312-39 Incident Detection And Triage Practice Test 4 — 15 Questions

Question 1

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

Accepted Answer

User identity and department information.. Option A is correct because user identity and department information are classic contextual enrichment fields that let a SIEM correlate an alert to a specific person, role, and business unit, which helps assess intent and blast radius. Option B is correct because asset criticality and ownership provide business context that determines how urgently an alert should be triaged and who must be notified, directly influencing risk scoring. Option D is correct because threat intelligence reputation scores enrich indicators (IPs, domains, hashes) with known maliciousness, letting the SIEM prioritize alerts tied to known-bad infrastructure. Option C does not belong because data center weather is not a standard security-relevant contextual attribute for alert enrichment. Option E does not belong because the security team's lunch menu has no bearing on alert triage, risk, or investigation.

Answer

The weather in the data center.

Answer

The lunch menu of the security team.

Question 2

In a SIEM, what is the role of a 'Parser'?

Accepted Answer

To extract fields and normalize log data.. A parser in a SIEM is the component that ingests raw log events from heterogeneous sources (firewalls, servers, applications) and breaks each event into structured fields (timestamp, source IP, user, event type) using regex, delimiters, or key-value extraction. It then normalizes those fields into a common schema (e.g., ECS or CIM) so correlation rules and dashboards can query across all sources consistently. Without parsing/normalization, the SIEM would only have unstructured text and could not reliably correlate events.

Answer

To print reports.

Answer

To encrypt log files.

Answer

To scan for viruses.

Question 3

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

Accepted Answer

A known malicious IP address.. An Indicator of Compromise is an observable artifact that suggests a system may have been breached — a known malicious IP address, a file hash, a domain, a registry key, or a URL associated with attacker infrastructure. A malicious IP is the textbook IoC because it is a concrete, matchable technical artifact used to detect or scope intrusions.

Answer

The SIEM administrator's name.

Answer

The server name.

Answer

The company's office address.

Question 4

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Accepted Answer

An automated process or script is likely involved.. Ten failures in one second strongly suggests an automated process or script, such as a brute-force attack or a misconfigured application repeatedly trying to authenticate. Human users typically cannot generate such a high rate of failed logins. This pattern is a common indicator of malicious activity or a system error.

Answer

The server is overheating.

Answer

A user is having a bad day.

Answer

The SIEM is broken.

Question 5

What is the purpose of 'Dashboards' in a SIEM?

Accepted Answer

To visualize data and monitor trends.. Dashboards in a SIEM provide visual representations of data, such as charts, graphs, and tables, to help analysts monitor trends, detect anomalies, and gain situational awareness. They aggregate and display key metrics and log events in real time, enabling quick identification of security incidents. The primary purpose is visualization and monitoring, not data storage or network control.

Answer

To block network traffic.

Answer

To install software patches.

Answer

To store all log data.

Question 6

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

Accepted Answer

Threat Intelligence Feed or Lookup Table.. Threat Intelligence Feeds and Lookup Tables are the standard SIEM features for importing external lists of indicators of compromise (IOCs), including malicious IPs. These features allow the SIEM to enrich events, correlate against known bad actors, and trigger alerts when traffic matches an entry. Lookup Tables specifically enable importing CSV or other structured data for real-time matching, while Threat Intelligence Feeds automate the ingestion and updating of such lists from external sources.

Answer

Global Rule Deletion.

Answer

Log Rotation Policy.

Answer

System Backup.

Question 7

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

Accepted Answer

where. The 'where' operator filters rows in a table based on a boolean predicate, so it is the correct choice to return only SecurityAlert rows where Severity == 'High' and the resource provider matches. It is the standard KQL filtering operator used in Sentinel analytics and hunting queries.

Answer

summarize

Answer

project

Answer

find

Question 8

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

Accepted Answer

Create an exclusion rule for the specific scanner IP address and vulnerability signatures within the SIEM policy.. Creating an exclusion rule for the specific scanner IP and vulnerability signatures within the SIEM policy suppresses the known-benign false positives while preserving the scanner's log ingestion and visibility. This is the standard tuning approach: filter the noise, not the source, so you retain audit and correlation capability for the scanner's activity.

Answer

Permanently disable the ingestion of logs from the vulnerability scanner.

Answer

Change the log source protocol from Syslog to SNMP.

Answer

Increase the threshold for the correlation rule to a point where the scanner no longer triggers it.

Question 9

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

Accepted Answer

Modify the device-side agent parser or the FlexConnector map file to extract the 'SessionID' field.. In ArcSight ESM, correlation rules can only aggregate on fields that are parsed and available in the event schema. If 'SessionID' is not parsed, you must first modify the device-side agent parser or the FlexConnector map file to extract the field. Only then can the rule reference it for aggregation.

Answer

Create a new 'Active List' to store the unparsed data.

Answer

Use the 'regex' operator within the rule condition itself.

Answer

Enable 'Event Forwarding' on the ESM manager.

Question 10

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

Accepted Answer

Alert Triage and Prioritization. Alert triage and prioritization involves reviewing incoming alerts, assessing their severity, and categorizing them to focus on the most critical issues first. Mapping alerts to MITRE ATT&CK techniques helps analysts understand the adversary's tactics and prioritize based on the stage of the attack, which directly reduces alert fatigue by filtering out low-priority or duplicate alerts. This is a core triage activity, not a vulnerability assessment, rule development, eradication, or log retention task.

Answer

Vulnerability Assessment

Answer

Correlation Rule Development

Answer

Incident Eradication

Answer

Log Retention Analysis

Question 11

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Accepted Answer

Check the asset's 'Business Criticality' and 'Owner' in the CMDB to see if the activity is a scheduled backup.. Before taking disruptive action, the analyst must establish context: checking the CMDB for the asset's business criticality and owner determines whether the 50GB transfer is a legitimate scheduled backup to cloud storage or genuine exfiltration. This validation step prevents false-positive responses that could break business operations or destroy evidence. Triage prioritizes understanding over immediate reaction.

Answer

Block the cloud storage IP address on the corporate firewall.

Answer

Immediately disable the user account in Active Directory.

Answer

Re-image the affected host immediately.

Question 12

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Option B is correct because implementing baseline behavioral profiling for users and entities establishes a normal activity reference, so deviations that trigger alerts are genuinely anomalous rather than expected behavior, which directly reduces false positives. Option C is correct because cross-correlation across different data sources such as EDR and Firewall requires multiple independent indicators to align before an alert fires, raising the confidence of detections and filtering out single-source noise. Option A is incorrect because lowering severity to 'Low' for all rules only changes prioritization and does not reduce the number of false positives generated. Option D is incorrect because removing Time Window constraints weakens temporal correlation, allowing unrelated events to match and typically increasing false positives. Option E is incorrect because single-condition rule logic is overly broad and lacks the contextual constraints needed to distinguish malicious activity from benign events.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.

Question 13

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Accepted Answer

Number of affected systems. Option B (Number of affected systems) is correct because the scope of an alert directly drives prioritization: an event touching many hosts indicates potential lateral movement or a widespread compromise and warrants higher urgency than an isolated single-endpoint hit. Option D (Asset Value/Business Criticality) is correct because triage weighs the criticality of the impacted asset, so an alert on a domain controller, database server, or regulated system outranks the same alert on a test workstation. Option E (Threat Intelligence Reputation Score) is correct because indicators matched against threat intel feeds carry a reputation score (e.g., known malicious IP, hash, or domain), letting analysts rank alerts by confidence that the activity is truly malicious. Option A (The color scheme of the SIEM dashboard) is not a prioritization attribute; it is a cosmetic UI setting with no bearing on risk. Option C (The time of day the alert was generated) is not a standard triage priority factor, since an alert's severity does not inherently change based on when it fired.

Answer

The color scheme of the SIEM dashboard

Answer

The time of day the alert was generated

Question 14

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Option B is correct because validating a SIEM correlation rule against historical log data in a test or staging environment confirms it detects the intended activity without generating excessive false positives before it is promoted to production. Option C is correct because mapping a use case to a specific MITRE ATT&CK technique ties the detection to a known adversary behavior, giving the rule clear scope, coverage rationale, and measurable detection value. Option A is wrong because deleting all logs after 24 hours destroys the retention needed for correlation, hunting, and forensic investigation. Option D is wrong because disabling firewall logging removes critical network telemetry that many SIEM use cases depend on. Option E is wrong because SIEM use case development requires security operations, detection engineering, or threat intelligence expertise, not marketing staff.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 15

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?

Accepted Answer

Contact the user to verify if they are traveling.. Contacting the user to verify whether they are traveling is the correct next logical action because a 'Successful login' from an unusual location is a low-fidelity indicator that could have a legitimate explanation (business travel, VPN, remote work). Verification is a non-destructive, proportionate response that confirms or denies the anomaly before escalating. This aligns with the NIST IR lifecycle's Detection and Analysis phase, where validation precedes containment.

Answer

Disable the user's account immediately.

Answer

Reformat the user's laptop.

Answer

Shut down the entire domain.