312-39 Practice Test 4 — 10 Questions

Question 1

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the sample in a debugger with breakpoints on LoadLibrary and GetProcAddress, then inspect the string arguments passed to those functions. Dynamic resolution through LoadLibrary and GetProcAddress is the standard mechanism behind sparse import tables, so instrumenting those two functions in a debugger recovers the module and procedure names as they are requested. Hash lookups, section size comparisons, and string extraction are triage techniques that do not expose the runtime resolution sequence.

Answer

Parse the PE section table and compare the raw size against the virtual size of each section

Answer

Extract printable ASCII and Unicode strings from the binary and filter for known Windows API names

Answer

Compute the file's MD5 and SHA-256 hashes and submit them to a public multi-engine scanning service

Question 2

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. For automated ingestion of STIX/TAXII indicators to drive incident response, the mandatory configuration is mapping STIX observable types (e.g., ipv4-addr, domain-name, file hashes) to the SIEM's local incident categories and severity levels. Without this mapping, indicators arrive but cannot be triaged, prioritized, or routed into the IR workflow.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 3

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Accepted Answer

MSSP. An MSSP (Managed Security Service Provider) is a third-party provider that delivers outsourced security monitoring and management services — such as 24/7 SOC operations, SIEM monitoring, and incident response — while the client organization retains ownership and control of its security posture and policies. This matches the scenario of outsourcing monitoring while retaining internal control.

Answer

Virtual SOC

Answer

Internal SOC

Answer

Hybrid Cloud SOC

Question 4

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

Accepted Answer

Isolate the workstation from the network using EDR. The immediate priority is to stop the malware from communicating and spreading. Isolating the endpoint via EDR achieves this by cutting off all network traffic from that host while preserving its state for investigation. This is a standard containment procedure that balances security with forensic integrity.

Answer

Run a full antivirus scan on the workstation

Answer

Block the C2 IP address at the perimeter firewall

Answer

Shut down the workstation immediately

Question 5

You are the SOC manager at a financial institution. During a monthly review, you notice that the mean time to detect (MTTD) security incidents has increased from 15 minutes to 3 hours over the past quarter. After investigation, you find that analysts are manually correlating alerts from the SIEM with threat intelligence feeds, which is time-consuming. Which action should you take FIRST to reduce MTTD?

Accepted Answer

Implement automated threat intelligence enrichment in the SIEM to correlate alerts with external feeds.. The increased MTTD is caused by manual correlation of SIEM alerts with threat intelligence feeds. Automating threat intelligence enrichment in the SIEM streamlines this process, providing analysts with enriched alerts that include external context. This reduces manual steps, accelerates triage, and directly lowers MTTD. Other options either add resources without fixing the process, reduce coverage, or suppress alerts, which are not sustainable solutions.

Answer

Reduce the number of threat intelligence feeds to only the most critical ones to simplify correlation.

Answer

Configure the SIEM to generate fewer alerts by raising the severity threshold for threat intelligence matches.

Answer

Increase the number of analysts on each shift to handle the manual correlation workload.

Question 6

A SOC analyst receives an alert about a possible data exfiltration attempt from a database server. The analyst needs to determine if large amounts of data were transferred outbound. Which network monitoring approach would best provide this information?

Accepted Answer

Review NetFlow records for outbound traffic volume from the database server.. NetFlow records capture flow-level metadata, including byte and packet counts, which can reveal unusually large outbound transfers indicative of data exfiltration. Unlike DNS logs, event logs, or antivirus logs, NetFlow directly measures the volume of data moving across the network. This makes it the most appropriate tool for determining if significant amounts of data were sent from the database server to an external destination.

Answer

Inspect DNS query logs for anomalous domain names.

Answer

Analyze Windows Security event logs for account logon events.

Answer

Check the server's antivirus logs for malware detections.

Question 7

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

Accepted Answer

The file has a high entropy value, especially in the code sections.. High entropy in code sections is a strong indicator of packing because packers compress or encrypt the original executable, resulting in randomized data. Tools like PEiD or Detect It Easy can identify known packers, but entropy analysis is a fundamental first step. In contrast, other options like digital signatures or import counts do not directly correlate with packing and may even suggest the opposite.

Answer

The file size is less than 100 KB.

Answer

The file has a large number of imported functions from kernel32.dll.

Answer

The file contains a digital signature from a known vendor.

Question 8

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring alerts, performing initial triage, and filtering out false positives. They validate whether an alert is a genuine security incident and escalate only confirmed incidents to Tier 2. This tier requires foundational skills and follows documented procedures to ensure basic incident filtering.

Answer

Tier 3

Answer

SOC Manager

Answer

Tier 2

Question 9

A SOC analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unfamiliar IP address over HTTPS. The analyst wants to determine if the traffic is malicious command and control (C2) or legitimate business traffic. Which technique should the analyst use to inspect the encrypted payload without terminating the session?

Accepted Answer

Analyze the JA3/JA3S fingerprints of the TLS handshake. JA3/JA3S fingerprinting is a passive technique that creates a fingerprint of the TLS handshake by hashing specific fields in the ClientHello and ServerHello. This allows identification of the client and server applications without decryption. In the scenario, comparing the JA3 hash to known malware families or legitimate applications can quickly indicate whether the traffic is likely C2. It does not disrupt the session and can be performed on network metadata, making it ideal for incident response.

Answer

Use NetFlow records to analyze packet sizes and timings

Answer

Perform SSL/TLS interception using a proxy with a trusted certificate

Answer

Deploy a honeypot to capture similar traffic

Question 10

A SOC team uses AWS Security Hub to centralize findings from GuardDuty, Inspector, and Macie. The team wants to automatically route only high-severity findings to an incident response ticketing system while suppressing informational findings. Which AWS Security Hub capability should the team configure to accomplish this?

Accepted Answer

Security Hub automation rules. Security Hub automation rules apply criteria to incoming findings and can automatically update, suppress, or route them. Matching severity labels HIGH and CRITICAL while suppressing INFORMATIONAL findings lets the team forward only actionable high-severity findings to the ticketing system without manual triage.

Answer

Security Hub Insights

Answer

Security Hub custom actions

Answer

Security Hub finding aggregation