312-39 Practice Test 5 — 25 Questions

Question 1

A SOC analyst is triaging a Linux web server that is suspected of hosting a web shell used by an attacker to maintain access. The analyst has a disk image and needs to identify indicators of the web shell and its activity. Which TWO artifacts should the analyst prioritize examining? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The web server access logs, looking for POST requests with unusual parameters or anomalous response sizes and user agents. Web shells manifest in two places: the web server access log, where command execution appears as anomalous POST traffic to a script, and the document root itself, where the injected file can be found by comparing against a baseline or package checksums. Kernel, SSH, and credential artifacts address unrelated intrusion vectors and do not evidence the web shell.

Answer

The /etc/shadow file, verifying password hash algorithms and account expiration fields

Answer

The systemd journal entries for the SSH daemon, counting failed authentication attempts per source IP

Answer

The kernel ring buffer, searching for segmentation faults and out-of-memory kill messages

Question 2

A SOC analyst is performing dynamic malware analysis in an isolated sandbox. The analyst wants to observe the malware's file system and Registry modifications in real time and then roll back the system to a clean state afterward. Which approach best supports this requirement?

Accepted Answer

Run the sample inside a virtual machine configured with a snapshot that is reverted after each analysis run. Dynamic analysis in an isolated VM with a pre-execution snapshot lets the analyst watch file system and Registry writes live using monitoring tools, then discard all changes by reverting. The snapshot guarantees a clean baseline for the next run. Running on production hardware, relying on public scanners, or performing only static review cannot satisfy both the real-time observation and rollback requirements.

Answer

Analyze the sample with a disassembler and annotate the file-system API calls statically

Answer

Upload the sample to a public multi-engine scanning service and review the behavioral report

Answer

Execute the sample directly on the analyst's production workstation while monitoring with Process Monitor

Question 3

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Accepted Answer

Isolate the host from the network. The presence of svchost.exe running from a temp folder is a classic indicator of a process masquerading attack, where malware names itself after a legitimate Windows process to evade detection. The most immediate action is to isolate the host from the network to prevent lateral movement, data exfiltration, or command-and-control communication. Containment must precede any remediation or investigation to avoid tipping off the attacker or allowing further damage.

Answer

Delete the file

Answer

Update antivirus signatures

Answer

Restart the server

Question 4

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis examines a binary without executing it, so the analyst inspects its contents and metadata directly. Option B is correct because embedded strings often reveal hardcoded C2 domains, IP addresses, URLs, file paths, and other artifacts that expose the malware's intent and infrastructure. Option C is correct because computing cryptographic hashes such as MD5 or SHA256 provides a unique fingerprint used to identify, correlate, and look up the sample in threat-intelligence databases like VirusTotal without running it. Option E is correct because the Import Address Table lists the Windows API functions the binary references (e.g., CreateRemoteThread, InternetOpen), which strongly hints at its capabilities such as process injection or network communication. Option A is not a static indicator since memory usage patterns only emerge during dynamic execution or runtime monitoring. Option D is likewise dynamic, as network latency to a server can only be measured by executing the sample and observing live traffic.

Answer

Memory usage patterns

Answer

Network latency to the server

Question 5

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

Accepted Answer

where. The 'where' operator filters rows in a table based on a boolean predicate, so it is the correct choice to return only SecurityAlert rows where Severity == 'High' and the resource provider matches. It is the standard KQL filtering operator used in Sentinel analytics and hunting queries.

Answer

summarize

Answer

project

Answer

find

Question 6

A SOC analyst receives an alert about a workstation making an outbound connection to a known malicious IP address on port 443. The connection is encrypted and occurs every 5 minutes with small, consistent packet sizes. Which phase of the Cyber Kill Chain does this activity most directly represent?

Accepted Answer

Command and Control (C2). The periodic, encrypted, small-packet connections to a known malicious IP are hallmark signs of Command and Control beaconing. In the Cyber Kill Chain, C2 is the phase where compromised hosts communicate with attacker infrastructure to receive commands. This activity typically follows exploitation and installation, and precedes actions on objectives. The regularity and packet size distinguish it from data exfiltration or other phases.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Weaponization

Question 7

Which THREE of the following are essential for effective incident response within a SIEM?

Accepted Answer

Automated playbooks or runbooks.. Automated playbooks or runbooks (A) are essential because they codify the repeatable steps analysts execute during detection, containment, eradication, and recovery, reducing mean time to respond and ensuring consistency across incidents. Clearly defined triage procedures (C) are essential because they let the SIEM team rapidly classify alerts by severity, validate true versus false positives, and prioritize which events require immediate escalation. Integration with ticketing systems (D) is essential because it creates an auditable workflow that assigns ownership, tracks status and SLAs, and preserves the evidence trail needed for post-incident review and compliance. The unmarked options do not belong: unlimited coffee (B) and a large collection of desk chairs (E) are office-comfort items with no bearing on SIEM detection, triage, or response capabilities.

Answer

Unlimited coffee supply.

Answer

A large collection of desk chairs.

Question 8

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Accepted Answer

Confirmed evidence of malicious intent or unauthorized access.. Option B is correct because confirmed evidence of malicious intent or unauthorized access is a definitive trigger for escalation — once an analyst verifies true-positive malicious activity (e.g., credential compromise, data exfiltration, or active intrusion), the incident exceeds routine triage and must be handed to senior responders or incident response teams. Option D is correct because an alert involving a critical production server raises the potential business impact (downtime, data integrity, revenue loss), so it warrants escalation to prioritize containment and engage the appropriate stakeholders. Option A is not a valid reason, since an alert's name has no bearing on its severity or risk. Option C is not valid, as who generated the alert does not determine whether it requires escalation. Option E is not valid, because SIEM license expiration is an administrative/procurement concern, not an incident escalation criterion.

Answer

The user likes the alert's name.

Answer

The alert was generated by a junior analyst.

Answer

The SIEM license is expiring soon.

Question 9

A SOC analyst notices a spike in alerts for the same Windows event ID 4625 (failed logon) across dozens of workstations, each showing a different username and originating from the same internal server. The server is not a domain controller and has no legitimate authentication role. What does this pattern MOST likely indicate?

Accepted Answer

An attacker has compromised the server and is performing a password spray attack against user accounts across the environment.. A single internal server that is not a domain controller generating failed logons for many different usernames is characteristic of password spraying from a compromised host. The attacker likely gained a foothold and is now attempting to harvest additional credentials. The correct response is to treat the server as compromised and begin containment and forensic investigation.

Answer

A vulnerability scanner is running a credentialed scan and generating authentication failures as it tests accounts.

Answer

The domain controller is replicating bad password attempts to member workstations, causing duplicate events.

Answer

A misconfigured application on the server is repeatedly attempting to authenticate with stale service account credentials.

Question 10

A SOC analyst is proactively hunting for unauthorized remote access tools. The analyst wants to identify hosts where a remote desktop client was used to connect to an external IP address. Which Windows artifact should the analyst examine to find the most recent outbound RDP connection targets?

Accepted Answer

Registry key HKCU\Software\Microsoft\Terminal Server Client\Servers. The Terminal Server Client Servers registry key is the client-side history of outbound RDP connections. It lists target hosts and MRU values, making it the best artifact for identifying external RDP destinations. Server-side logs and inbound logon events only show connections to the local host, not from it.

Answer

TerminalServices-RemoteConnectionManager operational log

Answer

Security event log 4624 Logon Type 10

Answer

RemoteDesktopServices-RdpCoreTS operational log

Question 11

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

Accepted Answer

powershell.exe -enc JABz.... Living off the Land (LotL) techniques use legitimate, pre-installed system tools to carry out attacks, avoiding the need to drop custom malware. 'powershell.exe -enc JABz...' is a classic LotL indicator: it uses the built-in PowerShell interpreter with a Base64-encoded command (-enc) to obfuscate malicious activity. This allows attackers to execute code without introducing foreign binaries.

Answer

malware.exe

Answer

mimikatz.exe

Answer

netcat.exe

Question 12

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Accepted Answer

To maintain persistent communication. The Command and Control (C2) tactic in MITRE ATT&CK describes how adversaries communicate with compromised systems to control them. Its primary goal is to establish and maintain a communication channel that allows the attacker to send commands and receive data, often using obfuscated or encrypted protocols to evade detection. This persistent communication is what enables subsequent actions like data exfiltration or lateral movement.

Answer

To escalate privileges

Answer

To steal data

Answer

To gain initial access

Question 13

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

Accepted Answer

Microsoft Entra ID Sign-in logs. Microsoft Entra ID (formerly Azure AD) Sign-in logs capture authentication events including the geographic location (via IP geolocation), device details, and risk level (when Identity Protection is enabled). This is the correct place to investigate suspicious VM or user sign-in patterns.

Answer

Azure Policy Compliance dashboard

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 14

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Accepted Answer

Dynamic analysis requires a sandbox or isolated environment. Option C is correct because static analysis examines a binary's code, headers, strings, imports, and structure without ever running it, which is its defining characteristic. Option A is correct because dynamic analysis observes the malware's actual behavior at runtime, so it must be executed inside a sandbox or otherwise isolated environment to prevent infection of the host and to safely capture process, file, registry, and network activity. Option B is incorrect because static analysis is not always faster; large or obfuscated/packed binaries can make it slow, while dynamic analysis may complete quickly. Option D is incorrect because static analysis can reveal malicious intent through indicators such as suspicious API imports, embedded strings, or malicious code patterns. Option E is incorrect because dynamic analysis applies to Windows, Linux, macOS, and other platforms, not only Linux systems.

Answer

Static analysis is always faster than dynamic analysis

Answer

Static analysis cannot identify malicious intent

Answer

Dynamic analysis is only used for Linux systems

Question 15

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Accepted Answer

Standardized handover and documentation. Follow-the-Sun relies on handing off active incidents between geographically distributed teams at the end of each shift, so standardized handover procedures and consistent documentation are the critical enablers. Without a uniform template covering incident status, actions taken, and next steps, the incoming team loses context and response stalls. This is a process and people requirement, not a technology purchase.

Answer

Purchasing a new SIEM license

Answer

Moving all logs to the cloud

Answer

Increasing the number of Tier 3 analysts

Question 16

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)

Accepted Answer

Web proxy logs. Firewall logs and web proxy logs are the most critical for determining data exfiltration method and volume. Firewall logs show outbound connections and byte counts, while proxy logs provide application-layer details like URLs and payload sizes. Together, they allow the analyst to identify the channel and quantify the data transferred. Other logs like DNS or authentication may provide context but lack the direct volume and method information.

Answer

DNS query logs

Answer

System performance logs

Answer

Authentication logs

Question 17

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Accepted Answer

Network traffic logs showing SMB/RDP connections between workstations. Option A is correct because network traffic logs capturing SMB (TCP 445) and RDP (TCP 3389) connections between workstations directly reveal lateral movement paths, such as workstation-to-workstation SMB sessions or RDP logins that deviate from normal patterns. Option E is correct because Windows Security Log Event ID 4624 records successful logon events, including Logon Type 3 (Network, typical of SMB) and Logon Type 10 (RemoteInteractive, used by RDP), which are essential for identifying remote access to a host. Option B is not relevant since system clock synchronization logs only concern time accuracy (e.g., NTP/W32Time) and do not record access activity. Option C is not relevant because Microsoft Word application logs capture document or crash events, not remote access techniques. Option D is not relevant because browser cache logs only reflect web browsing artifacts and have no bearing on RDP or SMB lateral movement.

Answer

System clock synchronization logs

Answer

Application logs for Microsoft Word

Answer

Browser cache logs

Question 18

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Accepted Answer

Modification of CloudTrail or logging configurations. Option A is correct because attackers routinely disable or tamper with CloudTrail trails, S3 access logging, or GuardDuty to erase their tracks, so any modification of logging configurations is a high-fidelity compromise indicator. Option D is correct because successful authentications from multiple geographically distant locations in a short window suggest credential theft or session hijacking, indicating account takeover. Option E is correct because creating an IAM user without an MFA device is a classic persistence technique used to establish a backdoor identity that survives password resets. Option B is not a reliable indicator, since free-tier usage is normal for many legitimate accounts and does not by itself signal compromise. Option C is not an indicator at all, as scheduled system reboots are routine maintenance activity rather than malicious behavior.

Answer

Increased usage of free-tier services

Answer

Standard scheduled system reboots

Question 19

What is the main objective of the 'Post-Incident Activity' phase?

Accepted Answer

To identify lessons learned and improve future response. The Post-Incident Activity phase in the NIST SP 800-61 incident response lifecycle exists to review what happened, capture lessons learned, and feed improvements back into preparation, detection, and response processes. Its core output is a post-incident report and updated playbooks, not punitive or destructive actions. This is why 'identify lessons learned and improve future response' is the correct objective.

Answer

To close all firewall ports

Answer

To discipline the employee involved

Answer

To delete all evidence

Question 20

What does the 'False Positive' rate of a SIEM rule indicate?

Accepted Answer

The ratio of legitimate activity flagged as malicious.. A false positive occurs when a SIEM rule flags legitimate activity as malicious. The false positive rate therefore measures the ratio or percentage of alerts that are benign but incorrectly identified as threats. A high false positive rate means analysts waste time investigating non-issues and may develop alert fatigue.

Answer

The speed of alert generation.

Answer

The number of logs ingested.

Answer

The percentage of blocked attacks.