312-39 Practice Test 5 — 25 Questions

Question 1

When building a new SIEM use case, what is the first phase of the development lifecycle?

Accepted Answer

Requirement gathering and scoping.. Defining requirements is always the starting point for SIEM use case design.

Answer

Writing the correlation query.

Answer

Testing the alert in production.

Answer

Documenting the playbook.

Question 2

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Accepted Answer

To reuse common logic in multiple rules.. Building blocks allow you to reuse common logic (e.g., 'Internal IPs') across multiple rules.

Answer

To delete logs from the storage.

Answer

To backup the configuration.

Answer

To generate reports automatically.

Question 3

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the standard repository for aggregating file hash results from multiple antivirus vendors.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 4

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

Accepted Answer

Asset Criticality.. Asset criticality helps determine the priority of an incident in a real-world SOC environment.

Answer

Alert frequency.

Answer

Log source vendor.

Answer

Number of alerts per user.

Question 5

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Accepted Answer

Confirmed evidence of malicious intent or unauthorized access.. High-impact assets and confirmed malicious activity are primary escalation criteria.

Answer

The user likes the alert's name.

Answer

The alert was generated by a junior analyst.

Answer

The SIEM license is expiring soon.

Question 6

In a SIEM, what is the role of a 'Parser'?

Accepted Answer

To extract fields and normalize log data.. Parsers normalize raw log data into a structured format with defined fields.

Answer

To print reports.

Answer

To encrypt log files.

Answer

To scan for viruses.

Question 7

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

Accepted Answer

Browser Hijacking. Installing unauthorized browser extensions is a common technique for persistence and data theft (browser hijacking).

Answer

Man-in-the-Middle (MitM)

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Question 8

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Calculating a cryptographic hash (MD5/SHA256) of the original and the copy confirms that the data has not been altered during the duplication process.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file

Question 9

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The 'Run' and 'RunOnce' keys are the most common locations for malware to ensure automatic execution upon user login.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKCU\Software\Classes

Answer

HKLM\System\CurrentControlSet\Control\Session Manager

Question 10

Which of the following is a key advantage of utilizing a centralized SIEM platform?

Accepted Answer

Unified visibility across disparate security layers.. A unified view allows for correlation across disparate security layers, which is impossible with siloed tools.

Answer

Hardware reduction in the datacenter.

Answer

Elimination of all false positives.

Answer

Automatic remediation of all threats.

Question 11

Which THREE of the following are essential for effective incident response within a SIEM?

Accepted Answer

Automated playbooks or runbooks.. Documentation, playbooks, and integration are critical for response.

Answer

Unlimited coffee supply.

Answer

A large collection of desk chairs.

Question 12

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

Accepted Answer

A known malicious IP address.. A malicious IP or file hash is a classic IoC.

Answer

The SIEM administrator's name.

Answer

The server name.

Answer

The company's office address.

Question 13

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Accepted Answer

Check the asset's 'Business Criticality' and 'Owner' in the CMDB to see if the activity is a scheduled backup.. Validating the legitimacy of the activity is critical. Checking if the user is authorized for cloud backups or if the machine is a known server/backup agent prevents false escalation.

Answer

Block the cloud storage IP address on the corporate firewall.

Answer

Immediately disable the user account in Active Directory.

Answer

Re-image the affected host immediately.

Question 14

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Accepted Answer

Process Tree. The Process Tree in CrowdStrike Falcon visualizes the genealogy of the process that triggered the detection.

Answer

Host Timeline

Answer

Detection Details

Answer

Network Activity

Question 15

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Accepted Answer

To validate and scope the threat. IOCs act as signatures or artifacts that help confirm the presence of a threat.

Answer

To communicate with law enforcement

Answer

To prevent future incidents

Answer

To manage system backups

Question 16

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

To remove the threat from the environment. To remove all traces of the threat (malware, backdoors, compromised accounts) from the environment.

Answer

To identify the root cause

Answer

To restore business operations

Answer

To report to stakeholders

Question 17

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Accepted Answer

Calculate a baseline of normal traffic volume and alert on deviations.. Baseline behavior provides a reference point, reducing false positives caused by expected high-volume traffic.

Answer

Only alert on weekend traffic.

Answer

Disable alerts for file servers.

Answer

Lower the threshold to 50MB.

Question 18

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

Accepted Answer

Correlation rule using user and location attributes.. User Entity Behavior Analytics (UEBA) and correlation rules are designed to detect impossible travel or multiple concurrent logins.

Answer

Vulnerability scanning.

Answer

Log compression.

Answer

Full packet capture.

Question 19

During alert triage, why is it important to check the 'source' of an alert?

Accepted Answer

To determine the confidence level of the detection.. Identifying if the source is a security tool or an application helps determine the reliability of the detection.

Answer

To identify the physical location of the server.

Answer

To see how much storage the source uses.

Answer

To check the manufacturer's warranty.

Question 20

Which of the following describes 'Event Correlation' in a SIEM?

Accepted Answer

Linking related events to identify security threats.. Correlation relates disparate events to identify a security threat.

Answer

Compressing logs for storage.

Answer

Generating reports for management.

Answer

Updating the SIEM software.