312-39 Incident Response — 10 Questions

Question 1

In an IR scenario involving a compromised Microsoft 365 account, which command in the Security & Compliance PowerShell module is used to force sign-out of all active sessions?

Accepted Answer

Revoke-AzureADUserAllRefreshToken. Revoke-AzureADUserAllRefreshToken is the official command to invalidate existing refresh tokens and force re-authentication.

Answer

Clear-M365Session

Answer

Disable-Mailbox

Answer

Disconnect-ExchangeOnline

Question 2

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Accepted Answer

Incident Review dashboard. The Incident Review dashboard allows analysts to view the MITRE ATT&CK tactics and techniques associated with notable events.

Answer

Threat Intelligence dashboard

Answer

Access Anomalies dashboard

Answer

User Activity Monitoring

Question 3

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. Updating the 'Assigned to' or 'Assignment group' fields while using the 'Work notes' to trigger a business rule notification is the standard workflow.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'

Question 4

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Accepted Answer

Set status to 'Closed' with resolution code 'False Positive'. Closing the ticket as 'False Positive' with a mandatory comment ensures the audit trail reflects why the alert was dismissed.

Answer

Assign it to another team to verify

Answer

Ignore the ticket and let it expire

Answer

Delete the incident

Question 5

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Accepted Answer

Process Tree. The Process Tree in CrowdStrike Falcon visualizes the genealogy of the process that triggered the detection.

Answer

Host Timeline

Answer

Detection Details

Answer

Network Activity

Question 6

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

Accepted Answer

Deny egress to the specific destination IP. Blocking the egress connection to the specific malicious IP at the perimeter firewall is the fastest way to stop C2 communication.

Answer

Allow all, then log

Answer

Enable Intrusion Prevention System (IPS) in 'Alert' mode

Answer

Enable SSL Inspection

Question 7

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

Accepted Answer

Volatility. Volatility is the industry-standard tool for memory forensics and analysis of injected code.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Answer

Procmon

Question 8

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

Accepted Answer

Isolate device. Isolate device stops network traffic to the host while keeping the communication with the Microsoft Defender for Endpoint service open.

Answer

Restrict application execution

Answer

Device tagging

Answer

Run antivirus scan

Question 9

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

Accepted Answer

System event logs (Event ID 4698). The Task Scheduler event logs, specifically Event ID 4698, document the creation of scheduled tasks.

Answer

Registry 'Run' keys

Answer

Application event logs

Answer

Security event logs (Event ID 4624)

Question 10

What is the primary purpose of a 'War Room' during a major incident?

Accepted Answer

To centralize real-time communication and coordination. To centralize communication, expedite decision-making, and coordinate response efforts among stakeholders.

Answer

To store physical evidence

Answer

To hide the incident from the public

Answer

To conduct IT maintenance