312-39 Practice Questions 2 — 50 Questions

Question 1

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Calculating the time delta between connections is the standard method for identifying the consistent heartbeat of C2 beacons.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 2

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

Accepted Answer

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/. The use of macros like $HOST or $YEAR allows for dynamic directory creation based on incoming log metadata.

Answer

Defining separate log paths for every individual IP address

Answer

Configuring the global log_level to debug

Answer

Using hardcoded static path strings only

Question 3

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. The mapping of threat attributes to incident severity and category is critical for automated workflow triggering.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 4

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Accepted Answer

Perform frequency analysis (stack counting) on the command-line arguments across the environment. Stack counting (frequency analysis) is a standard hunting method to isolate outliers in command-line execution patterns.

Answer

Enable verbose logging on all domain controllers

Answer

Run a full antivirus scan on the affected workstation

Answer

Reimage the host immediately to prevent lateral movement

Question 5

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Accepted Answer

certutil.exe. Certutil.exe is frequently misused to download files or decode malicious payloads, making its use by standard users a red flag.

Answer

mspaint.exe

Answer

calc.exe

Answer

notepad.exe

Question 6

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. Mean Time to Acknowledge (MTTA) specifically measures the time from alert generation to human intervention.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time

Question 7

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Accepted Answer

Standardized handover and documentation. Standardization of playbooks and handoff procedures ensures continuity across different time zones.

Answer

Purchasing a new SIEM license

Answer

Moving all logs to the cloud

Answer

Increasing the number of Tier 3 analysts

Question 8

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Accepted Answer

Updating correlation rules based on new IOCs. Integrating external threat feeds to update correlation rules is a core function of threat intelligence within operations.

Answer

Hardening server images

Answer

Managing SOC budget

Answer

Writing compliance reports

Question 9

Which TWO factors are most critical when calculating the ROI of a SOC?

Accepted Answer

Cost of potential data breach incidents. ROI in a SOC is calculated by comparing the reduction in risk (potential cost of breach) and the operational costs (tools/personnel).

Answer

Number of social media followers

Answer

Office space square footage

Answer

Number of coffee machines in the SOC

Question 10

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Cloud (specifically the Endpoint protection or integrated EDR) provides process-level visibility and alerts for suspicious activity on VMs.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph

Question 11

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

Accepted Answer

Cloud Logging. VPC Flow Logs in GCP are integrated directly into Cloud Logging to track network connections.

Answer

VPC Service Controls

Answer

Google Cloud Armor

Answer

Security Command Center

Question 12

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Accepted Answer

Modification of CloudTrail or logging configurations. Unauthorized changes to IAM policies, disabling of logging services, and unexpected creation of resources in unfamiliar regions are top indicators of compromise.

Answer

Increased usage of free-tier services

Answer

Standard scheduled system reboots

Question 13

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates findings from various AWS security services like GuardDuty, Inspector, and Config into a single view.

Answer

AWS Artifact

Answer

AWS Shield

Answer

AWS Trusted Advisor

Question 14

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Accepted Answer

Cloud Storage Data Access logs. Cloud Storage Data Access logs (found in Cloud Logging) contain granular details about which objects (files) were read or modified.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring metrics

Answer

Cloud Load Balancing logs

Question 15

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Accepted Answer

Enable global service events. Enabling global service events and log file integrity ensure that all actions are captured and that logs remain tamper-proof.

Answer

Disable SNS notifications

Answer

Limit logs to one region

Answer

Encrypt logs with a public key

Question 16

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

Accepted Answer

Newly created service name. Host-based IoCs are artifacts found on the endpoint itself, such as files, registry changes, or running processes.

Answer

SMTP server response codes

Answer

Malicious URL visited

Answer

Source IP address of an attack

Question 17

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Recording the exact time of collection and the identity of the person collecting it are fundamental requirements for chain of custody.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 18

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Accepted Answer

The polling interval for the API is set too high.. API polling intervals are the most common source of latency in cloud log ingestion.

Answer

The SIEM storage is full.

Answer

The cloud provider is down.

Answer

The SIEM license limit is reached.

Question 19

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Accepted Answer

Obtaining instructions from the threat actor. C2 allows the attacker to maintain access and send instructions to the compromised host.

Answer

Exploiting a zero-day vulnerability

Answer

Gathering system information

Answer

Encrypting files for ransom

Question 20

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Accepted Answer

Active network connections. Volatile data is lost when power is removed, making it the highest priority for collection.

Answer

Browser history files

Answer

Registry hive files on disk

Answer

Hard drive partition table