312-39 Practice Test 2 — 30 Questions

Question 1

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Offense rule using the 'when the event matches any of these building blocks' condition and apply a 'count of unique Source IP is greater than or equal to 3' filter within the temporal window.. Using a Building Block (BB) allows for reusable logic. Combining a threshold condition with a 'unique count' filter on source IP addresses ensures the rule only fires when the specific cross-IP threshold is met.

Answer

Use a simple threshold rule set to trigger only on the 5th failure without defining distinct source IP criteria.

Answer

Create a rule using the 'when the event matches any of these building blocks' condition combined with an 'and when at least 5 events are seen with the same username in 1 minute' filter.

Answer

Enable the 'Flow-based Anomaly' detection setting in the system configuration to automatically detect brute-force patterns.

Question 2

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

Accepted Answer

Alert Triage and Prioritization. Triage and prioritization involve categorizing and assessing the urgency of alerts to focus on the most critical threats.

Answer

Vulnerability Assessment

Answer

Correlation Rule Development

Answer

Incident Eradication

Answer

Log Retention Analysis

Question 3

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Accepted Answer

To maintain persistent communication. The goal is to maintain communication between the compromised system and the attacker's infrastructure.

Answer

To escalate privileges

Answer

To steal data

Answer

To gain initial access

Question 4

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

Accepted Answer

Increase the threshold for the number of failed attempts within the lookback window.. Risk-based alerting and threshold tuning are standard practices to reduce noise in SIEM correlation rules.

Answer

Delete the correlation rule and recreate it.

Answer

Enable packet capture on all domain controllers.

Answer

Change the rule severity to 'Informational'.

Question 5

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. Collectors gather data from various sources and forward it to the main processing engine.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 6

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Triage involves verification, context gathering, and determining impact.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 7

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Accepted Answer

An automated process or script is likely involved.. Rapid-fire failures usually indicate a script or bot, rather than a human user.

Answer

The server is overheating.

Answer

A user is having a bad day.

Answer

The SIEM is broken.

Question 8

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Aligning to threat frameworks (like MITRE ATT&CK) and testing against historical data are the pillars of effective use case engineering.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 9

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Baseline behavioral profiling and using multiple conditions (cross-correlation) help reduce noise by ensuring that only significant deviations trigger an alert.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.

Question 10

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. Updating the 'Assigned to' or 'Assignment group' fields while using the 'Work notes' to trigger a business rule notification is the standard workflow.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'

Question 11

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Accepted Answer

Number of affected systems. Business criticality, threat intelligence context, and the number of affected hosts are fundamental metrics for determining the priority of an incident.

Answer

The color scheme of the SIEM dashboard

Answer

The time of day the alert was generated

Question 12

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

Accepted Answer

ip.src == 192.168.1.50. The 'ip.src' filter isolates traffic originating from the specified source IP.

Answer

ip.addr == 192.168.1.50

Answer

src.ip == 192.168.1.50

Answer

filter: 192.168.1.50

Question 13

You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?

Accepted Answer

PowerShell Script Block Logging. Script Block Logging (Event ID 4104) is required to capture the full content of executed PowerShell scripts.

Answer

AppLocker

Answer

Credential Guard

Answer

Audit Process Creation

Question 14

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

Accepted Answer

Modify Security Group to deny all traffic. Modifying the Security Group associated with the instance is the standard practice to isolate it while maintaining the state for forensics.

Answer

Remove the IAM Role

Answer

Disable the VPC

Answer

Terminate the instance

Question 15

Which document is essential for recording every action taken during an incident for legal and audit purposes?

Accepted Answer

Incident Response Log/Journal. An Incident Log (or Journal) is mandatory for maintaining a chronological record of all response actions.

Answer

Change Management Request

Answer

System Configuration Document

Answer

Business Continuity Plan

Question 16

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

Accepted Answer

Comparing source IP against threat intel feeds of VPN exit nodes. Reviewing connection logs for anomalous login times and comparing them against known VPN exit node lists is the primary technique.

Answer

Analyzing DNS queries

Answer

Checking OS version

Answer

Scanning the source IP

Question 17

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

Accepted Answer

wecutil es. wecutil es (enum-subscriptions) is the standard utility for managing and checking WEF subscriptions.

Answer

wmic eventlog

Answer

winrm get config

Answer

gpresult /r

Question 18

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

Accepted Answer

Use a sandboxed/isolated browser environment. A secure sandbox or isolated browser provides a safe environment to observe the link's behavior.

Answer

Open the link in your local browser

Answer

Download the link contents to your desktop

Answer

Forward the email to your personal account

Question 19

Which THREE factors contribute to 'dwell time' in a security incident?

Accepted Answer

Inadequate logging visibility. Dwell time is the duration between the start of an intrusion and its detection.

Answer

The number of coffee machines in the SOC

Answer

The speed of the network

Question 20

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Accepted Answer

Keep logs for one year, with 3 months immediately available. PCI-DSS requires at least one year of retention, with at least three months of logs immediately available for analysis.

Answer

Archive all logs in a local text file format only

Answer

Retain logs for exactly 30 days

Answer

Delete logs after they are indexed in the SIEM