312-39 Incident Response Practice Test 4 — 15 Questions

Question 1

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

Accepted Answer

TXT record. TXT records are commonly associated with DNS tunneling for command and control because they can carry arbitrary text data, including encoded commands and responses, and are often allowed through firewalls. Attackers abuse TXT records to exfiltrate data or receive instructions from a C2 server by encoding payloads in the record's text field. This makes TXT a preferred record type for DNS tunneling.

Answer

A record

Answer

CNAME record

Answer

MX record

Question 2

A ticket is assigned to you with high priority. What is the first thing you should do?

Accepted Answer

Verify the alert and scope the incident. The first step in incident response is always to verify that the alert is genuine and to determine the scope of the incident. This prevents wasted effort on false positives and ensures the response is proportionate to the actual threat. Only after verification and scoping should escalation, containment, or communication actions be taken.

Answer

Call the CISO

Answer

Isolate the host immediately

Answer

Email the user

Question 3

Which TWO pieces of information are critical to include in an initial incident ticket?

Accepted Answer

Affected systems/users. Option A, affected systems/users, is correct because an initial incident ticket must scope the blast radius—identifying which hosts, applications, or user accounts are impacted so responders can prioritize containment and assess business impact. Option D, source of the alert, is correct because documenting where the detection originated (e.g., SIEM correlation rule, EDR alert, IDS signature, or user report) establishes the evidence trail and helps analysts validate the finding and tune detection logic. The remaining options do not belong: the analyst's salary (B) is irrelevant HR data, the server rack color (C) is a physical detail with no bearing on triage, and the CEO's name (E) is not needed unless they are specifically an affected user or stakeholder, which the option does not state.

Answer

The salary of the analyst

Answer

The color of the server rack

Answer

Name of the CEO

Question 4

Which TWO methods are commonly used to achieve persistence on a Windows host?

Accepted Answer

Registry Run keys. Registry Run keys (option C) are a classic Windows persistence mechanism: entries placed under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run are automatically executed at user logon or system startup, allowing malware to survive reboots. Scheduled tasks (option E) provide persistence via the Task Scheduler service, where a task configured with a logon or startup trigger (or schtasks /create) re-launches the payload automatically, even across reboots. The remaining options do not establish persistence: changing the desktop wallpaper (A) is only a cosmetic modification, clearing the browser cache (B) is a cleanup action that removes data rather than maintaining execution, and disabling the firewall (D) weakens defenses but does not by itself ensure a program runs again after restart.

Answer

Changing the desktop wallpaper

Answer

Clearing browser cache

Answer

Disabling the firewall

Question 5

Which TWO types of logs are most useful for detecting lateral movement?

Accepted Answer

Windows Event Log (Logon events). Windows Event Log logon events (Option C) are correct because lateral movement typically involves remote authentication, so Security log events such as 4624 (successful logon) with Logon Type 3 (network) or Type 10 (RemoteInteractive/RDP), plus 4625 failures and 4648 explicit-credential logons, reveal attacker pivoting between hosts. Network flow logs for SMB/RDP (Option D) are correct because lateral movement commonly uses TCP 445 (SMB) and TCP 3389 (RDP), and flow records showing internal host-to-host connections to these ports expose the movement path even when endpoint logging is incomplete. Option A (system temperature logs) is irrelevant because thermal data reflects hardware health, not authentication or connection activity. Option B (application logs) can occasionally show exploitation or service abuse but are not primarily designed to record logon or network-session evidence of lateral movement. Option E (printer spooler logs) relates to print jobs and the PrintNightmare vector at most, not to the authentication and connection patterns that characterize lateral movement.

Answer

System temperature logs

Answer

Application log

Answer

Printer spooler logs

Question 6

Which THREE factors should be considered when determining the severity level of an incident?

Accepted Answer

Business impact. Severity level in incident response is driven by how much harm the incident can cause and how quickly it must be addressed, so Business impact (B) is correct because it measures the effect on operations, revenue, and services, which directly determines how severe the incident is. Data sensitivity (C) is correct because incidents involving regulated, confidential, or high-value data (e.g., PII, PHI, intellectual property) warrant a higher severity due to legal, compliance, and reputational consequences. Urgency (E) is correct because it reflects how time-critical the response is — for example, an active ransomware spread or ongoing data exfiltration demands immediate action and thus elevates severity. The analyst's mood (A) is a subjective human state and has no bearing on objective incident severity, and the day of the week (D) is irrelevant to the technical and business impact of an incident, even if staffing levels may vary.

Answer

The analyst's mood

Answer

The day of the week

Question 7

Which THREE items should be included in a standard incident containment report?

Accepted Answer

Current status of affected hosts. Option A is correct because a containment report must document the current status of affected hosts (e.g., isolated, powered off, reimaged, or still active) so responders and management know the present state of the environment. Option B is correct because timestamping containment actions establishes an accurate chronological timeline, which is essential for auditing, legal chain-of-custody, and post-incident review. Option E is correct because recording the technical methods used for containment (such as disabling a switch port, applying an EDR network-isolation policy, blocking an IP at the firewall, or revoking credentials) lets others verify, reproduce, or reverse the actions taken. Option C is not included because an analyst's home address is personal data irrelevant to incident containment. Option D is not included because employee payroll details are unrelated to containment and would introduce unnecessary privacy and compliance risk.

Answer

The analyst's home address

Answer

Employee payroll details

Question 8

Which TWO items are part of the 'Lessons Learned' process?

Accepted Answer

Identifying what went well. The 'Lessons Learned' process is a post-incident review activity whose goal is to improve future response, so option C ('Identifying what went well') is correct because documenting successful actions, effective tools, and good decisions preserves institutional knowledge that can be repeated in future incidents. Option E ('Identifying process improvements') is also correct because the review must produce actionable recommendations—such as updating playbooks, tuning detection rules, or closing control gaps—to prevent recurrence or reduce impact. Options A, B, and D do not belong: firing an employee is a punitive HR action rather than a constructive review outcome, changing a building security code is a specific physical-security remediation that may or may not result from a review but is not itself part of the Lessons Learned process, and buying snacks is unrelated to incident analysis or improvement.

Answer

Firing the employee who made the mistake

Answer

Changing the building security code

Answer

Purchasing new snacks for the SOC

Question 9

Which THREE tools are typically used for forensic memory analysis?

Accepted Answer

Volatility. Volatility (A) is the canonical open-source framework for parsing RAM captures, using profiles/symbol tables to extract processes, network connections, and injected code from memory images. Rekall (C) is a memory forensics framework derived from Volatility that provides similar plugins for analyzing physical memory dumps and live memory. MemProcFS (D) is a memory forensics tool that exposes a RAM dump as a virtual file system, enabling direct inspection of processes, drivers, and registry hives in memory. Nmap (B) is a network port scanner used for host discovery and service enumeration, not memory analysis, and Wireshark (E) is a packet capture/analysis tool for network traffic, so neither operates on memory images.

Answer

Nmap

Answer

Wireshark

Question 10

Which THREE actions are appropriate during the eradication phase of a malware incident?

Accepted Answer

Patching the underlying vulnerability. Patching the underlying vulnerability (A) is correct because eradication must close the initial attack vector so the malware cannot be re-introduced or re-exploited after cleanup. Scanning the network for other infected hosts (B) is correct because eradication requires identifying and removing all instances of the malware across the environment, not just on the initially discovered system. Removing malicious binaries (D) is correct because deleting the malware files, persistence mechanisms, and associated artifacts is the core action of eradicating the threat from affected systems. Adding the attacker on social media (C) is not an incident response action and could compromise the investigation or create operational security risks. Deleting the entire server (E) is a disproportionate, destructive action that would cause unnecessary data and service loss rather than targeted eradication.

Answer

Adding the attacker on social media

Answer

Deleting the entire server

Question 11

Which THREE factors contribute to 'dwell time' in a security incident?

Accepted Answer

Inadequate logging visibility. Dwell time is the interval between an attacker's initial compromise and the moment the intrusion is detected, so any factor that delays detection extends it. Option A, inadequate logging visibility, is correct because without sufficient endpoint, network, and authentication logs (e.g., missing Windows Event ID 4624, DNS query logs, or EDR telemetry) defenders cannot see the malicious activity, so the breach goes unnoticed longer. Option D, insufficient automated alerting, is correct because if SIEM correlation rules, IDS/IPS signatures, or EDR detections do not fire and notify analysts in near real time, detection depends on manual review and dwell time grows. Option E, lack of threat intelligence, is correct because without IOCs, TTPs, and context from feeds such as STIX/TAXII or MITRE ATT&CK mappings, defenders are slower to recognize known adversary behavior and to hunt for it proactively. Option B, the number of coffee machines in the SOC, is irrelevant to detection timelines and is not a security control. Option C, the speed of the network, is not a direct contributor; faster links may even aid exfiltration, but they do not by themselves delay or accelerate detection of a compromise.

Answer

The number of coffee machines in the SOC

Answer

The speed of the network

Question 12

Which THREE elements are essential in an incident notification email to senior management?

Accepted Answer

Business impact assessment. A is correct because a business impact assessment tells senior management how the incident affects operations, revenue, customers, or compliance, which is the primary concern for executive decision-making. C is correct because a high-level summary gives leadership a concise, non-technical understanding of what happened, when it was detected, and its current status without overwhelming them with operational detail. E is correct because expected next steps and a timeline set expectations for containment, eradication, recovery, and communication, enabling management to allocate resources and manage stakeholder messaging. B is not appropriate because the attacker's personal phone number is irrelevant, likely unavailable, and not actionable for management. D is not appropriate because a full raw packet dump is highly technical, voluminous, and belongs in forensic evidence handling rather than an executive notification email.

Answer

The personal phone number of the attacker

Answer

The full raw packet dump

Question 13

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Accepted Answer

Suspicious sender address. Option A (Suspicious sender address) is correct because phishing emails frequently use spoofed, look-alike, or mismatched domains (e.g., 'micros0ft.com' or a display name that doesn't match the actual SMTP envelope sender), which is a primary technical indicator analysts examine in email headers via SPF, DKIM, and DMARC checks. Option E (Urgent/threatening tone) is correct because social-engineering lures commonly pressure recipients with deadlines, account-suspension threats, or fear of consequences to bypass careful scrutiny and trigger immediate clicks or credential entry. Option B is not a reliable indicator since legitimate and malicious emails alike are often sent during business hours to blend in. Option C is not an indicator at all, as virtually every email has a subject line. Option D is not inherently suspicious; while CEO impersonation (BEC) occurs, mail genuinely from the CEO is normal, so the sender's authenticity must be verified rather than the title alone treated as a red flag.

Answer

The email is sent during business hours

Answer

The email has a subject line

Answer

The email is from the CEO

Question 14

Which THREE actions are part of the 'Recovery' phase?

Accepted Answer

Monitoring for reinfection. The 'Recovery' phase of incident response focuses on returning affected systems to normal operation safely after the threat has been contained and eradicated. Option D (Restoring from clean backups) is correct because recovery commonly involves rebuilding or restoring systems from known-good backups that are free of the attacker's artifacts. Option E (Validating system integrity) is correct because before returning systems to production, analysts must verify that no malicious code, unauthorized changes, or persistence mechanisms remain. Option A (Monitoring for reinfection) is correct because after restoration, heightened monitoring confirms the threat has not returned and that recovery was successful. Option B (Increasing the analyst's pay) is incorrect because compensation is an HR matter, not an incident response recovery action. Option C (Deleting the original ticket) is incorrect because incident documentation and tickets must be retained for auditing, lessons learned, and legal purposes, not deleted during recovery.

Answer

Increasing the analyst's pay

Answer

Deleting the original ticket

Question 15

During an incident response engagement, a SOC analyst needs to acquire volatile memory from a running Windows 10 endpoint before isolating it from the network. The analyst must ensure the memory image is forensically sound and preserves the order of volatility. Which of the following should the analyst do FIRST?

Accepted Answer

Capture the contents of physical memory using a validated tool such as WinPmem or Magnet RAM Capture. The order of volatility dictates that the most perishable evidence, such as physical memory, be collected first. Capturing RAM with a validated tool preserves critical artifacts like running processes, network connections, and encryption keys before any containment or remediation alters the system. Other actions, such as network isolation or antivirus scanning, change system state and can destroy volatile evidence, so they must be performed after memory acquisition.

Answer

Create a forensic disk image of the system drive, then extract memory from the image

Answer

Disconnect the endpoint from the network to prevent lateral movement, then acquire memory

Answer

Run a full antivirus scan to identify the malware, then capture memory