312-39 Practice Test 8 — 10 Questions

Question 1

A SOC is implementing a new use case to detect credential dumping on Windows endpoints. The detection engineering team wants to combine multiple telemetry sources to reduce false positives and improve coverage. Which two data sources should be prioritized to reliably detect credential dumping activity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sysmon events for process access to the LSASS process. Credential dumping detection benefits from combining process creation telemetry, which shows what executed and with what arguments, and Sysmon process access events, which show suspicious access to LSASS. Together they provide both the actor and the target, enabling high-fidelity alerts. Network, DHCP, and email logs lack the endpoint process and memory access visibility required for this specific behavior.

Answer

NetFlow records showing outbound traffic volume from the endpoint

Answer

DHCP logs showing IP address leases for the endpoint

Answer

Email gateway logs showing inbound messages with attachments

Question 2

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Accepted Answer

Cloud Storage Data Access logs. Cloud Storage Data Access logs record every read and write operation against objects in a bucket, including the identity, timestamp, and specific object names accessed. To identify which files were exfiltrated, the analyst must review these logs for GET/read operations during the alert window. This is the only option that captures per-object access detail.

Answer

Cloud Asset Inventory

Answer

Cloud Monitoring metrics

Answer

Cloud Load Balancing logs

Question 3

Which of these is a common SIEM data ingestion protocol?

Accepted Answer

Syslog.. Syslog is the de facto standard protocol for transmitting event and log messages from network devices, servers, and applications to a central SIEM collector. It operates over UDP or TCP (typically port 514) and supports structured or unstructured messages, making it ideal for heterogeneous log sources. SIEM platforms natively parse syslog formats (RFC 3164 and RFC 5424) to normalize and correlate events. While HTTP can be used for some API-based ingestion, syslog remains the most common and purpose-built protocol for SIEM data collection.

Answer

ICMP.

Answer

HTTP.

Answer

DHCP.

Question 4

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

Accepted Answer

Check the firewall logs for allowed outbound connections to the suspicious IP.. To validate the potential data exfiltration alert, you need to correlate network and endpoint evidence. EDR data reveals the process responsible for the connection, while firewall logs confirm if the traffic was allowed and the volume transferred. Together, they provide a clear picture of whether data left the network. Blocking, scanning, or email review are either containment or less direct investigative steps that do not immediately confirm the true positive.

Answer

Immediately block the suspicious IP address at the perimeter firewall.

Answer

Review the user's recent email activity for signs of phishing.

Answer

Run a full antivirus scan on the affected endpoint.

Question 5

A SOC analyst in an AWS environment receives an alert that an EC2 instance is making unusual outbound DNS queries to a domain associated with command-and-control activity. The analyst needs to identify the full chain of API calls that led to the instance's current state, including any IAM role assumptions or network modifications. Which AWS service should the analyst use to retrieve this information?

Accepted Answer

AWS CloudTrail. CloudTrail is the authoritative source for API activity in AWS, capturing management and data events across services. In this scenario, the analyst needs to correlate the EC2 instance's activity with API calls such as RunInstances, ModifyNetworkInterface, and AssumeRole to understand how the instance was compromised or configured. GuardDuty, AWS Config, and VPC Flow Logs each provide partial visibility but lack the comprehensive API call history that CloudTrail delivers.

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Answer

Amazon GuardDuty

Question 6

Which TWO of the following are primary components of a cloud-native incident response plan?

Accepted Answer

Containment. Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61. Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Answer

Resource Provisioning

Answer

Budget Optimization

Answer

Hardware Refresh

Question 7

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

Accepted Answer

HTTP/HTTPS proxy logs. Data exfiltration to cloud storage providers such as Dropbox, Google Drive, or OneDrive typically occurs over HTTP/HTTPS, so proxy logs capture the destination URLs, bytes transferred, user identity, and timestamps needed to detect large uploads. Proxy logs are the primary evidence source for identifying which host sent how much data to which external cloud endpoint.

Answer

DHCP logs

Answer

NTP logs

Answer

SNMP logs

Question 8

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Option B is correct because Chain of Custody documentation must identify the person who collected or handled the evidence, establishing accountability for every transfer and ensuring the evidence can be traced to a responsible individual. Option E is correct because the date and time of collection are essential custody metadata that establish when the evidence was seized, helping prove it was not altered or tampered with before analysis. Together, the collector's identity and the collection timestamp are core elements required to demonstrate an unbroken custody trail. Options A, C, and D are incorrect because hard drive casing color, CPU manufacturer, and system temperature are irrelevant hardware or environmental details that do not establish who handled the evidence or when it was collected.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 9

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

Accepted Answer

Provides real-time context to alerts.. Threat intelligence integration enriches SIEM alerts with real-time context such as known malicious IPs, domains, file hashes, and adversary tactics. This context helps analysts quickly determine whether an alert is benign or part of a known campaign, improving triage speed and accuracy. It does not replace human analysts or automate response; it augments detection and investigation.

Answer

Increases the log ingestion rate.

Answer

Replaces the need for a SOC team.

Answer

Automates all incident response.

Question 10

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Accepted Answer

Keep logs for one year, with 3 months immediately available. PCI-DSS requirement 10.7 mandates retaining audit logs for at least one year, with a minimum of three months immediately available for analysis. This ensures that logs are accessible for forensic investigations and compliance audits, while older logs can be archived but must be retrievable.

Answer

Archive all logs in a local text file format only

Answer

Retain logs for exactly 30 days

Answer

Delete logs after they are indexed in the SIEM