312-39 Incident Detection And Triage Practice Test 2 — 15 Questions

Question 1

Which SIEM feature is used to group related events into a single incident?

Accepted Answer

Event correlation logic.. Event correlation logic is the SIEM feature that groups related events into a single incident by applying rules that match patterns across multiple log sources over time. For example, a correlation rule might trigger when five failed logins from the same IP are followed by a successful login within 10 minutes, producing one incident rather than five separate alerts. This reduces alert fatigue and gives analysts a coherent attack narrative.

Answer

Log rotation.

Answer

Dashboard visualization.

Answer

Data ingestion.

Question 2

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Accepted Answer

Calculate a baseline of normal traffic volume and alert on deviations.. A static threshold like 500MB does not account for normal variations in traffic, leading to false positives or missed exfiltration. Calculating a baseline of normal traffic volume and alerting on deviations (e.g., using standard deviation or machine learning) improves accuracy by adapting to the environment's typical behavior. This is a core SIEM best practice for reducing noise and detecting anomalies.

Answer

Only alert on weekend traffic.

Answer

Disable alerts for file servers.

Answer

Lower the threshold to 50MB.

Question 3

Which of the following is a key advantage of utilizing a centralized SIEM platform?

Accepted Answer

Unified visibility across disparate security layers.. A centralized SIEM aggregates and correlates log and event data from many heterogeneous sources — firewalls, IDS/IPS, endpoints, identity providers, cloud workloads — into a single normalized platform. This gives analysts one pane of glass to detect cross-layer attack patterns that would be invisible when each tool's logs are siloed. The core value is correlation and unified visibility, not cost savings or automated response.

Answer

Hardware reduction in the datacenter.

Answer

Elimination of all false positives.

Answer

Automatic remediation of all threats.

Question 4

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

Accepted Answer

Investigate the destination server's logs to see if the attack succeeded.. An alert for possible SQL injection with harmless payload strings may still indicate a probing attempt or a false positive, so the analyst must verify whether the attack actually succeeded before taking action. Reviewing the destination server's logs (web server, database, WAF) confirms whether the payload reached the database and whether any data was exfiltrated or modified, which determines the appropriate response.

Answer

Reimage the database server.

Answer

Close the alert as 'Benign'.

Answer

Block the source IP on the edge firewall.

Question 5

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

Accepted Answer

Add the vulnerability scanner's IP to an exclusion list (whitelist).. The best action is to add the vulnerability scanner's IP to an exclusion list (whitelist) so the SIEM rule ignores traffic from a known, authorized source while still detecting the same behavior from unauthorized hosts. This preserves detection coverage for real threats instead of weakening or removing the rule. Whitelisting known-good scanners is standard tuning practice in a SOC.

Answer

Disable the rule entirely.

Answer

Upgrade the vulnerability scanner.

Answer

Increase the rule threshold.

Question 6

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Accepted Answer

The polling interval for the API is set too high.. The polling interval determines how frequently the SIEM queries the cloud provider's API for new log data. If this interval is set too high (e.g., every 15 minutes instead of every minute), logs accumulate between polls and alerts are only generated after the next poll cycle, producing the observed high latency. Reducing the polling interval (or switching to a push/streaming mechanism like webhooks or syslog forwarding) directly decreases alert generation delay.

Answer

The SIEM storage is full.

Answer

The cloud provider is down.

Answer

The SIEM license limit is reached.

Question 7

Which of the following describes 'Event Correlation' in a SIEM?

Accepted Answer

Linking related events to identify security threats.. Event correlation in a SIEM is the process of analysing multiple log events from disparate sources and linking them together based on shared attributes (same user, same IP, same timeframe) to detect patterns that individually appear benign but collectively indicate a threat. It is the analytical engine behind use cases like detecting brute-force followed by successful login. It is not a storage, reporting, or maintenance function.

Answer

Compressing logs for storage.

Answer

Generating reports for management.

Answer

Updating the SIEM software.

Question 8

What does the 'False Positive' rate of a SIEM rule indicate?

Accepted Answer

The ratio of legitimate activity flagged as malicious.. A false positive occurs when a SIEM rule flags legitimate activity as malicious. The false positive rate therefore measures the ratio or percentage of alerts that are benign but incorrectly identified as threats. A high false positive rate means analysts waste time investigating non-issues and may develop alert fatigue.

Answer

The speed of alert generation.

Answer

The number of logs ingested.

Answer

The percentage of blocked attacks.

Question 9

Which component of a SIEM is responsible for identifying patterns in real-time?

Accepted Answer

Correlation engine.. The correlation engine in a SIEM is responsible for identifying patterns in real-time by correlating events across multiple sources using rules, thresholds, and logic. It matches normalized events against detection rules to generate alerts when patterns indicating security incidents occur. This is the analytical core that turns raw logs into actionable detections.

Answer

Log parser.

Answer

Reporting module.

Answer

Storage engine.

Question 10

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

Accepted Answer

Source IP, destination host, and the involved user account.. During initial triage of a high-severity alert, the most critical information to gather is the source IP, destination host, and involved user account. These three data points establish the who, what, and where of the event, enabling the analyst to quickly assess scope, determine if the activity is malicious, and decide on containment steps. Without them, the alert remains abstract and cannot be correlated with other logs or threat intelligence. This aligns with the EC-Council 312-39 (Certified SOC Analyst) focus on practical incident handling and the 5W1H approach to alert triage.

Answer

The time taken to generate the alert.

Answer

The hardware vendor of the firewall.

Answer

The SIEM software version.

Question 11

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

Accepted Answer

The rate of attempts compared to the attacker's potential speed.. When designing a SIEM rule to detect brute force attacks, the most important factor for the time window is the rate of attempts compared to the attacker's potential speed. Brute force attacks typically involve multiple failed login attempts within a short period. The time window must be set to capture this rate—too short and you miss slow attacks, too long and you get false positives from normal user errors. Aligning the window with the expected attack velocity ensures accurate detection.

Answer

The number of log sources in the SIEM.

Answer

The time of day the rule runs.

Answer

The disk space available in the SIEM.

Question 12

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

Accepted Answer

Check the SIEM ingestion error logs for agent authentication issues.. When logs are missing but the agent is running and network is clear, the next logical step is to check the SIEM ingestion error logs for agent authentication issues. Authentication failures (e.g., expired certificates, wrong API keys, or account lockouts) commonly prevent log ingestion even when the agent appears healthy. This is a targeted diagnostic step before more drastic measures.

Answer

Reinstall the OS on the server.

Answer

Increase the server CPU.

Answer

Delete the server from the SIEM asset list.

Question 13

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

Accepted Answer

Correlation rule using user and location attributes.. A correlation rule in a SIEM can join events based on user and location attributes to detect impossible travel or simultaneous logins from disparate geographies. This leverages the SIEM's ability to correlate multiple log sources and apply logic across events. It is the standard method for detecting credential misuse.

Answer

Vulnerability scanning.

Answer

Log compression.

Answer

Full packet capture.

Question 14

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

Accepted Answer

Provides real-time context to alerts.. Threat intelligence integration enriches SIEM alerts with real-time context such as known malicious IPs, domains, file hashes, and adversary tactics. This context helps analysts quickly determine whether an alert is benign or part of a known campaign, improving triage speed and accuracy. It does not replace human analysts or automate response; it augments detection and investigation.

Answer

Increases the log ingestion rate.

Answer

Replaces the need for a SOC team.

Answer

Automates all incident response.

Question 15

What is a 'log source' in the context of a SIEM?

Accepted Answer

Any device or application generating security logs.. A log source is any device, application, or system that generates security-relevant log data, such as firewalls, servers, endpoints, or authentication services. In a SIEM, these sources feed raw events into the collection pipeline for correlation and analysis. Option D correctly identifies this as the origin of log data, not the storage or infrastructure components.

Answer

The database storing the logs.

Answer

The SIEM administrator's computer.

Answer

A physical cable.