312-39 Practice Test 3 — 10 Questions

Question 1

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endpoint. Which TWO of the following are host-based IoCs that should be prioritized for collection and analysis? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unusual registry Run key entries that launch a binary from a user's AppData folder. Host-based IoCs include artifacts found on the endpoint, such as registry modifications, suspicious files, and process behaviors. Registry Run keys launching binaries from AppData and double-extension files in user folders are both host-based and commonly associated with malware persistence and execution. The other options describe network-based observations.

Answer

A sudden increase in outbound DNS queries to a newly registered domain

Answer

A spike in SMTP traffic from an internal mail server to an external IP

Answer

Anomalous TLS certificate presented by an external server during a connection

Question 2

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

Accepted Answer

Event ID 4769 with encryption type 0x17 (RC4) for service accounts that normally use AES.. Kerberoasting detection relies on identifying anomalous TGS requests. A user requesting multiple service tickets for different SPNs in a short window indicates enumeration, while RC4 encryption requests for accounts that normally use AES signal an attempt to obtain easily crackable tickets. Together, these behaviors provide high-fidelity detection with fewer false positives than generic logon or group-change events.

Answer

A service account being added to the Domain Admins group.

Answer

Event ID 4771 for Kerberos pre-authentication failures from a single source.

Answer

Event ID 4624 logon type 3 (network) from a workstation to a domain controller.

Question 3

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Accepted Answer

Regulatory compliance requirements (e.g., GDPR, HIPAA). Option A is correct because regulatory frameworks such as GDPR, HIPAA, PCI DSS, and SOX impose explicit minimum retention periods for audit and security logs, so the SOC must retain logs at least as long as the strictest applicable mandate requires. Option B is correct because log retention is bounded by available storage capacity; the volume of logs generated per day, combined with the retention window, determines the storage and archiving infrastructure needed, and insufficient capacity forces trade-offs such as shorter retention or tiered storage. Option C is correct because the average time to detect an incident (dwell time) defines how far back investigators must be able to look to reconstruct an intrusion; if logs are purged before the typical detection window, the SOC loses the evidence needed for detection, triage, and root-cause analysis. Option D is not relevant because the physical color of hardware chassis has no bearing on log retention policy or security requirements. Option E is not relevant because the scheduled time of day for backups affects backup operations, not the duration for which logs must be retained.

Answer

The color of the hardware chassis

Answer

The time of day the backup is scheduled

Question 4

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (A) are a classic persistence mechanism because an attacker can create a task that re-executes malware at logon, on a schedule, or at system startup, so analysts routinely enumerate them (e.g., schtasks /query or the Task Scheduler library) for suspicious entries. Registry 'Run' keys (C), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, are checked because they cause programs to launch automatically at user logon or system boot, making them a favorite autostart location for implants. Startup folders (D), both the per-user and all-users Startup directories, are also examined since any shortcut or executable placed there executes automatically when the user logs in. System memory dumps (B) are useful for live forensics such as extracting credentials or injected code, but they are not a standard persistence artifact, and Event log files (E) are examined for evidence of activity or tampering rather than being a persistence location themselves.

Answer

System memory dumps

Answer

Event log files

Question 5

A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)

Accepted Answer

Search the email gateway logs for the sender address and subject line.. To scope a phishing incident, the analyst should search email gateway logs for the sender and subject to find all recipients, and check proxy logs for connections to the malicious URL to identify users who clicked. These actions provide a comprehensive view of who was targeted and who interacted with the phishing page. Other actions like antivirus scans or password resets are remediation steps for specific users, not scoping.

Answer

Run an antivirus scan on the reporting user's workstation.

Answer

Interview the reporting user to ask who else might have received the email.

Answer

Reset the password for the reporting user's account.

Question 6

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

Accepted Answer

Immediately isolate the endpoint from the network and escalate to the incident response team as a potential ransomware precursor.. Shadow copy deletion executed through a suspicious parent-child process chain is a well-known ransomware precursor technique. The correct response prioritizes containment by isolating the endpoint and escalating, because the attacker is likely still active. Verifying legitimacy or waiting for scans allows the adversary to proceed with encryption or lateral movement.

Answer

Close the alert as a false positive because vssadmin is a legitimate Windows administrative utility.

Answer

Run a full antivirus scan on the endpoint and wait for the results before taking any other action.

Answer

Contact the end user by phone to ask whether they intentionally ran the command before escalating.

Question 7

A SOC analyst is reviewing DNS logs and sees a host repeatedly querying subdomains like 'a1b2c3d4e5.evil-domain.com' every 60 seconds, with each subdomain being a random 10-character string. The responses are consistently NXDOMAIN. Which attack technique is most likely indicated?

Accepted Answer

Domain Generation Algorithm (DGA) used by malware for C2. The combination of random subdomains under a single parent domain, periodic queries, and NXDOMAIN responses strongly indicates a Domain Generation Algorithm used by malware to locate C2 servers. DGA malware generates many domains and queries them until one resolves, producing exactly this log signature. Other DNS-based attacks like tunneling or fast flux would show different patterns such as data in queries or changing IPs.

Answer

Fast flux DNS used to hide a botnet's C2 infrastructure

Answer

DNS cache poisoning attack against the local resolver

Answer

DNS tunneling for data exfiltration

Question 8

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

Accepted Answer

Sysmon Event ID 3 (Network connection). Sysmon Event ID 3 is specifically designed to log network connections along with the initiating process information. This makes it the most suitable log source for correlating outbound connections with processes during a data exfiltration investigation. Other logs either lack network connection details or do not associate connections with processes.

Answer

Windows Security event log

Answer

Windows Application event log

Answer

Windows PowerShell operational log

Question 9

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

Accepted Answer

Use log deduplication and correlation rules in the SIEM to group repeated SSH failures from the same source into a single alert with a count.. Deduplication and correlation in the SIEM reduce alert volume by grouping repeated events while retaining the original logs for forensic analysis. This approach maintains visibility into attack patterns such as brute-force attempts without overwhelming the ingestion pipeline. It balances operational efficiency with the need for detailed security context, unlike dropping or limiting logs.

Answer

Configure a filter in the SIEM to drop all SSH failure logs from the authentication server.

Answer

Implement log aggregation with rate limiting on the syslog server to cap the number of SSH failure messages per second.

Answer

Disable SSH logging on the authentication server and rely solely on network flow data for anomaly detection.

Question 10

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?

Accepted Answer

Command and Control. Consistent interval beaconing to an uncommon external address, uniform packet sizes, and TLS traits that do not match a normal browser collectively identify the command-and-control phase, where an implanted agent maintains contact with attacker infrastructure. Weaponization and exploitation precede this and occur without such regular outbound patterns, while actions on objectives would manifest as observable impact rather than heartbeat traffic.

Answer

Exploitation

Answer

Weaponization

Answer

Actions on Objectives