312-39 Practice Test 3 — 10 Questions

Question 1

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

INetSim. INetSim is designed to simulate common internet services, including DNS, to study malware network behavior in an isolated environment.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 2

What is the purpose of 'Dashboards' in a SIEM?

Accepted Answer

To visualize data and monitor trends.. Dashboards visualize data to help analysts identify trends and monitor health.

Answer

To block network traffic.

Answer

To install software patches.

Answer

To store all log data.

Question 3

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

Accepted Answer

The rate of attempts compared to the attacker's potential speed.. The time window must be long enough to capture slow-and-low attacks but short enough to avoid excessive false positives.

Answer

The number of log sources in the SIEM.

Answer

The time of day the rule runs.

Answer

The disk space available in the SIEM.

Question 4

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

Accepted Answer

VirusTotal. VirusTotal aggregates results from multiple AV vendors, providing a comprehensive report on a file hash.

Answer

Google Search

Answer

Microsoft Update

Answer

WHOIS

Question 5

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Accepted Answer

Suspicious sender address. Unusual sender addresses and urgent language are classic phishing indicators.

Answer

The email is sent during business hours

Answer

The email has a subject line

Answer

The email is from the CEO

Question 6

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

Accepted Answer

Restrict the search to a specific time range and relevant indexes.. Filtering by time range and limiting fields are standard practices to optimize SIEM performance.

Answer

Use wildcard searches on all fields.

Answer

Add more fields to the search result.

Answer

Increase the search timeout.

Question 7

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Actionable intelligence must be context-rich, relevant to the infrastructure, and integrated into existing workflows.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 8

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Identifying long-duration connections and baseline deviations in data volume are the most effective ways to spot slow exfiltration.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall

Question 9

Which SIEM feature is used to group related events into a single incident?

Accepted Answer

Event correlation logic.. Correlation engines or incident management modules group events based on shared attributes.

Answer

Log rotation.

Answer

Dashboard visualization.

Answer

Data ingestion.

Question 10

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

Accepted Answer

Configure an Offense rule using the 'when the event matches any of these building blocks' condition and apply a 'count of unique Source IP is greater than or equal to 3' filter within the temporal window.. Using a Building Block (BB) allows for reusable logic. Combining a threshold condition with a 'unique count' filter on source IP addresses ensures the rule only fires when the specific cross-IP threshold is met.

Answer

Use a simple threshold rule set to trigger only on the 5th failure without defining distinct source IP criteria.

Answer

Create a rule using the 'when the event matches any of these building blocks' condition combined with an 'and when at least 5 events are seen with the same username in 1 minute' filter.

Answer

Enable the 'Flow-based Anomaly' detection setting in the system configuration to automatically detect brute-force patterns.