312-39 Practice Test 4 — 25 Questions

Question 1

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Accepted Answer

excel.exe. When a malicious macro runs, it often triggers 'cmd.exe' or 'powershell.exe' from the 'excel.exe' process tree.

Answer

explorer.exe

Answer

wininit.exe

Answer

svchost.exe

Question 2

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is specifically designed to view the structure of Portable Executable (PE) files including headers and imports.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 3

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. Using a transparent SSL/TLS proxy (like an intercepting proxy) allows the analyst to decrypt traffic if the certificate is trusted by the client.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 4

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Accepted Answer

Verify if the connection was successful or blocked by the firewall.. Verifying if the connection was successful is essential to confirm if a threat exists.

Answer

Isolate the host immediately.

Answer

Reimage the affected workstation.

Answer

Contact the user's manager.

Question 5

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Accepted Answer

Joins allow matching records between two datasets based on a common field.. Joins allow for the association of different data types based on common entities like IP addresses or hostnames.

Answer

Unions only support structured data.

Answer

Joins consume less memory than unions.

Answer

Unions cannot be used in detection rules.

Question 6

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) provides real-time monitoring of file system, Registry, and process activity.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer

Question 7

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

Accepted Answer

Create a custom DSM and map the event IDs to existing QIDs.. QID mapping ensures that normalized events are correctly classified for correlation.

Answer

Increase the storage allocation for the log source.

Answer

Upgrade the firmware on the log source.

Answer

Restart the Event Processor service.

Question 8

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

Accepted Answer

Check the SIEM ingestion error logs for agent authentication issues.. Checking the SIEM ingestion logs or agent logs is the logical step to identify why the data is not reaching the SIEM.

Answer

Reinstall the OS on the server.

Answer

Increase the server CPU.

Answer

Delete the server from the SIEM asset list.

Question 9

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Accepted Answer

Implementing Risk-Based Alerting (RBA).. Tuning thresholds and using risk-based alerting are key strategies.

Answer

Disabling all alerts during off-hours.

Answer

Using wildcard searches for all rules.

Answer

Increasing log retention to 10 years.

Question 10

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

Accepted Answer

Threat Intelligence Feed or Lookup Table.. Lookups or Threat Intelligence feeds are the standard ways to import external lists of IoCs.

Answer

Global Rule Deletion.

Answer

Log Rotation Policy.

Answer

System Backup.

Question 11

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

Accepted Answer

Modify the device-side agent parser or the FlexConnector map file to extract the 'SessionID' field.. Before a field can be used in a correlation rule, it must be mapped to a Common Event Format (CEF) field or a custom FlexConnector mapping must be defined to parse it from the raw log.

Answer

Create a new 'Active List' to store the unparsed data.

Answer

Use the 'regex' operator within the rule condition itself.

Answer

Enable 'Event Forwarding' on the ESM manager.

Question 12

Which document should you reference first to determine the communication path during a high-severity security incident?

Accepted Answer

Incident Response Plan. The Incident Response Plan (IRP) specifically defines the roles, responsibilities, and communication channels for incidents.

Answer

Employee Handbook

Answer

Network Topology Diagram

Answer

Disaster Recovery Plan

Question 13

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Accepted Answer

Dynamic analysis requires a sandbox or isolated environment. Static analysis examines code without executing it, while dynamic analysis observes behavior during execution.

Answer

Static analysis is always faster than dynamic analysis

Answer

Static analysis cannot identify malicious intent

Answer

Dynamic analysis is only used for Linux systems

Question 14

What is the purpose of normalizing logs in a SIEM?

Accepted Answer

To provide a common format for cross-vendor correlation.. Normalization creates a common schema, allowing for cross-vendor correlation.

Answer

To compress log size for storage efficiency.

Answer

To hide sensitive information.

Answer

To increase the ingestion speed.

Question 15

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

Accepted Answer

Source IP, destination host, and the involved user account.. Context like the source, destination, and user activity is required to assess risk.

Answer

The time taken to generate the alert.

Answer

The hardware vendor of the firewall.

Answer

The SIEM software version.

Question 16

What is a 'log source' in the context of a SIEM?

Accepted Answer

Any device or application generating security logs.. Any device or application that generates logs (firewalls, servers, databases) is a log source.

Answer

The database storing the logs.

Answer

The SIEM administrator's computer.

Answer

A physical cable.

Question 17

Which of these is a common SIEM data ingestion protocol?

Accepted Answer

Syslog.. Syslog is the most common and standard protocol for log transmission.

Answer

ICMP.

Answer

HTTP.

Answer

DHCP.

Question 18

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

Accepted Answer

Custom-tailored malware and tools. APTs are characterized by their long-term focus, stealth, and specific target orientation.

Answer

Automated mass-scale scanning

Answer

Immediate data destruction

Question 19

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Persistence mechanisms ensure malware survives reboots or user logoffs; common locations include scheduled tasks, registry keys, and startup folders.

Answer

System memory dumps

Answer

Event log files

Question 20

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

Accepted Answer

Add the vulnerability scanner's IP to an exclusion list (whitelist).. Excluding known-good assets prevents alert fatigue and ensures SOC focus on real threats.

Answer

Disable the rule entirely.

Answer

Upgrade the vulnerability scanner.

Answer

Increase the rule threshold.