312-39 Practice Test 2 — 25 Questions

Question 1

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

Accepted Answer

Restrict the search to a specific time range and relevant indexes.. Filtering by time range and limiting fields are standard practices to optimize SIEM performance.

Answer

Use wildcard searches on all fields.

Answer

Add more fields to the search result.

Answer

Increase the search timeout.

Question 2

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Actionable intelligence must be context-rich, relevant to the infrastructure, and integrated into existing workflows.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 3

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Identifying long-duration connections and baseline deviations in data volume are the most effective ways to spot slow exfiltration.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall

Question 4

Which SIEM feature is used to group related events into a single incident?

Accepted Answer

Event correlation logic.. Correlation engines or incident management modules group events based on shared attributes.

Answer

Log rotation.

Answer

Dashboard visualization.

Answer

Data ingestion.

Question 5

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

Accepted Answer

Configure an Offense rule using the 'when the event matches any of these building blocks' condition and apply a 'count of unique Source IP is greater than or equal to 3' filter within the temporal window.. Using a Building Block (BB) allows for reusable logic. Combining a threshold condition with a 'unique count' filter on source IP addresses ensures the rule only fires when the specific cross-IP threshold is met.

Answer

Use a simple threshold rule set to trigger only on the 5th failure without defining distinct source IP criteria.

Answer

Create a rule using the 'when the event matches any of these building blocks' condition combined with an 'and when at least 5 events are seen with the same username in 1 minute' filter.

Answer

Enable the 'Flow-based Anomaly' detection setting in the system configuration to automatically detect brute-force patterns.

Question 6

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

Accepted Answer

Alert Triage and Prioritization. Triage and prioritization involve categorizing and assessing the urgency of alerts to focus on the most critical threats.

Answer

Vulnerability Assessment

Answer

Correlation Rule Development

Answer

Incident Eradication

Answer

Log Retention Analysis

Question 7

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Accepted Answer

To maintain persistent communication. The goal is to maintain communication between the compromised system and the attacker's infrastructure.

Answer

To escalate privileges

Answer

To steal data

Answer

To gain initial access

Question 8

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

Accepted Answer

Increase the threshold for the number of failed attempts within the lookback window.. Risk-based alerting and threshold tuning are standard practices to reduce noise in SIEM correlation rules.

Answer

Delete the correlation rule and recreate it.

Answer

Enable packet capture on all domain controllers.

Answer

Change the rule severity to 'Informational'.

Question 9

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. Collectors gather data from various sources and forward it to the main processing engine.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 10

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Triage involves verification, context gathering, and determining impact.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 11

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Accepted Answer

An automated process or script is likely involved.. Rapid-fire failures usually indicate a script or bot, rather than a human user.

Answer

The server is overheating.

Answer

A user is having a bad day.

Answer

The SIEM is broken.

Question 12

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Aligning to threat frameworks (like MITRE ATT&CK) and testing against historical data are the pillars of effective use case engineering.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 13

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Baseline behavioral profiling and using multiple conditions (cross-correlation) help reduce noise by ensuring that only significant deviations trigger an alert.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.

Question 14

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. Updating the 'Assigned to' or 'Assignment group' fields while using the 'Work notes' to trigger a business rule notification is the standard workflow.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'

Question 15

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Accepted Answer

Number of affected systems. Business criticality, threat intelligence context, and the number of affected hosts are fundamental metrics for determining the priority of an incident.

Answer

The color scheme of the SIEM dashboard

Answer

The time of day the alert was generated

Question 16

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

Accepted Answer

ip.src == 192.168.1.50. The 'ip.src' filter isolates traffic originating from the specified source IP.

Answer

ip.addr == 192.168.1.50

Answer

src.ip == 192.168.1.50

Answer

filter: 192.168.1.50

Question 17

You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?

Accepted Answer

PowerShell Script Block Logging. Script Block Logging (Event ID 4104) is required to capture the full content of executed PowerShell scripts.

Answer

AppLocker

Answer

Credential Guard

Answer

Audit Process Creation

Question 18

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. Modifying the Security Group associated with the instance is the standard practice to isolate it while maintaining the state for forensics.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance

Question 19

Which document is essential for recording every action taken during an incident for legal and audit purposes?

Accepted Answer

Incident Response Log/Journal. An Incident Log (or Journal) is mandatory for maintaining a chronological record of all response actions.

Answer

Change Management Request

Answer

System Configuration Document

Answer

Business Continuity Plan

Question 20

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

Accepted Answer

Comparing source IP against threat intel feeds of VPN exit nodes. Reviewing connection logs for anomalous login times and comparing them against known VPN exit node lists is the primary technique.

Answer

Analyzing DNS queries

Answer

Checking OS version

Answer

Scanning the source IP