312-39 Practice Test 4 — 10 Questions

Question 1

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

Accepted Answer

Alert Triage and Prioritization. Triage and prioritization involve categorizing and assessing the urgency of alerts to focus on the most critical threats.

Answer

Vulnerability Assessment

Answer

Correlation Rule Development

Answer

Incident Eradication

Answer

Log Retention Analysis

Question 2

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Accepted Answer

To maintain persistent communication. The goal is to maintain communication between the compromised system and the attacker's infrastructure.

Answer

To escalate privileges

Answer

To steal data

Answer

To gain initial access

Question 3

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

Accepted Answer

Increase the threshold for the number of failed attempts within the lookback window.. Risk-based alerting and threshold tuning are standard practices to reduce noise in SIEM correlation rules.

Answer

Delete the correlation rule and recreate it.

Answer

Enable packet capture on all domain controllers.

Answer

Change the rule severity to 'Informational'.

Question 4

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. Collectors gather data from various sources and forward it to the main processing engine.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 5

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Triage involves verification, context gathering, and determining impact.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 6

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Accepted Answer

An automated process or script is likely involved.. Rapid-fire failures usually indicate a script or bot, rather than a human user.

Answer

The server is overheating.

Answer

A user is having a bad day.

Answer

The SIEM is broken.

Question 7

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Aligning to threat frameworks (like MITRE ATT&CK) and testing against historical data are the pillars of effective use case engineering.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 8

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Baseline behavioral profiling and using multiple conditions (cross-correlation) help reduce noise by ensuring that only significant deviations trigger an alert.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.

Question 9

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. Updating the 'Assigned to' or 'Assignment group' fields while using the 'Work notes' to trigger a business rule notification is the standard workflow.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'

Question 10

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Accepted Answer

Number of affected systems. Business criticality, threat intelligence context, and the number of affected hosts are fundamental metrics for determining the priority of an incident.

Answer

The color scheme of the SIEM dashboard

Answer

The time of day the alert was generated