312-39 Incident Detection And Triage — 25 Questions

Question 1

In an environment using Splunk, you want to correlate events from two different indexes based on a common 'user_id'. Which command is most efficient?

Accepted Answer

join user_id [search index=idx2]. The 'join' command effectively links events from different sources by a common key.

Answer

lookup table.csv

Answer

sort by user_id

Answer

eval user_id = field1

Question 2

In Splunk Enterprise Security, you are investigating a high-fidelity alert generated by the 'Access - Successful Web Authentication - Previous Success' correlation search. You notice the notable event is missing the user's location metadata. What is the most appropriate step to enrich this data for future triage?

Accepted Answer

Update the 'Identity' lookup table in the KV Store and ensure the correlation search is configured to perform a 'lookup' command against that table.. Splunk ES uses KV Store lookups for enrichment. Modifying the lookup definition or the correlation search base query to include the 'geoip' command or a lookup against the 'iplocation' table is the standard procedure.

Answer

Change the alert severity level in the 'Incident Review' dashboard settings.

Answer

Edit the correlation search definition to pipe the results into the 'inputlookup' command for user data.

Answer

Modify the 'Notable Event Aggregation Policy' to force a refresh of the user metadata.

Question 3

What is the purpose of normalizing logs in a SIEM?

Accepted Answer

To provide a common format for cross-vendor correlation.. Normalization creates a common schema, allowing for cross-vendor correlation.

Answer

To compress log size for storage efficiency.

Answer

To hide sensitive information.

Answer

To increase the ingestion speed.

Question 4

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Accepted Answer

Joins allow matching records between two datasets based on a common field.. Joins allow for the association of different data types based on common entities like IP addresses or hostnames.

Answer

Unions only support structured data.

Answer

Joins consume less memory than unions.

Answer

Unions cannot be used in detection rules.

Question 5

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

Accepted Answer

Asset Criticality.. Asset criticality helps determine the priority of an incident in a real-world SOC environment.

Answer

Alert frequency.

Answer

Log source vendor.

Answer

Number of alerts per user.

Question 6

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Accepted Answer

The aggregation window is configured incorrectly.. Event aggregation settings can prevent rules from firing if the conditions are too restrictive.

Answer

The parser is disabled.

Answer

The user interface is loading slowly.

Answer

The license has expired.

Question 7

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

Accepted Answer

Check threat intelligence feeds to see if the IP is flagged as malicious.. Cloud-based IPs are often legitimate proxies or malicious botnets; context is key.

Answer

Escalate to the ISP immediately.

Answer

Disable the rule for all cloud traffic.

Answer

Ignore the alert as cloud IPs are always false positives.

Question 8

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Accepted Answer

Verify if the connection was successful or blocked by the firewall.. Verifying if the connection was successful is essential to confirm if a threat exists.

Answer

Isolate the host immediately.

Answer

Reimage the affected workstation.

Answer

Contact the user's manager.

Question 9

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

Accepted Answer

Create a custom DSM and map the event IDs to existing QIDs.. QID mapping ensures that normalized events are correctly classified for correlation.

Answer

Increase the storage allocation for the log source.

Answer

Upgrade the firmware on the log source.

Answer

Restart the Event Processor service.

Question 10

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

Accepted Answer

Increase the threshold for the number of failed attempts within the lookback window.. Risk-based alerting and threshold tuning are standard practices to reduce noise in SIEM correlation rules.

Answer

Delete the correlation rule and recreate it.

Answer

Enable packet capture on all domain controllers.

Answer

Change the rule severity to 'Informational'.

Question 11

When building a new SIEM use case, what is the first phase of the development lifecycle?

Accepted Answer

Requirement gathering and scoping.. Defining requirements is always the starting point for SIEM use case design.

Answer

Writing the correlation query.

Answer

Testing the alert in production.

Answer

Documenting the playbook.

Question 12

What is the primary function of a SIEM collector?

Accepted Answer

Gather and forward logs to the SIEM processing engine.. Collectors gather data from various sources and forward it to the main processing engine.

Answer

Analyze logs for malware.

Answer

Encrypt stored logs.

Answer

Block malicious traffic.

Question 13

Which SIEM feature is used to group related events into a single incident?

Accepted Answer

Event correlation logic.. Correlation engines or incident management modules group events based on shared attributes.

Answer

Log rotation.

Answer

Dashboard visualization.

Answer

Data ingestion.

Question 14

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Accepted Answer

Calculate a baseline of normal traffic volume and alert on deviations.. Baseline behavior provides a reference point, reducing false positives caused by expected high-volume traffic.

Answer

Only alert on weekend traffic.

Answer

Disable alerts for file servers.

Answer

Lower the threshold to 50MB.

Question 15

Which of the following is a key advantage of utilizing a centralized SIEM platform?

Accepted Answer

Unified visibility across disparate security layers.. A unified view allows for correlation across disparate security layers, which is impossible with siloed tools.

Answer

Hardware reduction in the datacenter.

Answer

Elimination of all false positives.

Answer

Automatic remediation of all threats.

Question 16

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

Accepted Answer

Investigate the destination server's logs to see if the attack succeeded.. Triage involves confirming the intent and success of the attack, not just the signature match.

Answer

Reimage the database server.

Answer

Close the alert as 'Benign'.

Answer

Block the source IP on the edge firewall.

Question 17

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

Accepted Answer

Add the vulnerability scanner's IP to an exclusion list (whitelist).. Excluding known-good assets prevents alert fatigue and ensures SOC focus on real threats.

Answer

Disable the rule entirely.

Answer

Upgrade the vulnerability scanner.

Answer

Increase the rule threshold.

Question 18

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Accepted Answer

The polling interval for the API is set too high.. API polling intervals are the most common source of latency in cloud log ingestion.

Answer

The SIEM storage is full.

Answer

The cloud provider is down.

Answer

The SIEM license limit is reached.

Question 19

Which of the following describes 'Event Correlation' in a SIEM?

Accepted Answer

Linking related events to identify security threats.. Correlation relates disparate events to identify a security threat.

Answer

Compressing logs for storage.

Answer

Generating reports for management.

Answer

Updating the SIEM software.

Question 20

What does the 'False Positive' rate of a SIEM rule indicate?

Accepted Answer

The ratio of legitimate activity flagged as malicious.. High false positive rates degrade SOC efficiency and lead to analyst burnout.

Answer

The speed of alert generation.

Answer

The number of logs ingested.

Answer

The percentage of blocked attacks.