312-39 Practice Test 25 — 15 Questions

Question 1

A SOC manager is evaluating the effectiveness of the team's use of threat intelligence. The manager wants to ensure that threat intelligence is actionable and integrated into daily operations. Which TWO practices are essential for achieving this goal? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establishing a feedback loop where analysts report the outcome of intelligence-driven investigations.. Essential practices for actionable threat intelligence include mapping intelligence to the organization's assets and vulnerabilities, which ensures relevance, and establishing a feedback loop where analysts report investigation outcomes. These practices help prioritize threats and continuously improve the intelligence cycle, making it an integral part of SOC operations rather than a passive data source.

Answer

Sharing all internal incident data with external threat intelligence platforms.

Answer

Automatically ingesting all available threat feeds into the SIEM without filtering.

Answer

Relying solely on open-source threat intelligence (OSINT) for all detection rules.

Question 2

A SOC analyst is correlating EDR process-creation events with Windows Security logs during an investigation of an intrusion. The analyst notices that on a domain controller, the account 'svc_backup' authenticated successfully at 02:14, and two minutes later a new service named 'WinDefendHelper' was created, whose binary path points to C:\Windows\Temp\svc.exe. The service account configured for this service is the local SYSTEM account. Which attack technique is MOST consistent with this sequence?

Accepted Answer

Persistence via a new Windows service configured to run as SYSTEM, using a binary dropped in a writable directory.. A successful logon by a service account followed by creation of a new service that runs as SYSTEM and points to a binary in a world-writable directory is a well-known persistence pattern. Attackers who already have credentials or SYSTEM on a host often install a service to survive reboots and retain elevated execution. The service name and Temp path are red flags that distinguish this from legitimate administrative activity, and correlating the logon with the service-creation event strengthens attribution to the intrusion.

Answer

Kerberoasting, where the attacker requests service tickets for accounts with SPNs and cracks them offline.

Answer

DLL search order hijacking, where a malicious DLL is placed next to a legitimate application and loaded by it.

Answer

Pass-the-Hash, where the attacker reuses an NTLM hash to authenticate without knowing the plaintext password.

Question 3

A SOC analyst reviews network telemetry and finds that an internal workstation is sending periodic DNS queries for randomly generated subdomains under a single parent domain, and each query receives an immediate NXDOMAIN response. The queries occur roughly every 30 seconds with high entropy in the leftmost label. There is no corresponding HTTP or TLS traffic to those hostnames. Which attack activity is MOST consistent with this pattern?

Accepted Answer

Domain generation algorithm beaconing, where malware generates pseudo-random domains to locate its command-and-control server.. High-entropy subdomains under one parent, queried at regular short intervals with NXDOMAIN responses and no follow-on web traffic, match DGA-based beaconing. Malware using a DGA tries many candidate domains to find its C2; most are unregistered and return NXDOMAIN until one resolves. The consistent timing reflects the beacon interval, and the lack of HTTP or TLS indicates the host has not yet connected to an active C2 endpoint, which is consistent with an early or failed C2 attempt.

Answer

Fast-flux DNS, where a single domain resolves to a rotating set of IP addresses to evade blocklists.

Answer

DNS cache poisoning, where an attacker injects forged records into a resolver to redirect legitimate traffic.

Answer

DNS tunneling used to exfiltrate data, because the queries carry encoded payloads in the subdomain labels.

Question 4

A SOC analyst must configure a Linux web server to forward its logs to a central syslog server over the network. The organization requires reliable delivery and wants to avoid losing messages if the central server is temporarily unreachable. Which TWO syslog configuration directives should the analyst use? (Choose two.)

Accepted Answer

Configure the syslog daemon to use TCP instead of UDP for forwarding.. Reliable syslog forwarding requires a transport that can detect failures and a mechanism to buffer messages during outages. TCP provides acknowledged delivery, and a disk-assisted queue persists messages until the remote server is reachable, together preventing message loss. Facility, severity, disk size, and rotation settings affect categorization and local storage but not delivery reliability.

Answer

Increase the size of the /var/log partition to 500 GB to accommodate log growth.

Answer

Set the facility to local7 and the severity to debug for all forwarded messages.

Answer

Configure log rotation with a daily schedule and compress rotated files.

Question 5

A SOC analyst is configuring an ELK Stack to ingest logs from multiple sources. The analyst notices that events from different time zones are being indexed with incorrect timestamps in Elasticsearch. Which action should the analyst take to ensure events are stored with a consistent, correct time reference?

Accepted Answer

Configure a date filter in Logstash that parses the original timestamp and converts it to UTC before assigning it to the @timestamp field.. Because Elasticsearch stores @timestamp in UTC, the ingestion pipeline must convert each source's original time to UTC. Logstash's date filter, configured with the source's time zone and the correct format, achieves this by parsing the event's own timestamp and writing a normalized UTC value, ensuring all sources align on a single timeline for searching and correlation.

Answer

Use a mutate filter to add the local time zone offset as a separate field and rely on Kibana to adjust display times.

Answer

Set the Elasticsearch cluster's timezone setting to the SOC's local time zone in elasticsearch.yml.

Answer

Configure filebeat to append a timestamp with the local system time and disable Logstash date parsing.

Question 6

A SOC analyst is reviewing Apache access logs and needs to extract only the client IP addresses and requested URLs for a threat-hunting query. The log format is the default combined format. Which approach should the analyst use to reliably parse these fields?

Accepted Answer

Use a regular expression that matches the client IP at the start of the line and the request path inside the first quoted string.. The Apache combined log format is a well-defined text structure where the client IP is the first token and the request URL is inside the first quoted string. A regex that targets these positions extracts the desired fields accurately and is robust to variations in later fields such as referrer and user agent, unlike delimiter or fixed-width approaches.

Answer

Split each log line on the pipe character and select the first and second fields.

Answer

Extract the fields by counting characters from the beginning of each line based on fixed column widths.

Answer

Use a JSON parser because Apache access logs are natively emitted as JSON objects.

Question 7

A SOC analyst is investigating a suspected credential-dumping incident on a Windows workstation. The analyst has EDR telemetry, Windows Security event logs, and memory capture available. Which TWO artifacts would MOST reliably confirm that credential material was accessed from LSASS memory? (Choose two.)

Accepted Answer

An EDR alert showing a non-Microsoft process opening a handle to lsass.exe with PROCESS_VM_READ access.. Confirming credential access from LSASS requires evidence that a process read or dumped LSASS memory. Opening lsass.exe with PROCESS_VM_READ by an unexpected process and producing a MiniDump of lsass.exe by a non-sanctioned process are both direct indicators of that access. Other artifacts such as failed logons, network logons, or logon scripts reflect different behaviors and do not demonstrate that credential material was extracted from memory.

Answer

A spike in failed logon events (Event ID 4625) across multiple user accounts on the workstation.

Answer

The presence of a scheduled task that runs a PowerShell script at user logon to map network drives.

Answer

Windows Security Event ID 4624 with Logon Type 3 from the local host to itself.

Question 8

A SOC analyst receives an alert that a workstation has an outbound connection to a known command-and-control IP address over TCP port 4444. The connection is long-lived and the process making it is 'rundll32.exe' with a command line referencing a DLL in the user's AppData folder. Which phase of the attack lifecycle does this activity MOST directly represent?

Accepted Answer

Command and Control, because the compromised host is communicating with attacker infrastructure to receive instructions.. A persistent outbound session from a compromised process to known attacker infrastructure represents the command-and-control phase. The unusual port and the use of rundll32.exe to load a DLL from AppData indicate stealthy malware awaiting instructions. This phase bridges initial compromise and later objectives such as lateral movement or exfiltration, and identifying it early gives defenders an opportunity to disrupt the intrusion before further damage occurs.

Answer

Reconnaissance, because the attacker is scanning for reachable services on the internal network.

Answer

Exfiltration, because the host is sending data outbound to an external address.

Answer

Weaponization, because the attacker is preparing a malicious payload to deliver to the target.

Question 9

A SOC analyst is documenting the incident response process for a new playbook. The playbook must specify the correct order of phases according to the NIST SP 800-61 incident response lifecycle. Which phase immediately follows 'Detection and Analysis'?

Accepted Answer

Containment, Eradication, and Recovery. The NIST SP 800-61 incident response lifecycle defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. After detecting and analyzing an incident, the immediate next phase is Containment, Eradication, and Recovery, where the threat is contained, the root cause is eliminated, and systems are restored. This order is critical to effectively manage the incident.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Lessons Learned

Question 10

A SOC analyst is preparing an incident response report for a confirmed phishing incident that led to credential theft. The analyst must document the timeline and impact. Which TWO artifacts should the analyst include to support the timeline and scope of the incident? (Choose two.)

Accepted Answer

Authentication logs showing successful logins from the compromised account. Email gateway logs establish the initial delivery and recipient list, while authentication logs show when and where stolen credentials were used. Together they define the incident timeline and scope, enabling the analyst to identify affected users and systems. Other artifacts do not provide chronological or scope-related evidence for this phishing incident.

Answer

Firewall configuration backup from the previous quarter

Answer

List of installed applications on the user's workstation

Answer

Antivirus signature update history for the endpoint

Question 11

A SOC analyst is following the organization's incident response plan and has just completed containment of a malware outbreak. According to the NIST SP 800-61 lifecycle, which phase should the analyst perform next?

Accepted Answer

Eradication. The NIST SP 800-61 lifecycle sequence is Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. After containment, the next phase is eradication, where malware and root causes are removed. Recovery and post-incident activities follow later, so eradication is the correct next step.

Answer

Post-Incident Activity

Answer

Recovery

Answer

Preparation

Question 12

A SOC analyst is conducting memory forensics on a compromised Windows host using Volatility 3. The analyst needs to identify malicious processes that may be hiding using rootkit techniques. Which two Volatility 3 plugins should the analyst use to detect hidden or unlinked processes? (Choose two.)

Accepted Answer

windows.psscan. To detect hidden processes, analysts compare the output of windows.pslist, which shows processes linked in the active list, with windows.psscan, which scans memory for process objects regardless of list linkage. Discrepancies between the two can reveal processes unlinked by rootkits. These two plugins together provide a robust method for uncovering stealthy processes in memory forensics.

Answer

windows.netscan

Answer

windows.malfind

Answer

windows.dlllist

Question 13

A SOC analyst is investigating a suspected compromised user account. The analyst observes that the account was used to access a critical file server at 3:00 AM, outside of normal business hours, from an IP address geolocated in a foreign country. The account owner is currently on vacation in that country. Which factor is MOST important to consider when determining if this is a true positive?

Accepted Answer

The user's normal working hours and typical access patterns from the file server logs.. The most important factor is comparing the access against the user's normal working hours and typical access patterns. This behavioral analysis helps determine if the activity is anomalous. Even if the user is in a foreign country, their usual access times and methods provide a baseline. If the access deviates significantly, it suggests compromise, while if it aligns with their remote work habits, it may be legitimate.

Answer

Whether the IP address is listed in a threat intelligence feed as malicious.

Answer

Whether the user has multi-factor authentication (MFA) enabled on their account.

Answer

The sensitivity of the data stored on the file server that was accessed.

Question 14

A SOC analyst is implementing a proactive detection for suspicious PowerShell usage. The organization has Windows 10 endpoints with PowerShell v5.1 and Script Block Logging enabled. Which event ID should the analyst monitor to capture the actual script block content executed?

Accepted Answer

Event ID 4104. Script Block Logging captures the actual PowerShell code executed, including de-obfuscated scripts. Event ID 4104 contains this script block text. Other events like 4103 show pipeline execution but not the full code, 4688 logs process creation without script content, and 400 is just engine start. Thus, 4104 is the key event for proactive detection of malicious PowerShell.

Answer

Event ID 4688

Answer

Event ID 400

Answer

Event ID 4103

Question 15

During a forensic investigation of a compromised Windows server, an analyst discovers an alternate data stream (ADS) attached to a legitimate system file. The analyst wants to extract the hidden content for malware analysis. Which Windows command should the analyst use to view the contents of the ADS?

Accepted Answer

more < filename:streamname. Alternate data streams are a feature of NTFS that allows additional data to be attached to a file without appearing in normal directory listings. To view the contents of an ADS, an analyst can use the more command with input redirection, specifying the file and stream name separated by a colon. This native method avoids the need for third-party tools and works directly in the command prompt.

Answer

attrib filename

Answer

dir /r filename

Answer

icacls filename