312-39 Practice Test 8 — 10 Questions

Question 1

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

Accepted Answer

Investigate the destination server's logs to see if the attack succeeded.. Triage involves confirming the intent and success of the attack, not just the signature match.

Answer

Reimage the database server.

Answer

Close the alert as 'Benign'.

Answer

Block the source IP on the edge firewall.

Question 2

Which of the following is considered a 'Network-based' IoC?

Accepted Answer

Suspicious domain name. Network-based IoCs include IP addresses, domain names, and URLs associated with malicious activity.

Answer

Mutex name

Answer

Registry key path

Answer

File hash (SHA-256)

Question 3

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a tool that identifies file types and packers based on entropy and signature analysis.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 4

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis focuses on file properties, strings, and structural headers to identify potential malicious intent without execution.

Answer

Memory usage patterns

Answer

Network latency to the server

Question 5

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Accepted Answer

excel.exe. When a malicious macro runs, it often triggers 'cmd.exe' or 'powershell.exe' from the 'excel.exe' process tree.

Answer

explorer.exe

Answer

wininit.exe

Answer

svchost.exe

Question 6

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is specifically designed to view the structure of Portable Executable (PE) files including headers and imports.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 7

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. Using a transparent SSL/TLS proxy (like an intercepting proxy) allows the analyst to decrypt traffic if the certificate is trusted by the client.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 8

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Accepted Answer

Verify if the connection was successful or blocked by the firewall.. Verifying if the connection was successful is essential to confirm if a threat exists.

Answer

Isolate the host immediately.

Answer

Reimage the affected workstation.

Answer

Contact the user's manager.

Question 9

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Accepted Answer

Joins allow matching records between two datasets based on a common field.. Joins allow for the association of different data types based on common entities like IP addresses or hostnames.

Answer

Unions only support structured data.

Answer

Joins consume less memory than unions.

Answer

Unions cannot be used in detection rules.

Question 10

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) provides real-time monitoring of file system, Registry, and process activity.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer