312-39 Practice Questions 1 — 50 Questions

Question 1

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Accepted Answer

Use of removable media or virtual volumes. Shimcache (AppCompatCache) tracks file execution; if the volume is gone, it suggests a removable drive or virtual volume was used by the attacker.

Answer

Memory corruption

Answer

Log manipulation

Answer

System update failure

Question 2

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

Accepted Answer

Security Event ID 4624 (Logon Type 9). Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.

Answer

Registry key creation in RunOnce

Answer

Prefetch file modification

Answer

DNS query logs

Question 3

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Accepted Answer

Scanning for open ports and services. Reconnaissance involves gathering information to identify vulnerabilities before launching an attack.

Answer

Deploying a remote access trojan

Answer

Exploiting a software vulnerability

Answer

Encrypting data for ransom

Question 4

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

Accepted Answer

A compromised host attempting to reach a C2. Sinkholes are used by security researchers to intercept traffic from infected hosts that are trying to contact a C2 domain.

Answer

An attempted DDoS attack

Answer

A network misconfiguration

Answer

A successful data exfiltration

Question 5

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Accepted Answer

Unauthorized access attempt. This behavior is a classic indicator of a brute-force attack or credential stuffing attempt.

Answer

Data exfiltration indicator

Answer

Network anomaly signature

Answer

System resource exhaustion

Question 6

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Accepted Answer

netstat -tulnp. The 'netstat -tulnp' or 'ss -tulnp' command shows the process ID alongside the listening socket.

Answer

top

Answer

ps aux

Answer

lsmod

Question 7

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

Accepted Answer

Generating cryptographic hashes for log files. Cryptographic hashing of log files at intervals provides an verifiable proof of log integrity.

Answer

Storing logs on a local partition

Answer

Clearing the logs daily

Answer

Setting file permissions to read-only

Question 8

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

Accepted Answer

powershell.exe -enc JABz.... LotL techniques use built-in system tools like PowerShell or WMI to execute malicious actions, avoiding the need for custom malware.

Answer

malware.exe

Answer

mimikatz.exe

Answer

netcat.exe

Question 9

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Accepted Answer

Windows Scheduled Tasks. Persistence often relies on modifying startup folders, registry keys, or scheduled tasks.

Answer

Network interface throughput

Answer

Browser history logs

Question 10

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Accepted Answer

Isolate the host from the network. Identifying a process running from a suspicious location like Temp is a high-confidence IoC for malware.

Answer

Delete the file

Answer

Update antivirus signatures

Answer

Restart the server

Question 11

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Accepted Answer

Increased DNS request volume (DNS Tunneling). Exfiltration is characterized by large, anomalous outbound transfers and the use of unusual protocols.

Answer

Multiple failed login attempts

Answer

System clock synchronization errors

Answer

Installation of new system drivers

Question 12

Which component of a SIEM is responsible for identifying patterns in real-time?

Accepted Answer

Correlation engine.. The correlation engine evaluates incoming events against defined logic to trigger alerts.

Answer

Log parser.

Answer

Reporting module.

Answer

Storage engine.

Question 13

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Accepted Answer

Frequency analysis on connection flow metadata. Beaconing with jitter is a hallmark of C2 communication designed to evade simple threshold-based detection.

Answer

Port-based blocking

Answer

Signature-based IDS alert

Answer

Static IP blocklisting

Question 14

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based scheduling is a core feature for managing alert relevance in SIEMs.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 15

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Accepted Answer

Incident Review dashboard. The Incident Review dashboard allows analysts to view the MITRE ATT&CK tactics and techniques associated with notable events.

Answer

Threat Intelligence dashboard

Answer

Access Anomalies dashboard

Answer

User Activity Monitoring

Question 16

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Accepted Answer

4104. Event ID 4104 is generated when a script block is executed, providing insight into obfuscated PowerShell commands.

Answer

1102

Answer

4688

Answer

4624

Question 17

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

Accepted Answer

OleDump. OleDump is a specialized tool used to analyze OLE files (like Office docs) to extract VBA macros and embedded objects.

Answer

Burp Suite

Answer

Wireshark

Answer

Autopsy

Question 18

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Accepted Answer

The aggregation window is configured incorrectly.. Event aggregation settings can prevent rules from firing if the conditions are too restrictive.

Answer

The parser is disabled.

Answer

The user interface is loading slowly.

Answer

The license has expired.

Question 19

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

Accepted Answer

Create an exclusion rule for the specific scanner IP address and vulnerability signatures within the SIEM policy.. Creating a suppression rule or an exclusion filter based on the scanner's IP address and specific signature IDs allows you to silence known noise while keeping the events in the logs for audit purposes.

Answer

Permanently disable the ingestion of logs from the vulnerability scanner.

Answer

Change the log source protocol from Syslog to SNMP.

Answer

Increase the threshold for the correlation rule to a point where the scanner no longer triggers it.

Question 20

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

Accepted Answer

Remove the malicious file and rotate credentials. After identifying the web shell, removing the file and resetting the web application credentials is the critical next step.

Answer

Flush DNS

Answer

Restart the web service

Answer

Update the OS