312-39 Practice Test 9 — 10 Questions

Question 1

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

netstat -ano. The analyst needs a live mapping of connections to the owning process on a Windows host using only built-in tooling. The netstat utility with the -a, -n, and -o switches enumerates all connections in numeric form and appends the owning PID, allowing direct correlation to PID 4212. None of the other utilities expose socket ownership, so they cannot answer the question.

Answer

nslookup

Answer

arp -a

Answer

tracert

Question 2

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Accepted Answer

Document the rationale for closure. Option B is correct because documenting the rationale for closing an alert as a False Positive creates an audit trail and preserves the analyst's reasoning for compliance, reporting, and future investigations. Option D is correct because a confirmed False Positive often reveals that the correlation rule's logic, thresholds, or field mappings are too broad, so tuning the rule reduces future noise and improves detection fidelity. Option A is wrong because simply ignoring an alert without formal closure leaves it in an unresolved state and breaks incident-handling workflow. Option C is wrong because deleting the original event log destroys forensic evidence and violates log retention and integrity requirements. Option E is wrong because a False Positive is a detection-tuning issue, not a licensing capacity problem, so requesting a new SIEM license does not address the root cause.

Answer

Ignore the alert without closure

Answer

Delete the original event log

Answer

Request a new SIEM license

Question 3

A SOC analyst receives an alert that a domain controller is generating a high volume of Kerberos ticket-granting service (TGS) requests with RC4 encryption for various service principal names. The analyst suspects a Kerberoasting attack. Which Windows event ID should the analyst prioritize to confirm the attack?

Accepted Answer

Event ID 4769 (A Kerberos service ticket was requested). Kerberoasting exploits Kerberos TGS requests by requesting service tickets for accounts with SPNs and then cracking the encrypted ticket offline. Domain controllers log these requests as Event ID 4769. The presence of RC4 encryption (type 0x17) in 4769 events is a strong indicator because Kerberoasting tools often request RC4 tickets for easier cracking. Monitoring 4769 for anomalous service names and encryption types enables detection.

Answer

Event ID 4771 (Kerberos pre-authentication failed)

Answer

Event ID 4624 (An account was successfully logged on)

Answer

Event ID 4768 (A Kerberos authentication ticket (TGT) was requested)

Question 4

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Accepted Answer

Check the asset's 'Business Criticality' and 'Owner' in the CMDB to see if the activity is a scheduled backup.. Before taking disruptive action, the analyst must establish context: checking the CMDB for the asset's business criticality and owner determines whether the 50GB transfer is a legitimate scheduled backup to cloud storage or genuine exfiltration. This validation step prevents false-positive responses that could break business operations or destroy evidence. Triage prioritizes understanding over immediate reaction.

Answer

Block the cloud storage IP address on the corporate firewall.

Answer

Immediately disable the user account in Active Directory.

Answer

Re-image the affected host immediately.

Question 5

A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?

Accepted Answer

use-dns(yes);. To replace IP addresses with hostnames in syslog-ng, the use-dns(yes) option must be enabled. This triggers reverse DNS lookups on incoming messages, resolving IPs to hostnames when the sending device does not provide one. The other options either preserve existing hostnames, cache lookups, or handle relay chains, but none enable the necessary DNS resolution.

Answer

keep-hostname(yes);

Answer

dns-cache(yes);

Answer

chain-hostnames(yes);

Question 6

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Accepted Answer

Implementing Risk-Based Alerting (RBA).. Option A, Implementing Risk-Based Alerting (RBA), is correct because RBA aggregates multiple low-severity detections into a single risk-scored entity (user, host, or IP) rather than alerting on each event individually, which dramatically reduces the volume of isolated false-positive alerts and lets analysts focus on correlated, higher-risk behavior. Option D, Setting thresholds based on baselined activity, is correct because establishing a normal behavioral baseline (for example, typical login counts, data-transfer volumes, or process execution rates per host) allows thresholds to be tuned to the environment so that only statistically anomalous deviations trigger alerts, minimizing noise from legitimate activity. Option B is wrong because disabling all alerts during off-hours creates dangerous blind spots that attackers commonly exploit and does nothing to improve alert fidelity. Option C is wrong because wildcard searches for all rules broaden matching logic, producing more spurious hits and worsening false positives rather than reducing them. Option E is wrong because increasing log retention to 10 years affects storage and forensic availability, not the precision or false-positive rate of SIEM alert rules.

Answer

Disabling all alerts during off-hours.

Answer

Using wildcard searches for all rules.

Answer

Increasing log retention to 10 years.

Question 7

Which of the following is a key advantage of utilizing a centralized SIEM platform?

Accepted Answer

Unified visibility across disparate security layers.. A centralized SIEM aggregates and correlates log and event data from many heterogeneous sources — firewalls, IDS/IPS, endpoints, identity providers, cloud workloads — into a single normalized platform. This gives analysts one pane of glass to detect cross-layer attack patterns that would be invisible when each tool's logs are siloed. The core value is correlation and unified visibility, not cost savings or automated response.

Answer

Hardware reduction in the datacenter.

Answer

Elimination of all false positives.

Answer

Automatic remediation of all threats.

Question 8

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

Accepted Answer

Centralized visibility across multiple cloud providers. Option A is correct because a SIEM integrated with cloud-native logs ingests log streams from AWS CloudTrail, Azure Activity Logs, and GCP Cloud Audit Logs into one platform, giving centralized visibility across multiple cloud providers. Option B is correct because the SIEM stores normalized events in a long-term index, enabling advanced threat hunting queries and analytics over historical data that native cloud consoles cannot retain or query at scale. Option D is correct because the SIEM's correlation engine joins events from different security layers (identity, network, workload, and control-plane logs) into a single detection timeline, surfacing multi-stage attacks that isolated tools would miss. Option C is not a SIEM function; guest OS kernel patching is performed by configuration-management or patch-management tools such as AWS Systems Manager Patch Manager or Azure Update Manager. Option E is not a SIEM function either; creating cloud accounts is an identity/provisioning task handled by services like AWS Organizations or Azure Management Groups, not by log analytics.

Answer

Automatic patching of guest OS kernels

Answer

Automated creation of new cloud accounts

Question 9

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Accepted Answer

Scanning for open ports and services. The Reconnaissance phase of the Cyber Kill Chain (Lockheed Martin's seven-phase model) is the first stage, where the adversary gathers information about the target before launching an attack. Scanning for open ports and services is a classic active reconnaissance technique (e.g., using nmap or masscan) that maps the attack surface and identifies exploitable services. This aligns with the phase's goal of intelligence gathering to inform later weaponization and delivery stages.

Answer

Deploying a remote access trojan

Answer

Exploiting a software vulnerability

Answer

Encrypting data for ransom

Question 10

A SOC analyst is building detection content for credential access techniques on Windows endpoints. Which two artifacts would most reliably indicate an attempt to dump credentials from LSASS? (Choose two.)

Accepted Answer

Sysmon Event ID 10 showing a non-Microsoft signed process requesting access to lsass.exe. Credential dumping from LSASS requires both accessing the protected process memory and persisting or transmitting the extracted secrets. Detections that combine a suspicious process opening lsass.exe with subsequent dump file creation, or that flag non-Microsoft signed processes requesting access to lsass.exe through Sysmon, directly capture those steps and are far more reliable than authentication-failure or account-creation artifacts.

Answer

A new local administrator account created outside change management windows

Answer

An increase in Kerberos TGS requests using RC4 encryption for many service accounts

Answer

Event ID 4625 failures followed by a 4624 success for the same account from a new source workstation