312-39 Practice Questions 2 — 50 Questions

Question 1

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Accepted Answer

To validate and scope the threat. The primary function of an IoC is to validate that a compromise has occurred and to scope its extent — confirming the threat is real and determining which systems, accounts, or network segments are affected. IoCs act as matchable artifacts that turn a suspicion into a confirmed, bounded incident, enabling targeted containment.

Answer

To communicate with law enforcement

Answer

To prevent future incidents

Answer

To manage system backups

Question 2

Which of the following describes 'Event Correlation' in a SIEM?

Accepted Answer

Linking related events to identify security threats.. Event correlation in a SIEM is the process of analysing multiple log events from disparate sources and linking them together based on shared attributes (same user, same IP, same timeframe) to detect patterns that individually appear benign but collectively indicate a threat. It is the analytical engine behind use cases like detecting brute-force followed by successful login. It is not a storage, reporting, or maintenance function.

Answer

Compressing logs for storage.

Answer

Generating reports for management.

Answer

Updating the SIEM software.

Question 3

Which THREE of the following are common challenges in SIEM correlation rule development?

Accepted Answer

High rates of false positives.. Option A (High rates of false positives) is correct because correlation rules that are too broad or poorly tuned generate large volumes of benign alerts, overwhelming analysts and causing alert fatigue, which is a well-known SIEM tuning challenge. Option D (Poor log data quality) is correct because correlation depends on normalized, time-synchronized, and complete log sources; missing fields, inconsistent formats, or absent logs from key devices break rule logic and produce unreliable detections. Option E (Difficulty in finding skilled SIEM engineers) is correct because effective rule development requires expertise in query languages, log source parsing, threat detection logic, and tuning, and organizations frequently struggle to hire and retain personnel with these specialized skills. Options B (The SIEM is too colorful) and C (The SIEM is too small to fit in a rack) are not legitimate challenges in correlation rule development, as they describe superficial or physical characteristics rather than technical or operational issues affecting rule creation and accuracy.

Answer

The SIEM is too colorful.

Answer

The SIEM is too small to fit in a rack.

Question 4

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Accepted Answer

/etc/logrotate.conf. The logrotate utility reads its global configuration from /etc/logrotate.conf, which defines default retention (rotate count), compression, frequency, and permissions, and also includes per-application drop-in files from /etc/logrotate.d/. This is the canonical file administrators edit to control retention and compression behavior system-wide.

Answer

/var/log/messages

Answer

/etc/rsyslog.conf

Answer

/etc/sysctl.conf

Question 5

During triage of a suspected intrusion, a SOC analyst observes that a user account belonging to the finance department successfully authenticated from an IP address geolocated in a country where the company has no operations, at 03:00 local time. The account had no prior logins from that region. Which phase of the attack lifecycle does this most directly represent?

Accepted Answer

Initial Access via valid accounts. An out-of-geography, off-hours successful login to a legitimate account is a valid-accounts Initial Access event. The attacker has entered the environment using stolen credentials. The other phases require additional evidence such as privilege changes, internal pivoting, or data transfers that are not present in the described log.

Answer

Exfiltration over a command and control channel

Answer

Lateral Movement via remote services

Answer

Privilege Escalation via exploitation for privilege escalation

Question 6

Which TWO metrics are essential for measuring the efficiency of an incident response team?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) (B) is essential because it directly quantifies how quickly the incident response team detects, acknowledges, and begins mitigating incidents, making it a core efficiency indicator of response speed and effectiveness. Incident volume per analyst (E) is also essential because it measures team throughput and workload distribution, showing how many incidents each analyst handles and helping assess capacity, staffing, and productivity. The other options do not belong: emails sent to stakeholders (A) is a communication activity, not an efficiency metric; average analyst salary (C) is a cost/HR figure unrelated to response performance; and building security badge access logs (D) are physical security data, not incident response efficiency measurements.

Answer

Number of emails sent to stakeholders

Answer

Average salary of analysts

Answer

Building security badge access logs

Question 7

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

Accepted Answer

Memory dump, then disk image. The correct order is memory dump first, then disk image, because memory is the most volatile evidence and is lost on shutdown or reboot. Capturing RAM before touching the disk preserves running processes, network connections, encryption keys, and malware that only exists in memory. Disk imaging afterward captures the persistent state without destroying the volatile evidence.

Answer

Reboot, then memory dump

Answer

Disk image, then memory dump

Answer

Suspend, then disk image

Question 8

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Accepted Answer

To reuse common logic in multiple rules.. In IBM QRadar, a Building Block is a reusable rule component that encapsulates common logic — such as a set of log sources, a filter condition, or a threshold — so it can be referenced by multiple correlation rules. This promotes consistency and reduces duplication. When the building block is updated, every rule that references it inherits the change, which is critical for maintaining large rule sets.

Answer

To delete logs from the storage.

Answer

To backup the configuration.

Answer

To generate reports automatically.

Question 9

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

Accepted Answer

WHOIS database. The WHOIS database is the correct source because it stores domain registration records including the registrar, registrant contact information, creation date, expiration date, and name servers. Querying WHOIS for a malicious domain reveals when it was registered, which helps assess whether it's a newly created domain (common in phishing/malware campaigns) or an older compromised domain.

Answer

DNSSEC database

Answer

IP Reputation database

Answer

Passive DNS database

Question 10

Which THREE actions are appropriate during the eradication phase of a malware incident?

Accepted Answer

Patching the underlying vulnerability. Patching the underlying vulnerability (A) is correct because eradication must close the initial attack vector so the malware cannot be re-introduced or re-exploited after cleanup. Scanning the network for other infected hosts (B) is correct because eradication requires identifying and removing all instances of the malware across the environment, not just on the initially discovered system. Removing malicious binaries (D) is correct because deleting the malware files, persistence mechanisms, and associated artifacts is the core action of eradicating the threat from affected systems. Adding the attacker on social media (C) is not an incident response action and could compromise the investigation or create operational security risks. Deleting the entire server (E) is a disproportionate, destructive action that would cause unnecessary data and service loss rather than targeted eradication.

Answer

Adding the attacker on social media

Answer

Deleting the entire server

Question 11

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Accepted Answer

netstat -tulnp. The command 'netstat -tulnp' lists all TCP (-t) and UDP (-u) listening (-l) sockets, shows numeric addresses (-n), and includes the process ID and program name (-p) that owns each socket. This directly maps a network socket to the rogue process, which is exactly what the analyst needs. The -p flag requires root privileges but provides the critical process-to-socket association.

Answer

top

Answer

ps aux

Answer

lsmod

Question 12

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Accepted Answer

Security Content Engineer. The Security Content Engineer is the role dedicated to authoring, tuning, and maintaining detection content such as SIEM correlation rules, use cases, and parsers. This role owns the health and efficacy of the detection pipeline, which is exactly what the question describes. Other roles focus on response, governance, or management rather than content lifecycle.

Answer

Incident Responder

Answer

Compliance Officer

Answer

SOC Manager

Question 13

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

Accepted Answer

CloudWatch Unified Agent. The CloudWatch Unified Agent (formerly the unified CloudWatch agent) is the AWS-supported agent that runs on on-premises servers and can collect and forward logs (and metrics) to CloudWatch Logs over the public AWS endpoints. It supports both the logs and metrics plugins in a single agent, making it the correct choice for streaming on-premises logs into CloudWatch. The other options are AWS services, not agents installed on a server.

Answer

Simple Queue Service (SQS)

Answer

Kinesis Firehose

Answer

AWS Config

Question 14

A SOC analyst is performing live forensic triage on a Windows Server 2019 host suspected of a credential-dumping attack. The analyst wants to identify whether the LSASS process memory has been accessed by an unauthorized tool in the last 24 hours. Which Windows event log source and event ID should the analyst review?

Accepted Answer

Sysmon operational log, event ID 10. Sysmon event ID 10 (ProcessAccess) captures handle opens to other processes, including the source image, target image, and granted access rights. When Sysmon is configured with a rule for lsass.exe, it provides direct evidence of credential-dumping tools accessing LSASS. Security 4688 and 4624 and System 7045 do not record process-to-process handle operations, so they cannot answer the specific question.

Answer

Security log, event ID 4624

Answer

System log, event ID 7045

Answer

Security log, event ID 4688

Question 15

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. A SIEM collector is a dedicated component that receives log data from various sources (servers, network devices, applications) and forwards it to the central SIEM processing engine. It acts as a log aggregator and forwarder, often using protocols like syslog, SNMP, or agent-based collection. The collector does not perform analysis, encryption, or blocking; those are functions of other SIEM components or security controls.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 16

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the correct answer because it allows an analyst to submit a file hash (MD5, SHA-1, or SHA-256) and instantly cross-reference it against 70+ antivirus engines, URL/domain scanners, and sandbox behavioral analysis tools in a single query. This multi-engine aggregation gives a much higher detection confidence than any single AV product, and it also returns community comments and vendor-specific verdicts. For SOC analysts verifying whether an executable is known-malicious, VirusTotal is the industry-standard first stop.

Answer

Google Search

Answer

Microsoft Update

Answer

WHOIS

Question 17

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made in an AWS account, including the identity of the caller, the action performed, the source IP address, and the timestamp. Querying CloudTrail event history or a CloudTrail Lake/Athena-backed trail lets you pinpoint the exact API call and originating IP for the unauthorized IAM role usage.

Answer

AWS Systems Manager

Answer

AWS Config

Answer

Amazon GuardDuty

Question 18

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

Accepted Answer

HKCU\Software\Classes\CLSID. Option B (HKCU\Software\Classes\CLSID) is correct because per-user COM object registrations under the Classes\CLSID hive can be hijacked or created to point to malicious DLLs, enabling persistence via COM hijacking when a legitimate application instantiates the CLSID. Option C (HKLM\System\CurrentControlSet\Services) is correct because this key stores Windows service definitions, including the ImagePath and ServiceDLL values that attackers modify or add to run malicious code as a service at boot. Option E (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is correct because Run keys are a classic autostart location whose values execute programs at user logon, a very common persistence mechanism. Option A is not a persistence location; the Nls\Language key holds locale/language configuration data. Option D is also not a persistence location; FontSubstitutes merely maps font substitution names and does not execute code.

Answer

HKLM\System\CurrentControlSet\Control\Nls\Language

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

Question 19

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Accepted Answer

The polling interval for the API is set too high.. The polling interval determines how frequently the SIEM queries the cloud provider's API for new log data. If this interval is set too high (e.g., every 15 minutes instead of every minute), logs accumulate between polls and alerts are only generated after the next poll cycle, producing the observed high latency. Reducing the polling interval (or switching to a push/streaming mechanism like webhooks or syslog forwarding) directly decreases alert generation delay.

Answer

The SIEM storage is full.

Answer

The cloud provider is down.

Answer

The SIEM license limit is reached.

Question 20

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Accepted Answer

Run host isolation playbook. Host isolation is the fastest way to stop an active threat from spreading laterally or exfiltrating data, and it preserves the endpoint state for later forensics. In a SOAR playbook, isolation is typically the first automated containment action because it is reversible and low-impact compared to network-wide changes.

Answer

Reset all user passwords

Answer

Perform full forensic imaging

Answer

Update the firewall rule base