312-39 Practice Test 7 — 10 Questions

Question 1

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Accepted Answer

netstat -tulnp. The command 'netstat -tulnp' lists all TCP (-t) and UDP (-u) listening (-l) sockets, shows numeric addresses (-n), and includes the process ID and program name (-p) that owns each socket. This directly maps a network socket to the rogue process, which is exactly what the analyst needs. The -p flag requires root privileges but provides the critical process-to-socket association.

Answer

top

Answer

ps aux

Answer

lsmod

Question 2

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Accepted Answer

Security Content Engineer. The Security Content Engineer is the role dedicated to authoring, tuning, and maintaining detection content such as SIEM correlation rules, use cases, and parsers. This role owns the health and efficacy of the detection pipeline, which is exactly what the question describes. Other roles focus on response, governance, or management rather than content lifecycle.

Answer

Incident Responder

Answer

Compliance Officer

Answer

SOC Manager

Question 3

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

Accepted Answer

CloudWatch Unified Agent. The CloudWatch Unified Agent (formerly the unified CloudWatch agent) is the AWS-supported agent that runs on on-premises servers and can collect and forward logs (and metrics) to CloudWatch Logs over the public AWS endpoints. It supports both the logs and metrics plugins in a single agent, making it the correct choice for streaming on-premises logs into CloudWatch. The other options are AWS services, not agents installed on a server.

Answer

Simple Queue Service (SQS)

Answer

Kinesis Firehose

Answer

AWS Config

Question 4

A SOC analyst is performing live forensic triage on a Windows Server 2019 host suspected of a credential-dumping attack. The analyst wants to identify whether the LSASS process memory has been accessed by an unauthorized tool in the last 24 hours. Which Windows event log source and event ID should the analyst review?

Accepted Answer

Sysmon operational log, event ID 10. Sysmon event ID 10 (ProcessAccess) captures handle opens to other processes, including the source image, target image, and granted access rights. When Sysmon is configured with a rule for lsass.exe, it provides direct evidence of credential-dumping tools accessing LSASS. Security 4688 and 4624 and System 7045 do not record process-to-process handle operations, so they cannot answer the specific question.

Answer

Security log, event ID 4624

Answer

System log, event ID 7045

Answer

Security log, event ID 4688

Question 5

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. A SIEM collector is a dedicated component that receives log data from various sources (servers, network devices, applications) and forwards it to the central SIEM processing engine. It acts as a log aggregator and forwarder, often using protocols like syslog, SNMP, or agent-based collection. The collector does not perform analysis, encryption, or blocking; those are functions of other SIEM components or security controls.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 6

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the correct answer because it allows an analyst to submit a file hash (MD5, SHA-1, or SHA-256) and instantly cross-reference it against 70+ antivirus engines, URL/domain scanners, and sandbox behavioral analysis tools in a single query. This multi-engine aggregation gives a much higher detection confidence than any single AV product, and it also returns community comments and vendor-specific verdicts. For SOC analysts verifying whether an executable is known-malicious, VirusTotal is the industry-standard first stop.

Answer

Google Search

Answer

Microsoft Update

Answer

WHOIS

Question 7

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made in an AWS account, including the identity of the caller, the action performed, the source IP address, and the timestamp. Querying CloudTrail event history or a CloudTrail Lake/Athena-backed trail lets you pinpoint the exact API call and originating IP for the unauthorized IAM role usage.

Answer

AWS Systems Manager

Answer

AWS Config

Answer

Amazon GuardDuty

Question 8

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

Accepted Answer

HKCU\Software\Classes\CLSID. Option B (HKCU\Software\Classes\CLSID) is correct because per-user COM object registrations under the Classes\CLSID hive can be hijacked or created to point to malicious DLLs, enabling persistence via COM hijacking when a legitimate application instantiates the CLSID. Option C (HKLM\System\CurrentControlSet\Services) is correct because this key stores Windows service definitions, including the ImagePath and ServiceDLL values that attackers modify or add to run malicious code as a service at boot. Option E (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is correct because Run keys are a classic autostart location whose values execute programs at user logon, a very common persistence mechanism. Option A is not a persistence location; the Nls\Language key holds locale/language configuration data. Option D is also not a persistence location; FontSubstitutes merely maps font substitution names and does not execute code.

Answer

HKLM\System\CurrentControlSet\Control\Nls\Language

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

Question 9

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Accepted Answer

The polling interval for the API is set too high.. The polling interval determines how frequently the SIEM queries the cloud provider's API for new log data. If this interval is set too high (e.g., every 15 minutes instead of every minute), logs accumulate between polls and alerts are only generated after the next poll cycle, producing the observed high latency. Reducing the polling interval (or switching to a push/streaming mechanism like webhooks or syslog forwarding) directly decreases alert generation delay.

Answer

The SIEM storage is full.

Answer

The cloud provider is down.

Answer

The SIEM license limit is reached.

Question 10

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Accepted Answer

Run host isolation playbook. Host isolation is the fastest way to stop an active threat from spreading laterally or exfiltrating data, and it preserves the endpoint state for later forensics. In a SOAR playbook, isolation is typically the first automated containment action because it is reversible and low-impact compared to network-wide changes.

Answer

Reset all user passwords

Answer

Perform full forensic imaging

Answer

Update the firewall rule base