312-39 Hard Questions — 25 Difficult Questions

Question 1

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Accepted Answer

Use of removable media or virtual volumes. Shimcache (AppCompatCache) tracks file execution; if the volume is gone, it suggests a removable drive or virtual volume was used by the attacker.

Answer

Memory corruption

Answer

Log manipulation

Answer

System update failure

Question 2

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

Accepted Answer

Security Event ID 4624 (Logon Type 9). Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.

Answer

Registry key creation in RunOnce

Answer

Prefetch file modification

Answer

DNS query logs

Question 3

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Accepted Answer

netstat -tulnp. The 'netstat -tulnp' or 'ss -tulnp' command shows the process ID alongside the listening socket.

Answer

top

Answer

ps aux

Answer

lsmod

Question 4

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Accepted Answer

Windows Scheduled Tasks. Persistence often relies on modifying startup folders, registry keys, or scheduled tasks.

Answer

Network interface throughput

Answer

Browser history logs

Question 5

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Accepted Answer

Frequency analysis on connection flow metadata. Beaconing with jitter is a hallmark of C2 communication designed to evade simple threshold-based detection.

Answer

Port-based blocking

Answer

Signature-based IDS alert

Answer

Static IP blocklisting

Question 6

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based scheduling is a core feature for managing alert relevance in SIEMs.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 7

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Accepted Answer

Incident Review dashboard. The Incident Review dashboard allows analysts to view the MITRE ATT&CK tactics and techniques associated with notable events.

Answer

Threat Intelligence dashboard

Answer

Access Anomalies dashboard

Answer

User Activity Monitoring

Question 8

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Accepted Answer

The aggregation window is configured incorrectly.. Event aggregation settings can prevent rules from firing if the conditions are too restrictive.

Answer

The parser is disabled.

Answer

The user interface is loading slowly.

Answer

The license has expired.

Question 9

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

Accepted Answer

Remove the malicious file and rotate credentials. After identifying the web shell, removing the file and resetting the web application credentials is the critical next step.

Answer

Flush DNS

Answer

Restart the web service

Answer

Update the OS

Question 10

You are troubleshooting a performance bottleneck in an ELK Stack deployment. Logstash is dropping events due to backpressure. Which configuration parameter in the Logstash pipeline file is best suited to manage the queue size and prevent memory overflow?

Accepted Answer

Increase the pipeline.batch.size. pipeline.batch.size and pipeline.workers are key, but pipeline.ordered controls the processing flow and buffer behavior directly.

Answer

Set the log.level to error

Answer

Disable the Elasticsearch output plugin

Answer

Change the time_zone parameter

Question 11

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is designed to simulate common internet services, including DNS, to study malware network behavior in an isolated environment.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 12

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

Accepted Answer

The rate of attempts compared to the attacker's potential speed.. The time window must be long enough to capture slow-and-low attacks but short enough to avoid excessive false positives.

Answer

The number of log sources in the SIEM.

Answer

The time of day the rule runs.

Answer

The disk space available in the SIEM.

Question 13

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

Accepted Answer

Restrict the search to a specific time range and relevant indexes.. Filtering by time range and limiting fields are standard practices to optimize SIEM performance.

Answer

Use wildcard searches on all fields.

Answer

Add more fields to the search result.

Answer

Increase the search timeout.

Question 14

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Identifying long-duration connections and baseline deviations in data volume are the most effective ways to spot slow exfiltration.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall

Question 15

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Triage involves verification, context gathering, and determining impact.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 16

In Splunk Enterprise Security, you are investigating a high-fidelity alert generated by the 'Access - Successful Web Authentication - Previous Success' correlation search. You notice the notable event is missing the user's location metadata. What is the most appropriate step to enrich this data for future triage?

Accepted Answer

Update the 'Identity' lookup table in the KV Store and ensure the correlation search is configured to perform a 'lookup' command against that table.. Splunk ES uses KV Store lookups for enrichment. Modifying the lookup definition or the correlation search base query to include the 'geoip' command or a lookup against the 'iplocation' table is the standard procedure.

Answer

Change the alert severity level in the 'Incident Review' dashboard settings.

Answer

Edit the correlation search definition to pipe the results into the 'inputlookup' command for user data.

Answer

Modify the 'Notable Event Aggregation Policy' to force a refresh of the user metadata.

Question 17

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Baseline behavioral profiling and using multiple conditions (cross-correlation) help reduce noise by ensuring that only significant deviations trigger an alert.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.

Question 18

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

Accepted Answer

wecutil es. wecutil es (enum-subscriptions) is the standard utility for managing and checking WEF subscriptions.

Answer

wmic eventlog

Answer

winrm get config

Answer

gpresult /r

Question 19

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Calculating the time delta between connections is the standard method for identifying the consistent heartbeat of C2 beacons.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 20

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. Mean Time to Acknowledge (MTTA) specifically measures the time from alert generation to human intervention.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time