312-39 Practice Test 5 — 10 Questions

Question 1

A SOC analyst is reviewing a SIEM alert that fired on a suspicious PowerShell execution. The command line includes an encoded parameter and a download cradle. The analyst confirms the endpoint is a developer workstation used for legitimate automation. Which action best balances security and business continuity while still validating the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Decode the PowerShell command, review the parent process, and check the endpoint for related network connections. Decoding the encoded PowerShell command and reviewing parent process and network connections provides concrete evidence to determine whether the activity is legitimate automation or malicious. This validation step preserves business continuity for the developer while enabling confident escalation if needed. Premature containment or blanket policy changes can disrupt operations and destroy evidence.

Answer

Close the alert as benign because the workstation belongs to a developer

Answer

Immediately disable the user's Active Directory account and isolate the workstation

Answer

Block all PowerShell execution on the workstation via Group Policy

Question 2

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities through the integrated Defender for Endpoint agent, which captures process-level telemetry including command lines, parent-child process relationships, and file hashes. This is exactly what is needed to identify cryptomining binaries like XMRig and their execution chain on a compromised VM. Defender for Servers surfaces these events in the Microsoft 365 Defender portal for investigation.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 3

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

Accepted Answer

Implement multi-stage correlation rules that require high-confidence indicators to fire. Multi-stage correlation rules require multiple high-confidence indicators to align before generating an alert, which directly reduces false positives and improves the Signal-to-Noise ratio. By chaining events (e.g., a suspicious login followed by unusual data access), the SIEM fires only on genuinely suspicious behavior rather than on isolated low-fidelity events. This is the standard SOC practice for tuning detection content to combat alert fatigue.

Answer

Increase the retention period for all raw log data

Answer

Lower the threshold for all IDS alerts to catch more threats

Answer

Outsource all monitoring to a managed security provider

Question 4

A SOC analyst is investigating a suspected compromise of an AWS Lambda function. The analyst needs to determine what code was executed and which IAM role the function assumed during the suspicious activity. Which AWS service should the analyst use to review the function's configuration and execution role?

Accepted Answer

AWS Lambda console or GetFunction API. The Lambda console and GetFunction API are correct because they expose the function's configuration, including the execution role and the code package. An analyst can retrieve the role ARN and download the code to review what was executed. CloudTrail, CloudWatch Logs, and X-Ray provide runtime or API-level data but not the function's configured role or code.

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 5

You are a SOC analyst at a company that uses Microsoft 365. You receive an alert that a user's mailbox is being accessed from an unusual location. You need to review the mailbox audit logs to determine which operations were performed and by whom. Which Microsoft 365 tool should you use to search these logs?

Accepted Answer

Microsoft 365 compliance center audit log search. The Microsoft 365 compliance center audit log search queries the unified audit log, which captures mailbox operations such as MailItemsAccessed, SendAs, and SendOnBehalf. This is the authoritative source for investigating suspicious mailbox access and determining which operations were performed and by whom. Other tools like Defender for Cloud Apps or Microsoft Entra ID sign-in logs provide complementary data but lack the granular mailbox audit events needed here.

Answer

Azure Active Directory sign-in logs

Answer

Exchange admin center mail flow rules

Answer

Microsoft Defender for Cloud Apps activity log

Question 6

A SOC analyst is investigating a suspected compromised Windows 10 workstation. The analyst wants to determine which removable USB storage devices were connected to the host and correlate that activity with a suspicious data exfiltration alert. Which artifact or registry location should the analyst examine FIRST to enumerate historically connected USB mass storage devices?

Accepted Answer

The SYSTEM hive, under ControlSet00X\Enum\USBSTOR. USBSTOR under the SYSTEM hive is the canonical persistent record of USB mass storage devices attached to a Windows system, storing device instance IDs with vendor, product, and revision strings. It survives device removal and reboots, allowing retrospective enumeration. MountPoints2 supplements this per-user, while Policy\Secrets and SAM hold credential and account data unrelated to device history.

Answer

The NTUSER.DAT hive, under Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

The SECURITY hive, under Policy\Secrets

Answer

The SAM hive, under SAM\Domains\Account\Users

Question 7

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Accepted Answer

Use of removable media or virtual volumes. Shimcache (AppCompatCache) records metadata about executables that were present on the system, including the volume path from which they executed. An entry referencing a volume that no longer exists (e.g., a drive letter or GUID not currently mounted) strongly suggests the executable ran from removable media (USB drive) or a virtual/mounted volume that has since been detached. This is a classic indicator of tool execution from external media.

Answer

Memory corruption

Answer

Log manipulation

Answer

System update failure

Question 8

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

Answer

Cloud Trace

Answer

Deployment Manager

Answer

Cloud Billing

Question 9

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

Accepted Answer

Create a custom DSM and map the event IDs to existing QIDs.. When events are parsed but not mapped to a QID, QRadar cannot normalize them for correlation and offense generation. The correct next step is to create a custom DSM (Device Support Module) or modify the existing one to map the event IDs to appropriate QIDs. This ensures the events are properly categorized and can contribute to offenses.

Answer

Increase the storage allocation for the log source.

Answer

Upgrade the firmware on the log source.

Answer

Restart the Event Processor service.

Question 10

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Immediately after imaging the original media, the examiner must compute a cryptographic hash (e.g., SHA-256 or MD5) of both the original and the forensic copy and compare them. Matching hashes prove the copy is a bit-for-bit duplicate and that the original was not altered during acquisition, establishing the chain of custody and evidentiary integrity. This is the foundational step for admissibility in legal proceedings.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file