312-39 Practice Test 24 — 15 Questions

Question 1

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. An SSL/TLS intercepting proxy sits between the malware and the C2 server, terminating the TLS session on both sides using a trusted CA certificate installed on the endpoint. This allows the analyst to decrypt and inspect the plaintext HTTP or custom protocol inside the TLS tunnel without possessing the malware's private key. It is the standard technique for inspecting encrypted C2 traffic in a controlled lab or proxy-enabled environment.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 2

A SOC analyst receives a high-severity alert indicating that a workstation is communicating with a known command-and-control domain. Before escalating to the incident response team, the analyst wants to determine whether the alert represents a true positive and gather additional context. Which action best supports this triage decision while preserving forensic evidence?

Accepted Answer

Query historical proxy and DNS logs for the workstation to correlate the domain and identify related sessions. Passive log correlation using proxy and DNS records provides the context needed to validate a high-severity C2 alert without modifying the endpoint or alerting the adversary. It reveals scope, timing, and related hosts, which strengthens the escalation. Containment and remediation actions should wait until validation is complete to preserve evidence and avoid unnecessary business disruption.

Answer

Run a full antivirus scan on the workstation and delete any detected malware

Answer

Immediately isolate the workstation from the network to prevent lateral movement

Answer

Close the alert as a false positive because the domain may be shared hosting

Question 3

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?

Accepted Answer

Contact the user to verify if they are traveling.. Contacting the user to verify whether they are traveling is the correct next logical action because a 'Successful login' from an unusual location is a low-fidelity indicator that could have a legitimate explanation (business travel, VPN, remote work). Verification is a non-destructive, proportionate response that confirms or denies the anomaly before escalating. This aligns with the NIST IR lifecycle's Detection and Analysis phase, where validation precedes containment.

Answer

Disable the user's account immediately.

Answer

Reformat the user's laptop.

Answer

Shut down the entire domain.

Question 4

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Accepted Answer

An automated process or script is likely involved.. Ten failures in one second strongly suggests an automated process or script, such as a brute-force attack or a misconfigured application repeatedly trying to authenticate. Human users typically cannot generate such a high rate of failed logins. This pattern is a common indicator of malicious activity or a system error.

Answer

The server is overheating.

Answer

A user is having a bad day.

Answer

The SIEM is broken.

Question 5

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

Accepted Answer

Eliminating the threat. The Eradication phase in the Incident Response lifecycle focuses on removing the threat from the environment. This involves actions such as deleting malware, disabling breached user accounts, and patching vulnerabilities that were exploited. The primary goal is to ensure the threat is completely eliminated so that the system can be safely restored to normal operations.

Answer

Identifying the source

Answer

Blocking traffic

Answer

Restoring backups

Question 6

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Accepted Answer

Process access requests to lsass.exe from an unauthorized or unsigned process. Credential dumping tools such as Mimikatz must open a handle to lsass.exe and read its memory, where Windows caches plaintext credentials, NTLM hashes, and Kerberos tickets. EDR solutions detect this by monitoring process-access API calls (e.g., OpenProcess with PROCESS_VM_READ) targeting lsass.exe from processes that are unsigned, unexpected, or not on an allowlist. This behavioral signal is far more specific than generic system activity and directly maps to the MITRE ATT&CK technique T1003.001 (LSASS Memory).

Answer

Failed login attempts to the local administrator account

Answer

Increased CPU usage on the Domain Controller

Answer

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

Question 7

A SOC analyst receives a QRadar offense titled 'Multiple Failed Logins Followed by Success' for a domain service account. The offense lists 42 events from a single source IP over 3 minutes. Before escalating, the analyst must perform initial triage. Which action best represents the first step of triage for this offense?

Accepted Answer

Validate the offense by reviewing the contributing events to confirm the source IP, targeted account, and whether the successful login originated from an expected host.. Initial triage centers on validating the alert with evidence before deciding on containment or escalation. Reviewing the contributing events confirms whether the failed logins and subsequent success are real, what account and host are involved, and whether the source is expected. Only after this validation can the analyst confidently decide to escalate, contain, or close the offense.

Answer

Escalate the offense to the incident response team immediately and let them perform all validation and scoping activities.

Answer

Close the offense as a false positive because service accounts routinely authenticate from many sources and failed logins are common.

Answer

Immediately disable the targeted domain service account in Active Directory to stop any further unauthorized access.

Question 8

A SOC analyst is performing static analysis on a suspicious Windows Portable Executable (PE) file. The analyst wants to quickly determine the compile timestamp of the binary to assess whether it matches the reported incident timeline. Which field in the PE header should the analyst examine?

Accepted Answer

TimeDateStamp in the IMAGE_FILE_HEADER. The TimeDateStamp field in the IMAGE_FILE_HEADER of a PE file records the compilation time as a Unix timestamp. Analysts can convert this value to a human-readable date to compare against incident timelines. While timestamps can be manipulated, it remains a quick initial indicator for static analysis.

Answer

SizeOfImage in the IMAGE_OPTIONAL_HEADER

Answer

AddressOfEntryPoint in the IMAGE_OPTIONAL_HEADER

Answer

CheckSum in the IMAGE_OPTIONAL_HEADER

Question 9

A SOC analyst is examining a Windows 10 workstation suspected of malware infection. During live response, the analyst needs to capture the current state of network connections, associated process IDs, and executable paths to identify potential command-and-control communication. Which native Windows command should the analyst run to obtain this information?

Accepted Answer

netstat -anob. The netstat command with the -a, -n, -o, and -b switches provides a comprehensive view of all active connections and listening ports, includes numerical addresses, maps each connection to its owning process ID, and reveals the executable name. This is essential for live response on a Windows workstation to quickly identify suspicious processes communicating over the network.

Answer

nbtstat -c

Answer

arp -a

Answer

ipconfig /displaydns

Question 10

A SOC analyst is investigating a security incident in Microsoft Azure where an attacker may have used a compromised service principal to access resources. The analyst needs to review sign-in activity for the service principal and identify any conditional access policy evaluations. Which Azure log should the analyst query to obtain this information?

Accepted Answer

Azure AD Sign-in Logs. Microsoft Entra ID Sign-in Logs are designed to provide details on authentication events, including those for service principals. They include information such as the application ID, sign-in status, conditional access policies applied, and risk details. For a compromised service principal, these logs are critical to determine when and how the principal authenticated, and whether any conditional access policies were bypassed or triggered. Audit logs and Activity logs serve different purposes and do not contain the required authentication data.

Answer

Azure Activity Log

Answer

Azure AD Audit Logs

Answer

Azure Monitor Logs

Question 11

A SOC analyst is reviewing Windows event logs to proactively detect Kerberoasting activity. The environment uses Windows Server 2016 domain controllers and Windows 10 endpoints. Which event ID and field combination is most indicative of a Kerberoasting attempt?

Accepted Answer

Event ID 4769 with Ticket Encryption Type 0x17 and a service name that is not a computer account. Kerberoasting involves requesting Kerberos service tickets for accounts with SPNs and then cracking them offline. The key indicator is Event ID 4769 with RC4 encryption (0x17) for a service account that is not a computer account. This combination is unusual in environments that support AES and suggests an attacker is attempting to obtain crackable tickets.

Answer

Event ID 4624 with Logon Type 3 and an account name ending with $

Answer

Event ID 4771 with Failure Code 0x18 and a user account that has no SPN

Answer

Event ID 4672 with SeDebugPrivilege assigned to a service account

Question 12

A SOC analyst is proactively hunting for DNS tunneling activity. The organization's DNS logs include query name, query type, source IP, and response size. Which combination of characteristics is most indicative of DNS tunneling?

Accepted Answer

High volume of TXT queries with long, random subdomains and large response sizes. DNS tunneling encodes data in DNS queries and responses. The use of TXT records, which can hold more data, combined with long, random subdomains and large response sizes, is a strong indicator. Other query types like A, PTR, or MX are less likely to be abused for tunneling due to size limitations and normal usage patterns.

Answer

Numerous MX queries for external domains with consistent response times

Answer

Frequent A queries for the same domain from multiple internal hosts

Answer

Periodic PTR queries for internal IP addresses with small response sizes

Question 13

A SOC analyst is triaging a Microsoft Defender for Endpoint alert on a workstation. The alert shows 'lsass.exe' was accessed by an unsigned process named 'rundll32.exe' launched from a user's temp folder. The analyst needs to determine the appropriate triage priority. Which factor should most strongly influence the priority of this alert?

Accepted Answer

The process accessing lsass.exe is unsigned and running from a user temp folder, which is a strong indicator of credential dumping activity.. The strongest priority driver is the behavioral combination: an unsigned executable running from a user temp directory accessing lsass.exe. This matches credential dumping tradecraft and indicates an active attempt to steal credentials. Because stolen credentials enable lateral movement and privilege escalation, this alert warrants high-priority investigation regardless of whether the affected asset is a workstation or server.

Answer

The alert should be deprioritized because rundll32.exe is a legitimate Windows binary and is commonly used by many applications.

Answer

The alert should be triaged only after all higher-severity server alerts are resolved, because endpoint alerts are inherently less urgent.

Answer

The alert was generated on a workstation rather than a server, so it should be treated as low priority.

Question 14

A SOC analyst in a Splunk ES environment is triaging a notable event for a possible phishing campaign. The notable event aggregates multiple email security alerts and endpoint alerts. The analyst must determine which additional data sources to correlate to confirm and scope the incident. (Choose two.)

Accepted Answer

DNS logs to identify resolution of the phishing domain and any subsequent beaconing from affected hosts.. Confirming and scoping a phishing incident requires evidence of user interaction and post-delivery activity. Proxy or web gateway logs show clicks and downloads, while DNS logs reveal resolution of malicious domains and possible beaconing. Together they confirm execution and identify additional affected hosts, enabling the analyst to determine the true scope beyond the initial email alerts.

Answer

Physical security badge logs to determine whether affected users were at their desks when the email arrived.

Answer

Asset inventory records to confirm the operating system version of the affected workstations.

Answer

Human resources records to identify the organizational reporting structure of the affected users.

Question 15

A SOC analyst is monitoring a Google Cloud environment and receives an alert about a potentially compromised service account. The analyst needs to investigate the extent of the compromise by examining audit logs. Which TWO log types should the analyst review to identify actions taken by the service account and any configuration changes made to it? (Choose two.)

Accepted Answer

Data Access audit logs. Admin Activity and Data Access audit logs are the primary sources for investigating a compromised service account in Google Cloud. Admin Activity logs capture configuration changes, such as IAM policy updates or resource creation, which could indicate privilege escalation or persistence. Data Access logs capture reads and writes to user data, which could reveal data exfiltration. Together, they provide a comprehensive view of the service account's actions. System Event, Policy Denied, and Access Transparency logs serve different purposes and do not record the service account's successful operations.

Answer

System Event audit logs

Answer

Policy Denied audit logs

Answer

Access Transparency logs