312-39 Practice Test 6 — 10 Questions

Question 1

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Calculating the time delta between connections is the standard method for identifying the consistent heartbeat of C2 beacons.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 2

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

Accepted Answer

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/. The use of macros like $HOST or $YEAR allows for dynamic directory creation based on incoming log metadata.

Answer

Defining separate log paths for every individual IP address

Answer

Configuring the global log_level to debug

Answer

Using hardcoded static path strings only

Question 3

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. The mapping of threat attributes to incident severity and category is critical for automated workflow triggering.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 4

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Accepted Answer

Perform frequency analysis (stack counting) on the command-line arguments across the environment. Stack counting (frequency analysis) is a standard hunting method to isolate outliers in command-line execution patterns.

Answer

Enable verbose logging on all domain controllers

Answer

Run a full antivirus scan on the affected workstation

Answer

Reimage the host immediately to prevent lateral movement

Question 5

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Accepted Answer

certutil.exe. Certutil.exe is frequently misused to download files or decode malicious payloads, making its use by standard users a red flag.

Answer

mspaint.exe

Answer

calc.exe

Answer

notepad.exe

Question 6

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. Mean Time to Acknowledge (MTTA) specifically measures the time from alert generation to human intervention.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time

Question 7

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Accepted Answer

Standardized handover and documentation. Standardization of playbooks and handoff procedures ensures continuity across different time zones.

Answer

Purchasing a new SIEM license

Answer

Moving all logs to the cloud

Answer

Increasing the number of Tier 3 analysts

Question 8

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Accepted Answer

Updating correlation rules based on new IOCs. Integrating external threat feeds to update correlation rules is a core function of threat intelligence within operations.

Answer

Hardening server images

Answer

Managing SOC budget

Answer

Writing compliance reports

Question 9

Which TWO factors are most critical when calculating the ROI of a SOC?

Accepted Answer

Cost of potential data breach incidents. ROI in a SOC is calculated by comparing the reduction in risk (potential cost of breach) and the operational costs (tools/personnel).

Answer

Number of social media followers

Answer

Office space square footage

Answer

Number of coffee machines in the SOC

Question 10

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Cloud (specifically the Endpoint protection or integrated EDR) provides process-level visibility and alerts for suspicious activity on VMs.

Answer

Azure Advisor

Answer

Azure Network Watcher

Answer

Azure Resource Graph