312-39 Incident Response Practice Test 3 — 15 Questions

Question 1

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

Accepted Answer

Remove the malicious file and rotate credentials. After identifying a web shell on a compromised server, the immediate priority is to remove the attacker's persistence mechanism and invalidate any credentials they may have harvested. Removing the malicious file eliminates the web shell itself, while rotating credentials ensures that any passwords, API keys, or session tokens stolen by the attacker can no longer be used. This combination addresses both the active threat and the potential for lateral movement or re-entry using compromised accounts.

Answer

Flush DNS

Answer

Restart the web service

Answer

Update the OS

Question 2

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Accepted Answer

To maintain persistent communication. The Command and Control (C2) tactic in MITRE ATT&CK describes how adversaries communicate with compromised systems to control them. Its primary goal is to establish and maintain a communication channel that allows the attacker to send commands and receive data, often using obfuscated or encrypted protocols to evade detection. This persistent communication is what enables subsequent actions like data exfiltration or lateral movement.

Answer

To escalate privileges

Answer

To steal data

Answer

To gain initial access

Question 3

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to AWS services, including S3, capturing details such as the identity of the caller, the time of the call, the source IP, and the action performed (e.g., GetObject, PutObject, DeleteBucket). Reviewing CloudTrail logs for the S3 bucket in question reveals unauthorized or suspicious API activity.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS IAM Access Analyzer

Question 4

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

Accepted Answer

WHOIS database. The WHOIS database is the correct source because it stores domain registration records including the registrar, registrant contact information, creation date, expiration date, and name servers. Querying WHOIS for a malicious domain reveals when it was registered, which helps assess whether it's a newly created domain (common in phishing/malware campaigns) or an older compromised domain.

Answer

DNSSEC database

Answer

IP Reputation database

Answer

Passive DNS database

Question 5

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

Accepted Answer

Get-SmbSession. Get-SmbSession is a PowerShell cmdlet in Windows that lists active SMB sessions on a machine, showing which clients are connected, the user account, and the number of open files. It directly answers the question of viewing active SMB sessions between workstations during a lateral movement investigation.

Answer

wmic

Answer

tasklist

Answer

ipconfig

Question 6

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Accepted Answer

To validate and scope the threat. The primary function of an IoC is to validate that a compromise has occurred and to scope its extent — confirming the threat is real and determining which systems, accounts, or network segments are affected. IoCs act as matchable artifacts that turn a suspicion into a confirmed, bounded incident, enabling targeted containment.

Answer

To communicate with law enforcement

Answer

To prevent future incidents

Answer

To manage system backups

Question 7

Which document is essential for recording every action taken during an incident for legal and audit purposes?

Accepted Answer

Incident Response Log/Journal. An Incident Response Log (or journal) is the chronological record of every action, decision, timestamp, and evidence-handling step taken during an incident. It is the primary document used for legal defensibility, audit trails, chain-of-custody, and post-incident review. Without it, an organization cannot prove due diligence or reconstruct the timeline for regulators or courts.

Answer

Change Management Request

Answer

System Configuration Document

Answer

Business Continuity Plan

Question 8

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

Accepted Answer

Comparing source IP against threat intel feeds of VPN exit nodes. Comparing the source IP against threat intelligence feeds that catalog known VPN exit nodes, Tor relays, and anonymizing proxies is the most direct attribution technique. If the IP matches a commercial VPN provider's exit range, the analyst knows the true origin is masked and can pivot to other evidence (account metadata, timing, payload artifacts). This is a standard enrichment step in SOC workflows.

Answer

Analyzing DNS queries

Answer

Checking OS version

Answer

Scanning the source IP

Question 9

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

Accepted Answer

HTTP/HTTPS proxy logs. Data exfiltration to cloud storage providers such as Dropbox, Google Drive, or OneDrive typically occurs over HTTP/HTTPS, so proxy logs capture the destination URLs, bytes transferred, user identity, and timestamps needed to detect large uploads. Proxy logs are the primary evidence source for identifying which host sent how much data to which external cloud endpoint.

Answer

DHCP logs

Answer

NTP logs

Answer

SNMP logs

Question 10

What is the primary goal of the 'Eradication' phase in incident response?

Accepted Answer

To remove the threat from the environment. The Eradication phase focuses on removing the threat from the environment — deleting malware, disabling compromised accounts, patching the exploited vulnerability, and eliminating attacker persistence mechanisms. It follows containment and precedes recovery, ensuring the adversary's foothold is fully removed before systems are restored to production.

Answer

To identify the root cause

Answer

To restore business operations

Answer

To report to stakeholders

Question 11

What is the main objective of the 'Post-Incident Activity' phase?

Accepted Answer

To identify lessons learned and improve future response. The Post-Incident Activity phase in the NIST SP 800-61 incident response lifecycle exists to review what happened, capture lessons learned, and feed improvements back into preparation, detection, and response processes. Its core output is a post-incident report and updated playbooks, not punitive or destructive actions. This is why 'identify lessons learned and improve future response' is the correct objective.

Answer

To close all firewall ports

Answer

To discipline the employee involved

Answer

To delete all evidence

Question 12

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

Accepted Answer

Use a sandboxed/isolated browser environment. Analyzing a suspicious link in a sandboxed or isolated browser environment (e.g., Cuckoo Sandbox, Joe Sandbox, Any.Run, or a dedicated VM with no network access to production) prevents any malicious payload from executing on the analyst's real workstation. It allows safe observation of redirects, drive-by downloads, and credential-harvesting pages. This is a core phishing investigation best practice.

Answer

Open the link in your local browser

Answer

Download the link contents to your desktop

Answer

Forward the email to your personal account

Question 13

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the correct answer because it allows an analyst to submit a file hash (MD5, SHA-1, or SHA-256) and instantly cross-reference it against 70+ antivirus engines, URL/domain scanners, and sandbox behavioral analysis tools in a single query. This multi-engine aggregation gives a much higher detection confidence than any single AV product, and it also returns community comments and vendor-specific verdicts. For SOC analysts verifying whether an executable is known-malicious, VirusTotal is the industry-standard first stop.

Answer

Google Search

Answer

Microsoft Update

Answer

WHOIS

Question 14

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Accepted Answer

netstat -tulnp. The command 'netstat -tulnp' lists all TCP (-t) and UDP (-u) listening (-l) sockets, shows numeric addresses (-n), and includes the process ID and program name (-p) that owns each socket. This directly maps a network socket to the rogue process, which is exactly what the analyst needs. The -p flag requires root privileges but provides the critical process-to-socket association.

Answer

top

Answer

ps aux

Answer

lsmod

Question 15

Which TWO steps are part of the 'Preparation' phase of the incident response process?

Accepted Answer

Training personnel. In the Preparation phase of incident response, organizations build the capabilities needed before an incident occurs, which includes training personnel (D) so that responders know their roles, procedures, and tools when an event happens. Developing IR policies (E) is also a Preparation activity because it establishes the governance, definitions, escalation paths, and procedural framework that guide the entire response effort. By contrast, writing the final report (A) and root cause analysis (C) occur in the post-incident/lessons-learned phase, and containment of the breach (B) belongs to the containment, eradication, and recovery phase, so none of those are Preparation steps.

Answer

Writing the final report

Answer

Containment of the breach

Answer

Root cause analysis