312-39 Hard Questions — 25 Difficult Questions

Question 1

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Accepted Answer

The aggregation window is configured incorrectly.. In ArcSight correlation rules, the aggregation window defines the time period over which events are grouped and evaluated. If the window is misconfigured (too short, too long, or with incorrect reset conditions), the rule will not accumulate the required events to trigger, even if the filter logic is correct. This is the most common cause of a rule that matches events but never fires.

Answer

The parser is disabled.

Answer

The user interface is loading slowly.

Answer

The license has expired.

Question 2

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?

Accepted Answer

Security log, Event ID 4688. To retrieve the full command line of a PowerShell process, the analyst should examine Security log Event ID 4688, which records process creation and includes command-line data when the appropriate audit policy is enabled. Other events like 7045, 1000, or 4104 serve different purposes and do not reliably capture the command line. Event ID 4688 is the standard source for process command-line auditing.

Answer

Application log, Event ID 1000

Answer

System log, Event ID 7045

Answer

Windows PowerShell log, Event ID 4104

Question 3

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 4

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Accepted Answer

Windows Event Log - PowerShell Script Block Logging (Event ID 4104). PowerShell Script Block Logging (Event ID 4104) records the actual script block text that PowerShell executes, including de-obfuscated commands after certain decoding steps, making it the richest source for seeing what an attacker ran. This is especially valuable for fileless attacks where nothing touches disk. Event ID 4688 only shows that powershell.exe launched, not the commands inside it.

Answer

Disk forensic analysis of the user's browser history

Answer

Windows Security Log - Process Creation (Event ID 4688)

Answer

Network firewall traffic logs for port 5985

Question 5

Which THREE factors should be considered when determining the severity level of an incident?

Accepted Answer

Business impact. Severity level in incident response is driven by how much harm the incident can cause and how quickly it must be addressed, so Business impact (B) is correct because it measures the effect on operations, revenue, and services, which directly determines how severe the incident is. Data sensitivity (C) is correct because incidents involving regulated, confidential, or high-value data (e.g., PII, PHI, intellectual property) warrant a higher severity due to legal, compliance, and reputational consequences. Urgency (E) is correct because it reflects how time-critical the response is — for example, an active ransomware spread or ongoing data exfiltration demands immediate action and thus elevates severity. The analyst's mood (A) is a subjective human state and has no bearing on objective incident severity, and the day of the week (D) is irrelevant to the technical and business impact of an incident, even if staffing levels may vary.

Answer

The analyst's mood

Answer

The day of the week

Question 6

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based conditions such as 'only trigger during business hours' are applied in the alert's schedule or suppression settings, where the SIEM evaluates the rule only within defined time windows or suppresses alerts outside them. This is a rule-level configuration that controls when the detection logic is active or when notifications fire. It is separate from data ingestion or user permissions.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 7

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

Accepted Answer

A private executable memory region inside a legitimate process marked PAGE_EXECUTE_READWRITE. Injected code typically appears as executable private memory with write permissions inside a host process, or as a thread whose start address is outside any mapped module. Both artifacts deviate from normal process structure and are surfaced by memory forensics plugins. Signed DLLs, handle counts, and ordinary waiting threads are normal conditions and do not by themselves demonstrate injection.

Answer

A user-mode process with a single thread that is currently in a wait state

Answer

A signed Microsoft DLL loaded at its expected base address

Answer

A process with a high handle count and many open Registry keys

Question 8

During an incident response, a SOC analyst observes that a compromised host is periodically resolving a domain that was registered three days ago and has no reputation data. The domain resolves to an IP address that also hosts a legitimate content delivery network (CDN) service. Which technique is the attacker most likely using to evade detection?

Accepted Answer

Domain fronting by leveraging the CDN's TLS SNI and HTTP Host header mismatch. Domain fronting allows an attacker to hide the true destination behind a CDN by using a legitimate domain in the TLS SNI while the HTTP Host header specifies the attacker's domain. The new domain resolving to a CDN IP that also hosts legitimate services is a strong indicator of this technique, as it blends malicious traffic with benign CDN traffic.

Answer

Fast flux by rapidly changing the domain's A records across many IP addresses

Answer

DNS tunneling by encoding command-and-control data in DNS query names

Answer

Use of a domain generation algorithm (DGA) to create many pseudorandom domains

Question 9

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

Accepted Answer

Event ID 4769 with encryption type 0x17 (RC4) for service accounts that normally use AES.. Kerberoasting detection relies on identifying anomalous TGS requests. A user requesting multiple service tickets for different SPNs in a short window indicates enumeration, while RC4 encryption requests for accounts that normally use AES signal an attempt to obtain easily crackable tickets. Together, these behaviors provide high-fidelity detection with fewer false positives than generic logon or group-change events.

Answer

A service account being added to the Domain Admins group.

Answer

Event ID 4771 for Kerberos pre-authentication failures from a single source.

Answer

Event ID 4624 logon type 3 (network) from a workstation to a domain controller.

Question 10

A SOC analyst is reviewing logs from a Windows Server 2019 domain controller to detect credential dumping attempts. The analyst wants to identify events that indicate the use of Mimikatz or similar tools. Which TWO Windows event IDs should the analyst prioritize for detecting credential dumping? (Choose two.)

Accepted Answer

Event ID 10 from Sysmon (ProcessAccess). Sysmon Event ID 10 (ProcessAccess) is specifically designed to capture process memory access, which is a hallmark of credential dumping tools targeting LSASS. Event ID 4688 (Process Creation) can reveal the execution of credential dumping tools via command-line arguments. Together, they provide strong detection capabilities for Mimikatz-like activity. Other events, while useful for general auditing, are not as directly indicative of credential dumping.

Answer

Event ID 4656 (A handle to an object was requested)

Answer

Event ID 4663 (An attempt was made to access an object)

Answer

Event ID 4624 (An account was successfully logged on)

Question 11

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (A) are a classic persistence mechanism because an attacker can create a task that re-executes malware at logon, on a schedule, or at system startup, so analysts routinely enumerate them (e.g., schtasks /query or the Task Scheduler library) for suspicious entries. Registry 'Run' keys (C), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, are checked because they cause programs to launch automatically at user logon or system boot, making them a favorite autostart location for implants. Startup folders (D), both the per-user and all-users Startup directories, are also examined since any shortcut or executable placed there executes automatically when the user logs in. System memory dumps (B) are useful for live forensics such as extracting credentials or injected code, but they are not a standard persistence artifact, and Event log files (E) are examined for evidence of activity or tampering rather than being a persistence location themselves.

Answer

System memory dumps

Answer

Event log files

Question 12

A threat hunter notices that on several endpoints, a signed Microsoft binary located in System32 spawned a child process that wrote a file to a user's Startup folder and then exited. The parent process path is legitimate, and the file's signature is valid. Which technique does this most likely represent, and what is the key artifact for confirming it?

Accepted Answer

Signed binary proxy execution, confirmed by correlating the parent process command line with the child process's file creation event. A trusted, signed System32 binary launching a child process that drops a file into a Startup folder fits signed binary proxy execution. The confirming artifact is the linkage between the parent's command line and the child's file creation event, which ties the trusted binary to the persistence action. Other techniques do not match the observed file-write behavior.

Answer

Masquerading via renamed binary, confirmed by comparing the file's hash against a known-good baseline

Answer

Scheduled task creation, confirmed by inspecting the Task Scheduler operational log for task registration events

Answer

Process injection, confirmed by examining the parent process's memory for unbacked executable regions

Question 13

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?

Accepted Answer

Command and Control. Consistent interval beaconing to an uncommon external address, uniform packet sizes, and TLS traits that do not match a normal browser collectively identify the command-and-control phase, where an implanted agent maintains contact with attacker infrastructure. Weaponization and exploitation precede this and occur without such regular outbound patterns, while actions on objectives would manifest as observable impact rather than heartbeat traffic.

Answer

Exploitation

Answer

Weaponization

Answer

Actions on Objectives

Question 14

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

Accepted Answer

Run the sample in a debugger with breakpoints on LoadLibrary and GetProcAddress, then inspect the string arguments passed to those functions. Dynamic resolution through LoadLibrary and GetProcAddress is the standard mechanism behind sparse import tables, so instrumenting those two functions in a debugger recovers the module and procedure names as they are requested. Hash lookups, section size comparisons, and string extraction are triage techniques that do not expose the runtime resolution sequence.

Answer

Parse the PE section table and compare the raw size against the virtual size of each section

Answer

Extract printable ASCII and Unicode strings from the binary and filter for known Windows API names

Answer

Compute the file's MD5 and SHA-256 hashes and submit them to a public multi-engine scanning service

Question 15

A SOC analyst is triaging a SIEM alert for a potential malware infection on a critical server. The alert was triggered by a signature detecting the presence of a known malware hash. The analyst checks the file and finds that it is a legitimate administrative tool that was recently updated. The hash matches because the malware author copied the tool and added malicious code. The analyst needs to determine if the server is actually infected. Which of the following is the MOST reliable method to confirm the infection?

Accepted Answer

Perform a memory analysis on the server to look for malicious processes or network connections.. The most reliable method is memory analysis. It detects active malware by examining running processes and network connections, which can reveal malicious behavior even if the file on disk appears legitimate. Other methods like antivirus scans or signature checks can be evaded or provide false positives. Memory analysis provides concrete evidence of compromise and is a key skill for SOC analysts.

Answer

Run a full antivirus scan on the server to detect other malware files.

Answer

Check the file's digital signature to verify if it is valid and trusted.

Answer

Submit the file to a multi-engine antivirus scanner like VirusTotal to see if other engines detect it as malicious.

Question 16

A SOC analyst is reviewing Windows event logs to detect credential dumping attempts. The analyst focuses on events where a process requests access to the memory of lsass.exe. Which Windows event ID and log source should the analyst monitor to detect this behavior?

Accepted Answer

Event ID 4663 in the Security log. Event ID 4663 in the Security log records object access attempts, including when a process requests access to lsass.exe memory. This is critical for detecting credential dumping tools that read lsass memory. Enabling object access auditing for the lsass process is required. Other events like 4688 or 4656 provide related but less specific information, and Sysmon Event ID 10 is not a native Windows event log.

Answer

Event ID 4688 in the Security log

Answer

Event ID 4656 in the Security log

Answer

Event ID 10 in the Sysmon log

Question 17

A SOC analyst is investigating a suspected data exfiltration incident involving a compromised user account. The analyst has access to proxy logs, DNS logs, and NetFlow data. Which TWO data sources would BEST help identify the exfiltration channel and destination? (Choose two.)

Accepted Answer

DNS logs showing a high volume of TXT queries to a single domain. Proxy logs reveal HTTP/S uploads to rare domains, directly showing the exfiltration channel and destination. DNS logs with anomalous TXT query volumes indicate DNS tunneling, another common exfiltration method. Together, they provide application-layer visibility that NetFlow lacks. Other sources like authentication logs and antivirus logs do not show data transfer details. Thus, proxy and DNS logs are the best choices for identifying the exfiltration channel and destination.

Answer

Windows Security event logs showing successful logons from the user account

Answer

NetFlow data showing large outbound transfers to a known cloud storage IP

Answer

Antivirus logs showing a quarantined file on the user's workstation

Question 18

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

Accepted Answer

Security Event ID 4624 (Logon Type 9). Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.

Answer

Registry key creation in RunOnce

Answer

Prefetch file modification

Answer

DNS query logs

Question 19

You are troubleshooting a performance bottleneck in an ELK Stack deployment. Logstash is dropping events due to backpressure. Which configuration parameter in the Logstash pipeline file is best suited to manage the queue size and prevent memory overflow?

Accepted Answer

Increase the pipeline.batch.size. pipeline.batch.size and pipeline.workers are key, but pipeline.ordered controls the processing flow and buffer behavior directly.

Answer

Set the log.level to error

Answer

Disable the Elasticsearch output plugin

Answer

Change the time_zone parameter

Question 20

In Splunk Enterprise Security, you are investigating a high-fidelity alert generated by the 'Access - Successful Web Authentication - Previous Success' correlation search. You notice the notable event is missing the user's location metadata. What is the most appropriate step to enrich this data for future triage?

Accepted Answer

Update the 'Identity' lookup table in the KV Store and ensure the correlation search is configured to perform a 'lookup' command against that table.. Splunk ES uses KV Store lookups for enrichment. Modifying the lookup definition or the correlation search base query to include the 'geoip' command or a lookup against the 'iplocation' table is the standard procedure.

Answer

Change the alert severity level in the 'Incident Review' dashboard settings.

Answer

Edit the correlation search definition to pipe the results into the 'inputlookup' command for user data.

Answer

Modify the 'Notable Event Aggregation Policy' to force a refresh of the user metadata.