312-39 Practice Test 4 — 25 Questions

Question 1

Which TWO of the following are primary components of a cloud-native incident response plan?

Accepted Answer

Containment. Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61. Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Answer

Resource Provisioning

Answer

Budget Optimization

Answer

Hardware Refresh

Question 2

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

Accepted Answer

HTTP/HTTPS proxy logs. Data exfiltration to cloud storage providers such as Dropbox, Google Drive, or OneDrive typically occurs over HTTP/HTTPS, so proxy logs capture the destination URLs, bytes transferred, user identity, and timestamps needed to detect large uploads. Proxy logs are the primary evidence source for identifying which host sent how much data to which external cloud endpoint.

Answer

DHCP logs

Answer

NTP logs

Answer

SNMP logs

Question 3

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Option B is correct because Chain of Custody documentation must identify the person who collected or handled the evidence, establishing accountability for every transfer and ensuring the evidence can be traced to a responsible individual. Option E is correct because the date and time of collection are essential custody metadata that establish when the evidence was seized, helping prove it was not altered or tampered with before analysis. Together, the collector's identity and the collection timestamp are core elements required to demonstrate an unbroken custody trail. Options A, C, and D are incorrect because hard drive casing color, CPU manufacturer, and system temperature are irrelevant hardware or environmental details that do not establish who handled the evidence or when it was collected.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 4

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

Accepted Answer

Provides real-time context to alerts.. Threat intelligence integration enriches SIEM alerts with real-time context such as known malicious IPs, domains, file hashes, and adversary tactics. This context helps analysts quickly determine whether an alert is benign or part of a known campaign, improving triage speed and accuracy. It does not replace human analysts or automate response; it augments detection and investigation.

Answer

Increases the log ingestion rate.

Answer

Replaces the need for a SOC team.

Answer

Automates all incident response.

Question 5

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Accepted Answer

Keep logs for one year, with 3 months immediately available. PCI-DSS requirement 10.7 mandates retaining audit logs for at least one year, with a minimum of three months immediately available for analysis. This ensures that logs are accessible for forensic investigations and compliance audits, while older logs can be archived but must be retrievable.

Answer

Archive all logs in a local text file format only

Answer

Retain logs for exactly 30 days

Answer

Delete logs after they are indexed in the SIEM

Question 6

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

Accepted Answer

netstat -ano. The analyst needs a live mapping of connections to the owning process on a Windows host using only built-in tooling. The netstat utility with the -a, -n, and -o switches enumerates all connections in numeric form and appends the owning PID, allowing direct correlation to PID 4212. None of the other utilities expose socket ownership, so they cannot answer the question.

Answer

nslookup

Answer

arp -a

Answer

tracert

Question 7

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Accepted Answer

Document the rationale for closure. Option B is correct because documenting the rationale for closing an alert as a False Positive creates an audit trail and preserves the analyst's reasoning for compliance, reporting, and future investigations. Option D is correct because a confirmed False Positive often reveals that the correlation rule's logic, thresholds, or field mappings are too broad, so tuning the rule reduces future noise and improves detection fidelity. Option A is wrong because simply ignoring an alert without formal closure leaves it in an unresolved state and breaks incident-handling workflow. Option C is wrong because deleting the original event log destroys forensic evidence and violates log retention and integrity requirements. Option E is wrong because a False Positive is a detection-tuning issue, not a licensing capacity problem, so requesting a new SIEM license does not address the root cause.

Answer

Ignore the alert without closure

Answer

Delete the original event log

Answer

Request a new SIEM license

Question 8

A SOC analyst receives an alert that a domain controller is generating a high volume of Kerberos ticket-granting service (TGS) requests with RC4 encryption for various service principal names. The analyst suspects a Kerberoasting attack. Which Windows event ID should the analyst prioritize to confirm the attack?

Accepted Answer

Event ID 4769 (A Kerberos service ticket was requested). Kerberoasting exploits Kerberos TGS requests by requesting service tickets for accounts with SPNs and then cracking the encrypted ticket offline. Domain controllers log these requests as Event ID 4769. The presence of RC4 encryption (type 0x17) in 4769 events is a strong indicator because Kerberoasting tools often request RC4 tickets for easier cracking. Monitoring 4769 for anomalous service names and encryption types enables detection.

Answer

Event ID 4771 (Kerberos pre-authentication failed)

Answer

Event ID 4624 (An account was successfully logged on)

Answer

Event ID 4768 (A Kerberos authentication ticket (TGT) was requested)

Question 9

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Accepted Answer

Check the asset's 'Business Criticality' and 'Owner' in the CMDB to see if the activity is a scheduled backup.. Before taking disruptive action, the analyst must establish context: checking the CMDB for the asset's business criticality and owner determines whether the 50GB transfer is a legitimate scheduled backup to cloud storage or genuine exfiltration. This validation step prevents false-positive responses that could break business operations or destroy evidence. Triage prioritizes understanding over immediate reaction.

Answer

Block the cloud storage IP address on the corporate firewall.

Answer

Immediately disable the user account in Active Directory.

Answer

Re-image the affected host immediately.

Question 10

A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?

Accepted Answer

use-dns(yes);. To replace IP addresses with hostnames in syslog-ng, the use-dns(yes) option must be enabled. This triggers reverse DNS lookups on incoming messages, resolving IPs to hostnames when the sending device does not provide one. The other options either preserve existing hostnames, cache lookups, or handle relay chains, but none enable the necessary DNS resolution.

Answer

keep-hostname(yes);

Answer

dns-cache(yes);

Answer

chain-hostnames(yes);

Question 11

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Accepted Answer

Implementing Risk-Based Alerting (RBA).. Option A, Implementing Risk-Based Alerting (RBA), is correct because RBA aggregates multiple low-severity detections into a single risk-scored entity (user, host, or IP) rather than alerting on each event individually, which dramatically reduces the volume of isolated false-positive alerts and lets analysts focus on correlated, higher-risk behavior. Option D, Setting thresholds based on baselined activity, is correct because establishing a normal behavioral baseline (for example, typical login counts, data-transfer volumes, or process execution rates per host) allows thresholds to be tuned to the environment so that only statistically anomalous deviations trigger alerts, minimizing noise from legitimate activity. Option B is wrong because disabling all alerts during off-hours creates dangerous blind spots that attackers commonly exploit and does nothing to improve alert fidelity. Option C is wrong because wildcard searches for all rules broaden matching logic, producing more spurious hits and worsening false positives rather than reducing them. Option E is wrong because increasing log retention to 10 years affects storage and forensic availability, not the precision or false-positive rate of SIEM alert rules.

Answer

Disabling all alerts during off-hours.

Answer

Using wildcard searches for all rules.

Answer

Increasing log retention to 10 years.

Question 12

Which of the following is a key advantage of utilizing a centralized SIEM platform?

Accepted Answer

Unified visibility across disparate security layers.. A centralized SIEM aggregates and correlates log and event data from many heterogeneous sources — firewalls, IDS/IPS, endpoints, identity providers, cloud workloads — into a single normalized platform. This gives analysts one pane of glass to detect cross-layer attack patterns that would be invisible when each tool's logs are siloed. The core value is correlation and unified visibility, not cost savings or automated response.

Answer

Hardware reduction in the datacenter.

Answer

Elimination of all false positives.

Answer

Automatic remediation of all threats.

Question 13

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Accepted Answer

Centralized visibility across multiple cloud providers. Option A is correct because a SIEM integrated with cloud-native logs ingests log streams from AWS CloudTrail, Azure Activity Logs, and GCP Cloud Audit Logs into one platform, giving centralized visibility across multiple cloud providers. Option B is correct because the SIEM stores normalized events in a long-term index, enabling advanced threat hunting queries and analytics over historical data that native cloud consoles cannot retain or query at scale. Option D is correct because the SIEM's correlation engine joins events from different security layers (identity, network, workload, and control-plane logs) into a single detection timeline, surfacing multi-stage attacks that isolated tools would miss. Option C is not a SIEM function; guest OS kernel patching is performed by configuration-management or patch-management tools such as AWS Systems Manager Patch Manager or Azure Update Manager. Option E is not a SIEM function either; creating cloud accounts is an identity/provisioning task handled by services like AWS Organizations or Azure Management Groups, not by log analytics.

Answer

Automatic patching of guest OS kernels

Answer

Automated creation of new cloud accounts

Question 14

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Accepted Answer

Scanning for open ports and services. The Reconnaissance phase of the Cyber Kill Chain (Lockheed Martin's seven-phase model) is the first stage, where the adversary gathers information about the target before launching an attack. Scanning for open ports and services is a classic active reconnaissance technique (e.g., using nmap or masscan) that maps the attack surface and identifies exploitable services. This aligns with the phase's goal of intelligence gathering to inform later weaponization and delivery stages.

Answer

Deploying a remote access trojan

Answer

Exploiting a software vulnerability

Answer

Encrypting data for ransom

Question 15

A SOC analyst is building detection content for credential access techniques on Windows endpoints. Which two artifacts would most reliably indicate an attempt to dump credentials from LSASS? (Choose two.)

Accepted Answer

Sysmon Event ID 10 showing a non-Microsoft signed process requesting access to lsass.exe. Credential dumping from LSASS requires both accessing the protected process memory and persisting or transmitting the extracted secrets. Detections that combine a suspicious process opening lsass.exe with subsequent dump file creation, or that flag non-Microsoft signed processes requesting access to lsass.exe through Sysmon, directly capture those steps and are far more reliable than authentication-failure or account-creation artifacts.

Answer

A new local administrator account created outside change management windows

Answer

An increase in Kerberos TGS requests using RC4 encryption for many service accounts

Answer

Event ID 4625 failures followed by a 4624 success for the same account from a new source workstation

Question 16

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

Accepted Answer

Check threat intelligence feeds to see if the IP is flagged as malicious.. Cloud provider IPs are commonly used by attackers (and also by legitimate scanners and services), so the correct triage step is to enrich the source IP with threat intelligence feeds to determine whether it is a known malicious actor. This contextual enrichment is a core SOC triage practice before deciding to escalate, close, or tune. It avoids both blind escalation and blind dismissal.

Answer

Escalate to the ISP immediately.

Answer

Disable the rule for all cloud traffic.

Answer

Ignore the alert as cloud IPs are always false positives.

Question 17

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

Accepted Answer

Generating cryptographic hashes for log files. Generating cryptographic hashes for log files creates a tamper-evident seal: any modification to the log changes its hash, which can be detected by recomputing and comparing. This is the most robust method because it provides integrity verification even if an attacker gains write access to the logs. Hashing should be done immediately after log rotation and stored separately from the logs themselves.

Answer

Storing logs on a local partition

Answer

Clearing the logs daily

Answer

Setting file permissions to read-only

Question 18

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

Accepted Answer

Alert Triage and Prioritization. Alert triage and prioritization involves reviewing incoming alerts, assessing their severity, and categorizing them to focus on the most critical issues first. Mapping alerts to MITRE ATT&CK techniques helps analysts understand the adversary's tactics and prioritize based on the stage of the attack, which directly reduces alert fatigue by filtering out low-priority or duplicate alerts. This is a core triage activity, not a vulnerability assessment, rule development, eradication, or log retention task.

Answer

Vulnerability Assessment

Answer

Correlation Rule Development

Answer

Incident Eradication

Answer

Log Retention Analysis

Question 19

What is the primary benefit of using a centralized logging server compared to local logging?

Accepted Answer

Simplified log correlation and incident response. A centralized logging server aggregates logs from many sources into one location, enabling correlation of events across hosts, applications, and time zones — which is essential for detecting multi-stage attacks and accelerating incident response. Local logging scatters evidence across individual machines, making cross-system correlation slow or impossible during an investigation. Centralization also supports retention, tamper resistance, and compliance reporting from a single platform.

Answer

Increased disk space on the local server

Answer

Eliminating the need for a security policy

Answer

Faster network traffic speeds

Question 20

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Accepted Answer

Increased DNS request volume (DNS Tunneling). Option D is correct because DNS tunneling is a classic data exfiltration technique: malware encodes stolen data into DNS queries (often TXT, NULL, or CNAME records) sent to an attacker-controlled authoritative name server, so a sudden spike in DNS request volume—especially long or high-entropy subdomain labels—signals data being smuggled out through port 53. Option E is correct because exfiltration inherently requires outbound transfer, and a high volume of outbound traffic to an unfamiliar or foreign IP address (particularly over common ports like 80/443 or via protocols such as FTP/SMTP) indicates data being sent to an external command-and-control or collection server. Option A does not belong because multiple failed logins indicate a brute-force or password-guessing attempt (an access/authentication attack), not the transfer of data out of the environment. Option B does not belong because system clock synchronization errors point to NTP misconfiguration or time drift, which is a reliability/availability issue rather than evidence of data theft. Option C does not belong because installing new system drivers is a host configuration or persistence/rootkit-related change, not an indicator of outbound data exfiltration.

Answer

Multiple failed login attempts

Answer

System clock synchronization errors

Answer

Installation of new system drivers