312-39 Incident Response Practice Test 2 — 15 Questions

Question 1

During incident response, a SOC analyst needs to preserve volatile evidence from a compromised Windows workstation before containment. The analyst must capture the current network connections and the running processes with their command lines. Which built-in Windows tool should the analyst use to capture this information in a forensically sound manner before powering off?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PowerShell Get-CimInstance Win32_Process with Invoke-CimMethod to retrieve command lines and Get-NetTCPConnection. The analyst must capture both process command lines and network connections. PowerShell's Get-CimInstance Win32_Process provides full command-line data, while Get-NetTCPConnection maps connections to owning processes. Together they cover both evidence types without relying on deprecated tools, making them the correct approach for volatile data collection before containment.

Answer

Get-Process | Format-List *

Answer

netstat -anob

Answer

wmic process get ProcessId,CommandLine

Question 2

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Accepted Answer

Incident Review dashboard. The Incident Review dashboard in Splunk Enterprise Security is the primary triage workspace where notable events are displayed alongside their associated threat intelligence, risk scores, and MITRE ATT&CK annotations. When investigating a brute-force-then-successful-login pattern, analysts use Incident Review to see the full context of the notable event, including which ATT&CK technique (e.g., T1110 Brute Force, T1078 Valid Accounts) the correlation search mapped it to. This dashboard is purpose-built for first-responder verification and incident workflow.

Answer

Threat Intelligence dashboard

Answer

Access Anomalies dashboard

Answer

User Activity Monitoring

Question 3

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. In ServiceNow Security Incident Response (SIR), the standard way to notify a specific person such as the security manager while escalating a ticket is to add an @mention in the Work notes (or Additional comments). ServiceNow automatically sends a notification to the mentioned user, creating an auditable record on the ticket. This keeps communication within the incident record rather than in external channels.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'

Question 4

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Accepted Answer

Set status to 'Closed' with resolution code 'False Positive'. The correct action is to set the ticket status to 'Closed' with a resolution code of 'False Positive'. This documents that the alert was investigated, determined to be benign, and properly resolved, preserving an audit trail and enabling future tuning. Closing with a specific resolution code also feeds metrics for false positive rates and supports continuous improvement of detection rules.

Answer

Assign it to another team to verify

Answer

Ignore the ticket and let it expire

Answer

Delete the incident

Question 5

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Accepted Answer

Process Tree. In CrowdStrike Falcon, the Process Tree view visualizes the parent-child relationships of processes on an endpoint, letting the analyst trace the lineage of a suspicious file back to its originating parent process. This is the correct view for understanding how a detection was spawned and identifying the root process that launched it.

Answer

Host Timeline

Answer

Detection Details

Answer

Network Activity

Question 6

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

Accepted Answer

Deny egress to the specific destination IP. Denying egress to the specific destination IP is the most effective immediate containment for an external C2 callback because it blocks the outbound channel the malware uses to communicate with its controller. This directly severs the command-and-control link with minimal collateral impact.

Answer

Allow all, then log

Answer

Enable Intrusion Prevention System (IPS) in 'Alert' mode

Answer

Enable SSL Inspection

Question 7

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

Accepted Answer

Volatility. Volatility is the standard open-source memory forensics framework used to analyze RAM dumps and identify artifacts such as injected code, running processes, and network connections. When a suspicious PowerShell script may have injected malicious code into a process, volatile memory analysis with Volatility can reveal hidden or injected modules that disk-based tools would miss. Nmap, Autopsy, Wireshark, and Procmon serve different purposes and cannot perform memory forensics.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Answer

Procmon

Question 8

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

Accepted Answer

Isolate device. In Microsoft Defender for Endpoint, the 'Isolate device' action in the Device inventory dashboard cuts the endpoint off from the network while preserving the Defender communication channel, allowing the SOC to investigate and remediate without the malware communicating with its C2 or spreading laterally. This is the standard containment action for a suspected infected workstation.

Answer

Restrict application execution

Answer

Device tagging

Answer

Run antivirus scan

Question 9

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

Accepted Answer

System event logs (Event ID 4698). Windows Security event log Event ID 4698 is generated when a scheduled task is created, making it the correct artifact to identify tasks created within the last 24 hours. Filtering the Security log for 4698 and the relevant time window directly answers the hunt question.

Answer

Registry 'Run' keys

Answer

Application event logs

Answer

Security event logs (Event ID 4624)

Question 10

What is the primary purpose of a 'War Room' during a major incident?

Accepted Answer

To centralize real-time communication and coordination. A War Room centralizes real-time communication and coordination among incident responders, enabling rapid decision-making, shared situational awareness, and clear task assignment during a major incident. It is a coordination mechanism, not a storage or concealment function.

Answer

To store physical evidence

Answer

To hide the incident from the public

Answer

To conduct IT maintenance

Question 11

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

Accepted Answer

Rebooting may cause data loss in volatile memory. Disconnecting the host from the network immediately isolates the ransomware, preventing lateral movement and further encryption of shared resources. Rebooting, however, wipes volatile memory (RAM), which contains critical forensic evidence such as encryption keys, running processes, and network connections. Preserving this volatile data is essential for incident response, as it can help decrypt files or identify the attack vector. Therefore, network isolation is prioritized over rebooting to avoid losing this valuable information.

Answer

Rebooting takes too long

Answer

Rebooting resets the firewall

Answer

Rebooting alerts the attacker

Question 12

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

Accepted Answer

Memory dump, then disk image. The correct order is memory dump first, then disk image, because memory is the most volatile evidence and is lost on shutdown or reboot. Capturing RAM before touching the disk preserves running processes, network connections, encryption keys, and malware that only exists in memory. Disk imaging afterward captures the persistent state without destroying the volatile evidence.

Answer

Reboot, then memory dump

Answer

Disk image, then memory dump

Answer

Suspend, then disk image

Question 13

Which document should you reference first to determine the communication path during a high-severity security incident?

Accepted Answer

Incident Response Plan. The Incident Response Plan (IRP) is the authoritative document that defines roles, responsibilities, and communication protocols during a security incident. It explicitly outlines who to contact, escalation paths, and notification timelines for high-severity events, ensuring a coordinated response. Other documents like the Employee Handbook or Network Topology Diagram do not provide incident-specific communication procedures. The Disaster Recovery Plan focuses on restoring IT infrastructure after a disruption, not on incident communication.

Answer

Employee Handbook

Answer

Network Topology Diagram

Answer

Disaster Recovery Plan

Question 14

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

Accepted Answer

Detection and Analysis. Detection and Analysis is the correct phase because it encompasses the activities of identifying that an incident has occurred, determining its type (e.g., malware, phishing, DDoS), and assessing its scope (affected systems, data, users). This phase follows Preparation and precedes Containment, Eradication, and Recovery in the NIST SP 800-61 lifecycle.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 15

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

Accepted Answer

bytes_sent. The bytes_sent field is the correct focus because it directly quantifies the volume of data transmitted from the source to the external IP, which is the primary indicator of exfiltration volume. In Splunk, network flow logs and proxy logs typically include bytes_sent (or bytes_out) as a field representing outbound data transfer. Analyzing this field allows the analyst to identify anomalous large transfers to external IPs.

Answer

session_duration

Answer

source_port

Answer

packets_received