312-39 Practice Questions 1 — 50 Questions

Question 1

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Accepted Answer

The aggregation window is configured incorrectly.. In ArcSight correlation rules, the aggregation window defines the time period over which events are grouped and evaluated. If the window is misconfigured (too short, too long, or with incorrect reset conditions), the rule will not accumulate the required events to trigger, even if the filter logic is correct. This is the most common cause of a rule that matches events but never fires.

Answer

The parser is disabled.

Answer

The user interface is loading slowly.

Answer

The license has expired.

Question 2

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?

Accepted Answer

Security log, Event ID 4688. To retrieve the full command line of a PowerShell process, the analyst should examine Security log Event ID 4688, which records process creation and includes command-line data when the appropriate audit policy is enabled. Other events like 7045, 1000, or 4104 serve different purposes and do not reliably capture the command line. Event ID 4688 is the standard source for process command-line auditing.

Answer

Application log, Event ID 1000

Answer

System log, Event ID 7045

Answer

Windows PowerShell log, Event ID 4104

Question 3

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 4

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

Accepted Answer

Detection and Analysis. Detection and Analysis is the correct phase because it encompasses the activities of identifying that an incident has occurred, determining its type (e.g., malware, phishing, DDoS), and assessing its scope (affected systems, data, users). This phase follows Preparation and precedes Containment, Eradication, and Recovery in the NIST SP 800-61 lifecycle.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 5

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved change window. The analyst needs to determine who made the modification and from which IP address. Which AWS service should the analyst query to retrieve this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the authoritative source for API activity in an AWS account. It logs every API call, including IAM policy attachments, and captures the caller's identity, source IP, and timestamp. By querying CloudTrail event history for the AttachRolePolicy action on the Lambda execution role, the analyst can pinpoint the unauthorized change and its origin, enabling incident response.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 6

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

Accepted Answer

Source IP, destination host, and the involved user account.. During initial triage of a high-severity alert, the most critical information to gather is the source IP, destination host, and involved user account. These three data points establish the who, what, and where of the event, enabling the analyst to quickly assess scope, determine if the activity is malicious, and decide on containment steps. Without them, the alert remains abstract and cannot be correlated with other logs or threat intelligence. This aligns with the EC-Council 312-39 (Certified SOC Analyst) focus on practical incident handling and the 5W1H approach to alert triage.

Answer

The time taken to generate the alert.

Answer

The hardware vendor of the firewall.

Answer

The SIEM software version.

Question 7

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?

Accepted Answer

Logon Type 2. Interactive brute-force attacks against workstations generate Windows Security Event ID 4625 with Logon Type 2, which indicates a user attempted to log on at the physical console. Other logon types correspond to different access methods: Type 3 for network, Type 4 for batch, Type 5 for service, and Type 10 for RDP. Focusing on Type 2 allows the analyst to isolate local interactive password-guessing attempts.

Answer

Logon Type 5

Answer

Logon Type 4

Answer

Logon Type 10

Question 8

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Accepted Answer

Windows Event Log - PowerShell Script Block Logging (Event ID 4104). PowerShell Script Block Logging (Event ID 4104) records the actual script block text that PowerShell executes, including de-obfuscated commands after certain decoding steps, making it the richest source for seeing what an attacker ran. This is especially valuable for fileless attacks where nothing touches disk. Event ID 4688 only shows that powershell.exe launched, not the commands inside it.

Answer

Disk forensic analysis of the user's browser history

Answer

Windows Security Log - Process Creation (Event ID 4688)

Answer

Network firewall traffic logs for port 5985

Question 9

Which THREE factors should be considered when determining the severity level of an incident?

Accepted Answer

Business impact. Severity level in incident response is driven by how much harm the incident can cause and how quickly it must be addressed, so Business impact (B) is correct because it measures the effect on operations, revenue, and services, which directly determines how severe the incident is. Data sensitivity (C) is correct because incidents involving regulated, confidential, or high-value data (e.g., PII, PHI, intellectual property) warrant a higher severity due to legal, compliance, and reputational consequences. Urgency (E) is correct because it reflects how time-critical the response is — for example, an active ransomware spread or ongoing data exfiltration demands immediate action and thus elevates severity. The analyst's mood (A) is a subjective human state and has no bearing on objective incident severity, and the day of the week (D) is irrelevant to the technical and business impact of an incident, even if staffing levels may vary.

Answer

The analyst's mood

Answer

The day of the week

Question 10

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Accepted Answer

Suspicious sender address. Option A (Suspicious sender address) is correct because phishing emails frequently use spoofed, look-alike, or mismatched domains (e.g., 'micros0ft.com' or a display name that doesn't match the actual SMTP envelope sender), which is a primary technical indicator analysts examine in email headers via SPF, DKIM, and DMARC checks. Option E (Urgent/threatening tone) is correct because social-engineering lures commonly pressure recipients with deadlines, account-suspension threats, or fear of consequences to bypass careful scrutiny and trigger immediate clicks or credential entry. Option B is not a reliable indicator since legitimate and malicious emails alike are often sent during business hours to blend in. Option C is not an indicator at all, as virtually every email has a subject line. Option D is not inherently suspicious; while CEO impersonation (BEC) occurs, mail genuinely from the CEO is normal, so the sender's authenticity must be verified rather than the title alone treated as a red flag.

Answer

The email is sent during business hours

Answer

The email has a subject line

Answer

The email is from the CEO

Question 11

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

Accepted Answer

Asset Criticality.. Asset Criticality is the most important metric for prioritizing incidents by business impact because a compromise on a domain controller, database server, or executive workstation carries far greater risk than one on a test machine. SIEM triage workflows weight alerts by the criticality of the affected asset to focus analyst attention where it matters most. This aligns detection response with business risk.

Answer

Alert frequency.

Answer

Log source vendor.

Answer

Number of alerts per user.

Question 12

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should the analyst take?

Accepted Answer

Use a utility such as certutil -hashfile or sha256sum to compute the file's hash. The analyst needs a cryptographic hash without executing the sample. Built-in utilities such as certutil -hashfile on Windows or sha256sum on Linux generate MD5, SHA-1, or SHA-256 values safely and quickly, enabling comparison against threat intelligence. Sandbox execution, hex inspection, and public submissions either execute the file, fail to produce a hash, or expose the sample unnecessarily.

Answer

Submit the binary to a public multi-engine scanning service and read the detection names

Answer

Run the binary in a sandbox and record the hash from the sandbox report

Answer

Open the binary in a hex editor and visually inspect the first bytes

Question 13

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based conditions such as 'only trigger during business hours' are applied in the alert's schedule or suppression settings, where the SIEM evaluates the rule only within defined time windows or suppresses alerts outside them. This is a rule-level configuration that controls when the detection logic is active or when notifications fire. It is separate from data ingestion or user permissions.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 14

Which THREE factors contribute to 'dwell time' in a security incident?

Accepted Answer

Inadequate logging visibility. Dwell time is the interval between an attacker's initial compromise and the moment the intrusion is detected, so any factor that delays detection extends it. Option A, inadequate logging visibility, is correct because without sufficient endpoint, network, and authentication logs (e.g., missing Windows Event ID 4624, DNS query logs, or EDR telemetry) defenders cannot see the malicious activity, so the breach goes unnoticed longer. Option D, insufficient automated alerting, is correct because if SIEM correlation rules, IDS/IPS signatures, or EDR detections do not fire and notify analysts in near real time, detection depends on manual review and dwell time grows. Option E, lack of threat intelligence, is correct because without IOCs, TTPs, and context from feeds such as STIX/TAXII or MITRE ATT&CK mappings, defenders are slower to recognize known adversary behavior and to hunt for it proactively. Option B, the number of coffee machines in the SOC, is irrelevant to detection timelines and is not a security control. Option C, the speed of the network, is not a direct contributor; faster links may even aid exfiltration, but they do not by themselves delay or accelerate detection of a compromise.

Answer

The number of coffee machines in the SOC

Answer

The speed of the network

Question 15

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Accepted Answer

Snapshot the persistent disk for forensics. Option B is correct because taking a snapshot of the persistent disk preserves volatile and non-volatile evidence (disk state, logs, files) for forensic analysis before any remediation destroys it, which is a standard incident-response step for a rogue VM. Option C is correct because restricting network ingress/egress rules (e.g., via VPC firewall rules or removing the VM's external IP) contains the threat by isolating the rogue VM and preventing lateral movement or data exfiltration while investigation proceeds. Option A is wrong because upgrading the OS image is a patching action that neither contains the rogue VM nor preserves evidence. Option D is wrong because increasing CPU quota is a performance change unrelated to incident response. Option E is wrong because deleting the VM immediately destroys forensic evidence and may tip off an attacker, so containment and snapshotting must come first.

Answer

Upgrade the VM's OS image

Answer

Increase the VM's CPU quota

Answer

Delete the VM immediately

Question 16

Which document should you reference first to determine the communication path during a high-severity security incident?

Accepted Answer

Incident Response Plan. The Incident Response Plan (IRP) is the authoritative document that defines roles, responsibilities, and communication protocols during a security incident. It explicitly outlines who to contact, escalation paths, and notification timelines for high-severity events, ensuring a coordinated response. Other documents like the Employee Handbook or Network Topology Diagram do not provide incident-specific communication procedures. The Disaster Recovery Plan focuses on restoring IT infrastructure after a disruption, not on incident communication.

Answer

Employee Handbook

Answer

Network Topology Diagram

Answer

Disaster Recovery Plan

Question 17

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Option B is correct because validating a SIEM correlation rule against historical log data in a test or staging environment confirms it detects the intended activity without generating excessive false positives before it is promoted to production. Option C is correct because mapping a use case to a specific MITRE ATT&CK technique ties the detection to a known adversary behavior, giving the rule clear scope, coverage rationale, and measurable detection value. Option A is wrong because deleting all logs after 24 hours destroys the retention needed for correlation, hunting, and forensic investigation. Option D is wrong because disabling firewall logging removes critical network telemetry that many SIEM use cases depend on. Option E is wrong because SIEM use case development requires security operations, detection engineering, or threat intelligence expertise, not marketing staff.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 18

A SOC analyst is reviewing a threat intelligence report that lists a new C2 domain. The SIEM has no prior detection rule for this domain. Which action best uses the diamond model to proactively operationalize this intelligence for future detection?

Accepted Answer

Extract the domain and associated adversary, capability, and victim metadata to build a detection rule that correlates DNS queries with subsequent network connections.. The diamond model structures threat intelligence around adversary, infrastructure, capability, and victim, enabling analysts to pivot and build detection logic. Extracting and correlating these elements into a SIEM rule transforms a single IOC into a durable, context-aware detection that supports proactive hunting and reduces reliance on fragile indicators like IPs. This approach aligns with operationalizing intelligence for sustained visibility.

Answer

Submit the domain to a public blocklist and wait for other organizations to report activity.

Answer

Add the domain to a watchlist and manually review alerts daily.

Answer

Create a firewall block rule for the domain's IP address only.

Question 19

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

Accepted Answer

A private executable memory region inside a legitimate process marked PAGE_EXECUTE_READWRITE. Injected code typically appears as executable private memory with write permissions inside a host process, or as a thread whose start address is outside any mapped module. Both artifacts deviate from normal process structure and are surfaced by memory forensics plugins. Signed DLLs, handle counts, and ordinary waiting threads are normal conditions and do not by themselves demonstrate injection.

Answer

A user-mode process with a single thread that is currently in a wait state

Answer

A signed Microsoft DLL loaded at its expected base address

Answer

A process with a high handle count and many open Registry keys

Question 20

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a handful resolving to short-lived IP addresses. The analyst wants to map this behavior to the most likely stage of the Cyber Kill Chain and the corresponding IOC category. Which of the following best describes this activity?

Accepted Answer

Command and Control (C2) using Domain Generation Algorithm (DGA) domains as network-based IoCs. Algorithmically generated domains with many NXDOMAIN responses and occasional short-lived resolutions indicate a host trying to find its C2 server, which is the Command and Control phase. Because the evidence is DNS traffic, it is a network-based IoC. The other choices misattribute the phase or the IoC category.

Answer

Weaponization using malicious macros as registry-based IoCs

Answer

Exfiltration using DNS tunneling as file-based IoCs

Answer

Reconnaissance using DNS zone transfer attempts as host-based IoCs