312-39 Practice Test 2 — 25 Questions

Question 1

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immediately isolate the endpoint from the network and escalate to the incident response team as a potential ransomware precursor.. Shadow copy deletion executed through a suspicious parent-child process chain is a well-known ransomware precursor technique. The correct response prioritizes containment by isolating the endpoint and escalating, because the attacker is likely still active. Verifying legitimacy or waiting for scans allows the adversary to proceed with encryption or lateral movement.

Answer

Close the alert as a false positive because vssadmin is a legitimate Windows administrative utility.

Answer

Run a full antivirus scan on the endpoint and wait for the results before taking any other action.

Answer

Contact the end user by phone to ask whether they intentionally ran the command before escalating.

Question 2

A SOC analyst is reviewing DNS logs and sees a host repeatedly querying subdomains like 'a1b2c3d4e5.evil-domain.com' every 60 seconds, with each subdomain being a random 10-character string. The responses are consistently NXDOMAIN. Which attack technique is most likely indicated?

Accepted Answer

Domain Generation Algorithm (DGA) used by malware for C2. The combination of random subdomains under a single parent domain, periodic queries, and NXDOMAIN responses strongly indicates a Domain Generation Algorithm used by malware to locate C2 servers. DGA malware generates many domains and queries them until one resolves, producing exactly this log signature. Other DNS-based attacks like tunneling or fast flux would show different patterns such as data in queries or changing IPs.

Answer

Fast flux DNS used to hide a botnet's C2 infrastructure

Answer

DNS cache poisoning attack against the local resolver

Answer

DNS tunneling for data exfiltration

Question 3

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

Accepted Answer

Sysmon Event ID 3 (Network connection). Sysmon Event ID 3 is specifically designed to log network connections along with the initiating process information. This makes it the most suitable log source for correlating outbound connections with processes during a data exfiltration investigation. Other logs either lack network connection details or do not associate connections with processes.

Answer

Windows Security event log

Answer

Windows Application event log

Answer

Windows PowerShell operational log

Question 4

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

Accepted Answer

Use log deduplication and correlation rules in the SIEM to group repeated SSH failures from the same source into a single alert with a count.. Deduplication and correlation in the SIEM reduce alert volume by grouping repeated events while retaining the original logs for forensic analysis. This approach maintains visibility into attack patterns such as brute-force attempts without overwhelming the ingestion pipeline. It balances operational efficiency with the need for detailed security context, unlike dropping or limiting logs.

Answer

Configure a filter in the SIEM to drop all SSH failure logs from the authentication server.

Answer

Implement log aggregation with rate limiting on the syslog server to cap the number of SSH failure messages per second.

Answer

Disable SSH logging on the authentication server and rely solely on network flow data for anomaly detection.

Question 5

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?

Accepted Answer

Command and Control. Consistent interval beaconing to an uncommon external address, uniform packet sizes, and TLS traits that do not match a normal browser collectively identify the command-and-control phase, where an implanted agent maintains contact with attacker infrastructure. Weaponization and exploitation precede this and occur without such regular outbound patterns, while actions on objectives would manifest as observable impact rather than heartbeat traffic.

Answer

Exploitation

Answer

Weaponization

Answer

Actions on Objectives

Question 6

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

Accepted Answer

Run the sample in a debugger with breakpoints on LoadLibrary and GetProcAddress, then inspect the string arguments passed to those functions. Dynamic resolution through LoadLibrary and GetProcAddress is the standard mechanism behind sparse import tables, so instrumenting those two functions in a debugger recovers the module and procedure names as they are requested. Hash lookups, section size comparisons, and string extraction are triage techniques that do not expose the runtime resolution sequence.

Answer

Parse the PE section table and compare the raw size against the virtual size of each section

Answer

Extract printable ASCII and Unicode strings from the binary and filter for known Windows API names

Answer

Compute the file's MD5 and SHA-256 hashes and submit them to a public multi-engine scanning service

Question 7

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. For automated ingestion of STIX/TAXII indicators to drive incident response, the mandatory configuration is mapping STIX observable types (e.g., ipv4-addr, domain-name, file hashes) to the SIEM's local incident categories and severity levels. Without this mapping, indicators arrive but cannot be triaged, prioritized, or routed into the IR workflow.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 8

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Accepted Answer

MSSP. An MSSP (Managed Security Service Provider) is a third-party provider that delivers outsourced security monitoring and management services — such as 24/7 SOC operations, SIEM monitoring, and incident response — while the client organization retains ownership and control of its security posture and policies. This matches the scenario of outsourcing monitoring while retaining internal control.

Answer

Virtual SOC

Answer

Internal SOC

Answer

Hybrid Cloud SOC

Question 9

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

Accepted Answer

Isolate the workstation from the network using EDR. The immediate priority is to stop the malware from communicating and spreading. Isolating the endpoint via EDR achieves this by cutting off all network traffic from that host while preserving its state for investigation. This is a standard containment procedure that balances security with forensic integrity.

Answer

Run a full antivirus scan on the workstation

Answer

Block the C2 IP address at the perimeter firewall

Answer

Shut down the workstation immediately

Question 10

You are the SOC manager at a financial institution. During a monthly review, you notice that the mean time to detect (MTTD) security incidents has increased from 15 minutes to 3 hours over the past quarter. After investigation, you find that analysts are manually correlating alerts from the SIEM with threat intelligence feeds, which is time-consuming. Which action should you take FIRST to reduce MTTD?

Accepted Answer

Implement automated threat intelligence enrichment in the SIEM to correlate alerts with external feeds.. The increased MTTD is caused by manual correlation of SIEM alerts with threat intelligence feeds. Automating threat intelligence enrichment in the SIEM streamlines this process, providing analysts with enriched alerts that include external context. This reduces manual steps, accelerates triage, and directly lowers MTTD. Other options either add resources without fixing the process, reduce coverage, or suppress alerts, which are not sustainable solutions.

Answer

Reduce the number of threat intelligence feeds to only the most critical ones to simplify correlation.

Answer

Configure the SIEM to generate fewer alerts by raising the severity threshold for threat intelligence matches.

Answer

Increase the number of analysts on each shift to handle the manual correlation workload.

Question 11

A SOC analyst receives an alert about a possible data exfiltration attempt from a database server. The analyst needs to determine if large amounts of data were transferred outbound. Which network monitoring approach would best provide this information?

Accepted Answer

Review NetFlow records for outbound traffic volume from the database server.. NetFlow records capture flow-level metadata, including byte and packet counts, which can reveal unusually large outbound transfers indicative of data exfiltration. Unlike DNS logs, event logs, or antivirus logs, NetFlow directly measures the volume of data moving across the network. This makes it the most appropriate tool for determining if significant amounts of data were sent from the database server to an external destination.

Answer

Inspect DNS query logs for anomalous domain names.

Answer

Analyze Windows Security event logs for account logon events.

Answer

Check the server's antivirus logs for malware detections.

Question 12

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

Accepted Answer

The file has a high entropy value, especially in the code sections.. High entropy in code sections is a strong indicator of packing because packers compress or encrypt the original executable, resulting in randomized data. Tools like PEiD or Detect It Easy can identify known packers, but entropy analysis is a fundamental first step. In contrast, other options like digital signatures or import counts do not directly correlate with packing and may even suggest the opposite.

Answer

The file size is less than 100 KB.

Answer

The file has a large number of imported functions from kernel32.dll.

Answer

The file contains a digital signature from a known vendor.

Question 13

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring alerts, performing initial triage, and filtering out false positives. They validate whether an alert is a genuine security incident and escalate only confirmed incidents to Tier 2. This tier requires foundational skills and follows documented procedures to ensure basic incident filtering.

Answer

Tier 3

Answer

SOC Manager

Answer

Tier 2

Question 14

A SOC analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unfamiliar IP address over HTTPS. The analyst wants to determine if the traffic is malicious command and control (C2) or legitimate business traffic. Which technique should the analyst use to inspect the encrypted payload without terminating the session?

Accepted Answer

Analyze the JA3/JA3S fingerprints of the TLS handshake. JA3/JA3S fingerprinting is a passive technique that creates a fingerprint of the TLS handshake by hashing specific fields in the ClientHello and ServerHello. This allows identification of the client and server applications without decryption. In the scenario, comparing the JA3 hash to known malware families or legitimate applications can quickly indicate whether the traffic is likely C2. It does not disrupt the session and can be performed on network metadata, making it ideal for incident response.

Answer

Use NetFlow records to analyze packet sizes and timings

Answer

Perform SSL/TLS interception using a proxy with a trusted certificate

Answer

Deploy a honeypot to capture similar traffic

Question 15

A SOC team uses AWS Security Hub to centralize findings from GuardDuty, Inspector, and Macie. The team wants to automatically route only high-severity findings to an incident response ticketing system while suppressing informational findings. Which AWS Security Hub capability should the team configure to accomplish this?

Accepted Answer

Security Hub automation rules. Security Hub automation rules apply criteria to incoming findings and can automatically update, suppress, or route them. Matching severity labels HIGH and CRITICAL while suppressing INFORMATIONAL findings lets the team forward only actionable high-severity findings to the ticketing system without manual triage.

Answer

Security Hub Insights

Answer

Security Hub custom actions

Answer

Security Hub finding aggregation

Question 16

A SOC analyst is reviewing a SIEM alert that fired on a suspicious PowerShell execution. The command line includes an encoded parameter and a download cradle. The analyst confirms the endpoint is a developer workstation used for legitimate automation. Which action best balances security and business continuity while still validating the alert?

Accepted Answer

Decode the PowerShell command, review the parent process, and check the endpoint for related network connections. Decoding the encoded PowerShell command and reviewing parent process and network connections provides concrete evidence to determine whether the activity is legitimate automation or malicious. This validation step preserves business continuity for the developer while enabling confident escalation if needed. Premature containment or blanket policy changes can disrupt operations and destroy evidence.

Answer

Close the alert as benign because the workstation belongs to a developer

Answer

Immediately disable the user's Active Directory account and isolate the workstation

Answer

Block all PowerShell execution on the workstation via Group Policy

Question 17

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 18

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

Accepted Answer

Implement multi-stage correlation rules that require high-confidence indicators to fire. Multi-stage correlation rules require multiple high-confidence indicators to align before generating an alert, which directly reduces false positives and improves the Signal-to-Noise ratio. By chaining events (e.g., a suspicious login followed by unusual data access), the SIEM fires only on genuinely suspicious behavior rather than on isolated low-fidelity events. This is the standard SOC practice for tuning detection content to combat alert fatigue.

Answer

Increase the retention period for all raw log data

Answer

Lower the threshold for all IDS alerts to catch more threats

Answer

Outsource all monitoring to a managed security provider

Question 19

A SOC analyst is investigating a suspected compromise of an AWS Lambda function. The analyst needs to determine what code was executed and which IAM role the function assumed during the suspicious activity. Which AWS service should the analyst use to review the function's configuration and execution role?

Accepted Answer

AWS Lambda console or GetFunction API. The Lambda console and GetFunction API are correct because they expose the function's configuration, including the execution role and the code package. An analyst can retrieve the role ARN and download the code to review what was executed. CloudTrail, CloudWatch Logs, and X-Ray provide runtime or API-level data but not the function's configured role or code.

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 20

You are a SOC analyst at a company that uses Microsoft 365. You receive an alert that a user's mailbox is being accessed from an unusual location. You need to review the mailbox audit logs to determine which operations were performed and by whom. Which Microsoft 365 tool should you use to search these logs?

Accepted Answer

Microsoft 365 compliance center audit log search. The Microsoft 365 compliance center audit log search queries the unified audit log, which captures mailbox operations such as MailItemsAccessed, SendAs, and SendOnBehalf. This is the authoritative source for investigating suspicious mailbox access and determining which operations were performed and by whom. Other tools like Defender for Cloud Apps or Microsoft Entra ID sign-in logs provide complementary data but lack the granular mailbox audit events needed here.

Answer

Azure Active Directory sign-in logs

Answer

Exchange admin center mail flow rules

Answer

Microsoft Defender for Cloud Apps activity log