312-39 Incident Detection And Triage Practice Test 5 — 15 Questions

Question 1

A SOC analyst receives an alert for suspicious PowerShell execution on a workstation. During triage, the analyst observes the command line: `powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. The endpoint's EDR shows the parent process as `winword.exe`. Which of the following BEST describes the immediate triage priority?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immediately isolate the workstation from the network and initiate the incident response process.. The scenario presents a classic malware execution chain: a Microsoft Word document spawning a hidden, encoded PowerShell command. This is a high-fidelity indicator of compromise, and the immediate triage priority is to contain the threat by isolating the affected workstation. Decoding the payload, tracing the email, or running antivirus scans are subsequent steps that, while important, do not address the urgent risk of an active adversary on the network.

Answer

Run a full antivirus scan on the workstation to remove the malicious payload.

Answer

Decode the Base64 string to understand the payload, then decide whether to isolate the host.

Answer

Check the user's recent email activity to identify the source of the document and then block the sender.

Question 2

A SOC analyst is triaging an alert from a Windows server indicating a new service was installed. The service binary is located in `C:\Windows\Temp\svc.exe` and runs as `LocalSystem`. The analyst checks the service creation time and sees it was created 10 minutes ago. The server's change management system shows no approved changes. Which of the following is the MOST likely explanation?

Accepted Answer

A persistence mechanism established by an attacker.. The creation of a new service with a binary in a Temp directory, running as LocalSystem, and without corresponding change management approval is highly indicative of an attacker establishing persistence. Attackers frequently use services for persistence because they can be configured to start automatically and run with high privileges. The lack of legitimate documentation and the suspicious binary location are key red flags that should prompt immediate investigation and containment.

Answer

A legitimate software installation by an administrator.

Answer

A false positive caused by a Windows update.

Answer

A scheduled task created by a known application.

Question 3

A SOC analyst is triaging a potential phishing incident. An employee reported a suspicious email with an attachment. The analyst has retrieved the email and attachment. Which TWO of the following actions are MOST appropriate during the initial triage to determine if the attachment is malicious? (Choose two.)

Accepted Answer

Open the attachment in a sandboxed environment to observe its behavior.. During initial triage of a suspicious email attachment, the analyst should focus on safe analysis methods. Submitting the hash to a threat intelligence platform provides quick reputation data without execution risk. Sandboxing the attachment allows dynamic observation of its behavior in an isolated environment. These actions help determine maliciousness while preserving evidence and avoiding infection of production systems.

Answer

Execute the attachment on the analyst's workstation to see if it triggers antivirus.

Answer

Delete the email from the user's mailbox immediately.

Answer

Forward the email to all employees as a warning.

Question 4

A SOC analyst receives a Microsoft Defender for Endpoint alert indicating a suspicious PowerShell script executed on a finance workstation. The script attempted to download a file from an external IP. The alert severity is 'High'. According to the incident detection and triage process, what should the analyst do FIRST?

Accepted Answer

Validate the alert by reviewing the script's content, parent process, and user context.. The initial step in incident detection and triage is to validate the alert by examining the script's content, parent process, and user context. This determines whether the alert is a true positive and informs subsequent actions. Validation prevents premature containment or escalation, which can disrupt operations or waste resources. Only after validation should the analyst consider containment, evidence collection, or escalation based on the confirmed threat.

Answer

Collect and preserve volatile evidence such as memory and network connections before any containment.

Answer

Escalate the alert to the incident response team immediately due to its high severity.

Answer

Immediately isolate the workstation from the network to prevent potential lateral movement.

Question 5

A SOC analyst is triaging a SIEM alert for a potential data exfiltration attempt. The alert shows a large outbound transfer to an unknown IP address from a database server. The analyst needs to determine if this is malicious or benign. Which of the following actions is MOST appropriate to perform FIRST?

Accepted Answer

Check the reputation of the destination IP using threat intelligence feeds.. The most appropriate first action is to check the reputation of the destination IP using threat intelligence. This provides immediate context on whether the IP is known for malicious activity, helping to quickly determine if the alert is a true positive. Other actions like blocking or contacting the administrator are either containment or verification steps that should follow initial validation. This approach balances speed and accuracy in triage.

Answer

Block the outbound connection at the firewall to stop the exfiltration.

Answer

Analyze the volume and frequency of the transfer compared to baseline traffic.

Answer

Contact the database administrator to ask if the transfer was authorized.

Question 6

A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)

Accepted Answer

Search the email gateway logs for the sender address and subject line.. To scope a phishing incident, the analyst should search email gateway logs for the sender and subject to find all recipients, and check proxy logs for connections to the malicious URL to identify users who clicked. These actions provide a comprehensive view of who was targeted and who interacted with the phishing page. Other actions like antivirus scans or password resets are remediation steps for specific users, not scoping.

Answer

Run an antivirus scan on the reporting user's workstation.

Answer

Interview the reporting user to ask who else might have received the email.

Answer

Reset the password for the reporting user's account.

Question 7

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

Accepted Answer

Immediately isolate the endpoint from the network and escalate to the incident response team as a potential ransomware precursor.. Shadow copy deletion executed through a suspicious parent-child process chain is a well-known ransomware precursor technique. The correct response prioritizes containment by isolating the endpoint and escalating, because the attacker is likely still active. Verifying legitimacy or waiting for scans allows the adversary to proceed with encryption or lateral movement.

Answer

Close the alert as a false positive because vssadmin is a legitimate Windows administrative utility.

Answer

Run a full antivirus scan on the endpoint and wait for the results before taking any other action.

Answer

Contact the end user by phone to ask whether they intentionally ran the command before escalating.

Question 8

A SOC analyst is investigating a potential insider threat. The SIEM generated an alert for unusual file access on a file server by a user who normally works in a different department. The analyst needs to gather more context. Which of the following is the MOST appropriate action to take?

Accepted Answer

Review the user's recent login history and accessed files to establish a pattern.. For insider threat triage, the most appropriate action is to review the user's recent login history and accessed files to establish a pattern. This helps determine if the unusual file access is part of a legitimate business need or malicious activity. Other actions like disabling the account or confronting the user are premature without validation and could have negative consequences. Context gathering is key.

Answer

Confront the user directly about the suspicious activity.

Answer

Disable the user's account immediately to prevent further access.

Answer

Check if the user has recently transferred to a new role that requires access.

Question 9

A SOC analyst receives an alert from the SIEM indicating a potential brute-force attack against a domain controller. The alert shows 20 failed logon attempts (Event ID 4625) for the user 'administrator' within 30 seconds, followed by a successful logon (Event ID 4624) from the same source IP. The analyst wants to determine if this is a true positive and prioritize the response. According to incident triage best practices, what is the MOST appropriate next step?

Accepted Answer

Check the source IP address against threat intelligence and review the account's recent activity for anomalies.. The correct approach is to validate the alert by checking the source IP and account activity. This helps determine if the successful logon is malicious or benign. Triage involves gathering evidence to make an informed decision, not immediately taking containment actions or ignoring the alert. Proper triage ensures that true positives are prioritized and false positives are dismissed efficiently.

Answer

Immediately disable the 'administrator' account to prevent further unauthorized access.

Answer

Ignore the alert because a successful logon after failures is common for users who mistype passwords.

Answer

Escalate the alert to the incident response team immediately without further analysis.

Question 10

During triage of a SIEM alert indicating multiple failed VPN authentications followed by a successful login for the same account within five minutes, the analyst must classify the event. Which classification is MOST appropriate at this stage?

Accepted Answer

Suspicious true positive requiring further investigation, because the pattern matches brute force or credential stuffing.. Repeated authentication failures immediately followed by a success is a recognized indicator of brute force or credential stuffing. The appropriate triage classification is a suspicious true positive that requires enrichment, such as checking source IP reputation and confirming with the user. Dismissing it as a typo or informational event would ignore a plausible account compromise.

Answer

Benign true positive, because the user simply mistyped their password before succeeding.

Answer

False positive, because the SIEM rule thresholds are too low and generate noise.

Answer

Informational, because successful authentication means no security impact occurred.

Question 11

A SOC analyst is triaging an alert from an endpoint detection and response (EDR) platform showing that 'rundll32.exe' loaded a DLL from the user's Downloads folder and then established an outbound connection to an unfamiliar IP on port 443. Which TWO actions should the analyst take FIRST to properly triage this alert? (Choose two.)

Accepted Answer

Retrieve the process tree and command-line arguments associated with the rundll32.exe execution.. Triage of a suspicious rundll32 execution begins with evidence collection and enrichment. Pulling the process tree and command line clarifies what was actually executed, while checking the destination IP against threat intelligence and SIEM history establishes whether the connection is malicious. Containment or remediation decisions follow once these facts are known.

Answer

Immediately reimage the endpoint to remove any potential malware before investigating further.

Answer

Submit the alert to the vulnerability management team for patch verification.

Answer

Disable the user's email account to prevent data exfiltration.

Question 12

A SOC analyst is triaging a security alert generated by the SIEM. The alert indicates that a workstation attempted to connect to a known malicious IP address on port 443. The analyst verifies that the workstation's user recently received a phishing email. Which of the following should the analyst do FIRST to contain the potential incident?

Accepted Answer

Isolate the workstation from the network.. The correct first step is to isolate the workstation. This immediately stops any ongoing malicious communication and prevents the threat from spreading. Other actions like antivirus scans or user contact are important but secondary to containment. Blocking the IP at the firewall may help but is not as thorough as isolating the endpoint. Isolation is a fundamental containment tactic in incident response.

Answer

Run a full antivirus scan on the workstation.

Answer

Block the malicious IP at the firewall.

Answer

Contact the user to ask if they opened the phishing email.

Question 13

A SOC analyst notices a spike in alerts for the same Windows event ID 4625 (failed logon) across dozens of workstations, each showing a different username and originating from the same internal server. The server is not a domain controller and has no legitimate authentication role. What does this pattern MOST likely indicate?

Accepted Answer

An attacker has compromised the server and is performing a password spray attack against user accounts across the environment.. A single internal server that is not a domain controller generating failed logons for many different usernames is characteristic of password spraying from a compromised host. The attacker likely gained a foothold and is now attempting to harvest additional credentials. The correct response is to treat the server as compromised and begin containment and forensic investigation.

Answer

A vulnerability scanner is running a credentialed scan and generating authentication failures as it tests accounts.

Answer

The domain controller is replicating bad password attempts to member workstations, causing duplicate events.

Answer

A misconfigured application on the server is repeatedly attempting to authenticate with stale service account credentials.

Question 14

A SOC analyst is triaging a SIEM alert for a possible data exfiltration. The alert triggered because a large volume of data (5 GB) was transferred from an internal database server to an external IP address over the past hour. The analyst checks the database server's logs and sees that the transfer was initiated by a scheduled backup job that normally runs at 2 AM, but it is currently 10 AM. The backup job uses a service account that has access to the database. Which of the following is the MOST likely explanation for this alert?

Accepted Answer

The service account credentials were compromised and used by an attacker to exfiltrate data.. The most likely explanation is that the service account was compromised and used for data exfiltration. The unusual timing, large data transfer, and external destination are strong indicators of malicious activity. While other explanations are possible, they are less probable without supporting evidence. The analyst should immediately investigate the service account's activity and the external IP to confirm and respond.

Answer

The database server was misconfigured and sent data to the wrong external IP.

Answer

The backup job was manually triggered by an administrator for an ad-hoc backup.

Answer

The SIEM alert is a false positive because backup jobs often transfer large amounts of data.

Question 15

A SOC analyst is reviewing a phishing alert where the user reported an email with a malicious attachment. The analyst confirms the attachment's hash matches a known malware family in the threat intelligence platform. The user states they did not open the attachment. What is the MOST appropriate triage outcome?

Accepted Answer

Classify as a suspicious true positive, verify no execution occurred on the endpoint, and search for other recipients of the same email.. A known-malicious attachment that was reportedly not opened represents a suspicious true positive rather than a confirmed compromise. The analyst should validate the non-execution claim using endpoint telemetry and hunt for other recipients to determine campaign scope. This approach keeps the investigation accurate and proportionate to the evidence.

Answer

Quarantine the user's mailbox and reset their password to prevent credential theft.

Answer

Escalate as a confirmed incident because the malicious attachment reached the user's mailbox.

Answer

Close the alert as benign because the user did not open the attachment.