behavior from unauthorized hosts. This preserves detection coverage for real threats instead of weakening or removing the rule. Whitelisting known-good scanners is standard tuning practice in a SOC.

Answer

Disable the rule entirely.

Answer

Upgrade the vulnerability scanner.

Answer

Increase the rule threshold.

Question 8

A SOC analyst is proactively hunting for DNS tunneling used by malware to exfiltrate data from a compromised host. The SIEM has DNS query logs from all internal resolvers. Which detection query would most effectively surface potential DNS tunneling activity?

Accepted Answer

Alert on hosts issuing an unusually high volume of DNS queries with long, high-entropy subdomain labels to a single external domain.. DNS tunneling works by encoding stolen data into subdomain labels of queries sent to an attacker-controlled authoritative server. The telltale signs are a high volume of queries to one domain and subdomains with long, random-looking labels that carry the encoded payload. Detecting these patterns proactively reveals exfiltration attempts that signature-based tools may miss.

Answer

Alert on any DNS query for a domain that is not present in the organization's approved domain allowlist.

Answer

Alert on DNS queries that use TCP instead of UDP.

Answer

Alert on any DNS query for a domain that resolves to an internal RFC1918 address.

Question 9

A SOC team is deploying a new log management system and needs to ingest logs from various sources, including Windows Event Logs, Linux syslog, and network device logs. The team wants to ensure that all logs are parsed into a common format for easier analysis. Which component of the ELK Stack is primarily responsible for parsing and transforming logs before they are stored in Elasticsearch?

Accepted Answer

Logstash. Logstash is the component in the ELK Stack responsible for parsing and transforming logs. It uses input plugins to collect data, filters like grok to parse unstructured logs, and output plugins to send data to Elasticsearch. While Beats can collect and do minor processing, Logstash is designed for complex transformations, making it the primary choice for normalizing diverse logs.

Answer

Kibana

Answer

Beats

Answer

Elasticsearch

Question 10

A SOC analyst is performing post-incident analysis after a successful containment of a malware outbreak. The analyst needs to identify which two Windows Registry locations are commonly used by malware for persistence to ensure they are cleaned. (Choose two.)

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The Run key (HKCU) and Services key (HKLM) are two of the most commonly abused registry locations for persistence. The Run key allows programs to execute at user logon, while the Services key allows malicious services to start at boot with system privileges. Both are frequently used by malware to maintain a foothold. Post-incident analysis should include checking these keys for unauthorized entries and removing them to prevent re-infection.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKEY_CURRENT_USER\Control Panel\Desktop

Answer

HKEY_CLASSES_ROOT\exefile\shell\open\command

Question 11

A SOC manager is evaluating the team's performance and wants to measure how effectively they are using threat intelligence to prioritize alerts. Which metric best indicates the proportion of high-risk alerts that were correctly identified as true positives?

Accepted Answer

True positive rate (Recall). The true positive rate, or recall, specifically measures the proportion of actual malicious events that were correctly identified. When threat intelligence is used to prioritize high-risk alerts, a high true positive rate for those alerts indicates that the team is effectively using that intelligence to catch real threats.

Answer

False positive rate

Answer

Alert volume per analyst

Answer

Mean time to detect (MTTD)

Question 12

Which TWO of the following are standard log types ingested into a SIEM?

Accepted Answer

Firewall logs.. Firewall logs (B) are a standard SIEM log source because they record allowed/denied connections, source and destination IPs, ports, and protocol data (e.g., via syslog, CEF, or LEEF) that support network monitoring, correlation, and threat detection. Authentication/Login logs (E) are also standard SIEM inputs since they capture identity events such as successful and failed logons, account lockouts, and privilege changes from sources like Windows Security event logs, Linux auth.log, or RADIUS/TACACS+, which are essential for detecting brute-force and credential-based attacks. The remaining options do not belong: microwave oven event logs (A), digital clock sync logs (C), and coffee machine telemetry (D) are not conventional enterprise security log sources and are not typically ingested into a SIEM for security monitoring.

Answer

Microwave oven event logs.

Answer

Digital clock sync logs.

Answer

Coffee machine telemetry.

Question 13

When building a new SIEM use case, what is the first phase of the development lifecycle?

Accepted Answer

Requirement gathering and scoping.. Requirement gathering and scoping is the first phase of the SIEM use-case development lifecycle because you must define what threat you are detecting, which log sources are needed, what the expected outcome is, and who will respond before writing any correlation logic. Without this foundation, detection rules are built blindly and often miss the actual risk. All subsequent phases — query writing, testing, and playbook documentation — depend on clear requirements.

Answer

Writing the correlation query.

Answer

Testing the alert in production.

Answer

Documenting the playbook.

Question 14

A SOC analyst receives an alert about a suspicious process named 'svchost.exe' running from C:\Users\Public\Downloads. The analyst wants to quickly determine whether the process is malicious by examining its parent process, command line, and loaded modules. Which Sysinternals tool should the analyst use?

Accepted Answer

Process Explorer. Process Explorer is the correct tool because it provides a comprehensive, real-time view of running processes, including parent-child relationships, command-line arguments, and loaded modules. These features allow the analyst to quickly assess whether svchost.exe running from an unusual path is legitimate or malicious, which is critical for rapid triage in a SOC environment.

Answer

Process Monitor

Answer

TCPView

Answer

Autoruns

Question 15

A SOC analyst is investigating a suspected compromised host and wants to identify persistence mechanisms that survive reboots. The analyst runs the command 'schtasks /query /fo LIST /v' on the host. Which field in the output is most critical for determining if a scheduled task is malicious?

Accepted Answer

Task To Run. The 'Task To Run' field is most critical because it shows the exact command or executable that the scheduled task will launch. Malicious tasks often execute suspicious binaries or scripts, such as PowerShell with encoded commands. By examining this field, analysts can quickly identify if the task is performing unauthorized actions. Other fields like name, user, or schedule provide context but are not definitive indicators of maliciousness on their own.

Answer

Run As User

Answer

TaskName

Answer

Schedule