312-39 Incident Response — Timed 20 Questions

Question 1

In an IR scenario involving a compromised Microsoft 365 account, which command in the Security & Compliance PowerShell module is used to force sign-out of all active sessions?

Accepted Answer

Revoke-AzureADUserAllRefreshToken. Revoke-AzureADUserAllRefreshToken is the official command to invalidate existing refresh tokens and force re-authentication.

Answer

Clear-M365Session

Answer

Disable-Mailbox

Answer

Disconnect-ExchangeOnline

Question 2

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

Accepted Answer

ip.src == 192.168.1.50. In Wireshark display filter syntax, 'ip.src == 192.168.1.50' isolates packets whose IPv4 source address matches the suspicious host. This is the correct field name and operator for source-IP filtering. It captures only outbound traffic from that IP, which is what 'source IP' means.

Answer

ip.addr == 192.168.1.50

Answer

src.ip == 192.168.1.50

Answer

filter: 192.168.1.50

Question 3

You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?

Accepted Answer

PowerShell Script Block Logging. PowerShell Script Block Logging (Event ID 4104) captures the full text of script blocks as they execute, including deobfuscated content and command-line arguments passed to scripts. This is the required setting to see the actual PowerShell commands attackers run. It must be enabled via Group Policy or registry under the PowerShell operational log.

Answer

AppLocker

Answer

Credential Guard

Answer

Audit Process Creation

Question 4

You are auditing user access logs for a potential privilege escalation. What indicates that a user has successfully used 'runas' to switch context?

Accepted Answer

Event ID 4624 with Logon Type 9. Event ID 4624 with Logon Type 9 indicates a successful logon using the 'runas' command, which switches the user context by creating a new logon session with alternate credentials. Logon Type 9 is specifically defined as 'NewCredentials' and is used when a process is started with different credentials via runas /netonly or similar mechanisms. This is the definitive indicator that runas was used successfully.

Answer

Event ID 4670

Answer

Event ID 4625

Answer

Event ID 1102

Question 5

Which TWO types of evidence should be collected during the identification phase of an incident?

Accepted Answer

System event logs. During the identification phase of incident response, the goal is to gather volatile and non-volatile data that can confirm whether an incident has occurred and establish its scope. Option A, system event logs, is correct because logs from the OS, applications, and security tools (e.g., Windows Event Log, syslog, SIEM feeds) provide the primary timeline and indicators of compromise needed to validate and characterize the incident. Option C, disk images, is correct because forensic bit-for-bit copies of storage media preserve file system metadata, deleted files, and artifacts that support deeper analysis and evidentiary integrity during identification. The other options do not belong: employee performance reviews (B) are HR records unrelated to technical incident evidence, coffee machine logs (D) are irrelevant IoT/device telemetry with no investigative value for this scenario, and building access badges (E) are physical security records that may support a broader investigation but are not the technical evidence types collected in the identification phase.

Answer

Employee performance reviews

Answer

Coffee machine logs

Answer

Building access badges

Question 6

You are investigating a suspicious login. Which attribute in the Azure AD sign-in logs helps determine if the user successfully authenticated using MFA?

Accepted Answer

MFA Result. The MFA Result attribute in Microsoft Entra ID sign-in logs explicitly indicates whether multi-factor authentication was successfully completed, failed, or was not required. It is the direct field for determining MFA success. Other attributes provide context but not the MFA outcome.

Answer

Device ID

Answer

Risk State

Answer

Conditional Access Status

Question 7

Which TWO actions should be taken immediately upon identifying an active malware infection on a workstation?

Accepted Answer

Disable the user account associated. Option B is correct because disabling the associated user account immediately prevents the compromised credentials from being used to spread the infection, access shared resources, or move laterally across the network while the incident is being contained. Option D is correct because isolating the host from the network (e.g., unplugging the Ethernet cable or disabling the Wi-Fi adapter) stops the malware from communicating with command-and-control servers, exfiltrating data, or infecting other systems, which is the priority containment step in incident response. Option A is not appropriate because rebooting can trigger destructive payloads, destroy volatile evidence in RAM, or allow the malware to re-execute via persistence mechanisms. Option C is not appropriate because deleting the malware file alone does not remove persistence, may destroy forensic evidence, and the malware could simply be re-dropped by a remaining component. Option E is not appropriate as an immediate containment action because updating antivirus definitions is a preventive/remediation measure that does not stop an already active infection from spreading.

Answer

Reboot the machine

Answer

Delete the malware file

Answer

Update antivirus definitions

Question 8

A SOC analyst receives an alert about a suspicious process on a Windows workstation. The analyst suspects the process is malicious and wants to quickly identify its parent process and command line to understand how it was launched. Which built-in Windows tool should the analyst use to obtain this information in real time?

Accepted Answer

Process Explorer. Process Explorer provides real-time, detailed information about running processes, including parent-child relationships and command-line arguments. This allows the analyst to quickly determine how a suspicious process was launched and whether it is malicious. Other built-in tools like Task Manager or Resource Monitor lack this depth, and Event Viewer is not suited for live process inspection.

Answer

Event Viewer

Answer

Resource Monitor

Answer

Task Manager

Question 9

After containing a ransomware outbreak on a file server, the incident response team needs to determine the initial infection vector. Which artifact would BEST help identify the original dropper file?

Accepted Answer

The Windows Prefetch files in C:\Windows\Prefetch. Prefetch files are created by Windows when an application is executed, storing the executable name, path, and timestamps. They persist after the executable is deleted, making them valuable for identifying a dropper that may have been removed. In a ransomware incident, examining Prefetch for recently executed files with suspicious names or paths can reveal the initial dropper and its execution time, guiding further investigation into the infection vector.

Answer

The $MFT record for the file server's data volume

Answer

The Volume Shadow Copy snapshots of the system drive

Answer

The Windows Security event log for Event ID 4688 (process creation)

Question 10

During an incident investigation, a SOC analyst discovers that an attacker used PsExec to move laterally from a compromised workstation to a server. The analyst wants to determine the source of the PsExec execution and the account used. Which Windows artifact should the analyst examine first to identify the user account that initiated the remote service creation?

Accepted Answer

Security event log with Event ID 4648 (Explicit credential logon). Event ID 4648 records explicit credential use, which occurs when PsExec is executed with specified credentials or when a process attempts a logon using different credentials. This event includes the subject user name (the account running the process) and the target user name, making it the most direct artifact to identify the account that initiated the remote service creation. Other events like 4624 or 7045 provide context but do not link the action to a specific initiating account.

Answer

Security event log with Event ID 5145 (Detailed file share access)

Answer

System event log with Event ID 7045 (Service installation)

Answer

Security event log with Event ID 4624 (Logon Type 3)

Question 11

A SOC analyst is responding to an incident where a user's workstation is infected with malware that beacons to a command-and-control (C2) server. The analyst has isolated the workstation from the network. Which two actions should the analyst take next to contain the incident and prevent further spread? (Choose two.)

Accepted Answer

Block the C2 server's IP address and domain at the perimeter firewall.. After isolating an infected workstation, the analyst should preserve volatile evidence by capturing memory, which may contain C2 indicators and malware code. Simultaneously, blocking the identified C2 server at the perimeter firewall contains the incident by preventing further communication and spread. These two actions address both evidence preservation and containment. Reimaging, disabling accounts, or scanning domain controllers are not immediate priorities and could hinder the investigation or cause unnecessary disruption.

Answer

Disable the user's account in Active Directory.

Answer

Run a full antivirus scan on all domain controllers.

Answer

Reimage the workstation immediately to remove the malware.

Question 12

A SOC analyst is investigating a suspected data exfiltration incident involving a compromised user account. The analyst has access to proxy logs, DNS logs, and NetFlow data. Which TWO data sources would BEST help identify the exfiltration channel and destination? (Choose two.)

Accepted Answer

DNS logs showing a high volume of TXT queries to a single domain. Proxy logs reveal HTTP/S uploads to rare domains, directly showing the exfiltration channel and destination. DNS logs with anomalous TXT query volumes indicate DNS tunneling, another common exfiltration method. Together, they provide application-layer visibility that NetFlow lacks. Other sources like authentication logs and antivirus logs do not show data transfer details. Thus, proxy and DNS logs are the best choices for identifying the exfiltration channel and destination.

Answer

Windows Security event logs showing successful logons from the user account

Answer

NetFlow data showing large outbound transfers to a known cloud storage IP

Answer

Antivirus logs showing a quarantined file on the user's workstation

Question 13

A SOC analyst receives an alert about a possible ransomware infection on a file server. The analyst needs to contain the incident to prevent further encryption. Which action should the analyst take FIRST according to incident response best practices?

Accepted Answer

Isolate the file server by disabling its network interfaces. The first priority in containing a ransomware incident is to stop the spread while preserving evidence. Isolating the server by disabling its network interfaces achieves this by cutting off communication without powering down the system. This prevents the ransomware from encrypting files on other network shares and from communicating with C2 servers, while keeping memory and disk intact for forensic analysis. Other actions like running scans or shutting down may be counterproductive at this stage.

Answer

Run a full antivirus scan on the file server

Answer

Shut down the file server immediately

Answer

Disconnect the file server from the network

Question 14

A SOC analyst is performing live response on a compromised Linux server. The analyst needs to capture the current network connections and associated processes. Which command should the analyst use?

Accepted Answer

netstat -antp. The netstat -antp command is the standard tool for listing active TCP connections along with the process ID and program name. It provides a snapshot of network activity and the processes responsible, which is critical during live response to identify malicious connections. Other commands like ps and ifconfig do not map connections to processes, and while lsof can do so, netstat is more commonly used and available.

Answer

lsof -i

Answer

ifconfig -a

Answer

ps -ef

Question 15

A SOC analyst notices that the SIEM has not received any Windows event logs from a critical domain controller for the past six hours. Other servers are reporting normally. The analyst suspects the Windows Event Forwarding subscription has failed. Which Windows component should the analyst check first to verify the WEF subscription status on the domain controller?

Accepted Answer

Event Viewer under Subscriptions. Windows Event Forwarding subscriptions are managed and monitored through the Subscriptions node in Event Viewer. When logs stop arriving from a specific source, the subscription's runtime status and last heartbeat reveal whether the forwarder is failing, disabled, or misconfigured. Other tools mentioned do not expose subscription-level health, so they cannot confirm the cause of the missing logs.

Answer

Services console for the Windows Event Collector service

Answer

Performance Monitor with the Event Tracing for Windows counter set

Answer

Task Scheduler under Microsoft\Windows\EventLog

Question 16

During incident response, a SOC analyst needs to preserve volatile evidence from a compromised Windows workstation before containment. The analyst must capture the current network connections and the running processes with their command lines. Which built-in Windows tool should the analyst use to capture this information in a forensically sound manner before powering off?

Accepted Answer

PowerShell Get-CimInstance Win32_Process with Invoke-CimMethod to retrieve command lines and Get-NetTCPConnection. The analyst must capture both process command lines and network connections. PowerShell's Get-CimInstance Win32_Process provides full command-line data, while Get-NetTCPConnection maps connections to owning processes. Together they cover both evidence types without relying on deprecated tools, making them the correct approach for volatile data collection before containment.

Answer

Get-Process | Format-List *

Answer

netstat -anob

Answer

wmic process get ProcessId,CommandLine

Question 17

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Accepted Answer

Incident Review dashboard. The Incident Review dashboard in Splunk Enterprise Security is the primary triage workspace where notable events are displayed alongside their associated threat intelligence, risk scores, and MITRE ATT&CK annotations. When investigating a brute-force-then-successful-login pattern, analysts use Incident Review to see the full context of the notable event, including which ATT&CK technique (e.g., T1110 Brute Force, T1078 Valid Accounts) the correlation search mapped it to. This dashboard is purpose-built for first-responder verification and incident workflow.

Answer

Threat Intelligence dashboard

Answer

Access Anomalies dashboard

Answer

User Activity Monitoring

Question 18

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Accepted Answer

Update the Work notes with an @mention to the manager. In ServiceNow Security Incident Response (SIR), the standard way to notify a specific person such as the security manager while escalating a ticket is to add an @mention in the Work notes (or Additional comments). ServiceNow automatically sends a notification to the mentioned user, creating an auditable record on the ticket. This keeps communication within the incident record rather than in external channels.

Answer

Delete the ticket and create a new one

Answer

Manually email the manager with incident details

Answer

Change the State to 'Closed'

Question 19

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Accepted Answer

Set status to 'Closed' with resolution code 'False Positive'. The correct action is to set the ticket status to 'Closed' with a resolution code of 'False Positive'. This documents that the alert was investigated, determined to be benign, and properly resolved, preserving an audit trail and enabling future tuning. Closing with a specific resolution code also feeds metrics for false positive rates and supports continuous improvement of detection rules.

Answer

Assign it to another team to verify

Answer

Ignore the ticket and let it expire

Answer

Delete the incident

Question 20

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

Accepted Answer

Process Tree. In CrowdStrike Falcon, the Process Tree view visualizes the parent-child relationships of processes on an endpoint, letting the analyst trace the lineage of a suspicious file back to its originating parent process. This is the correct view for understanding how a detection was spawned and identifying the root process that launched it.

Answer

Host Timeline

Answer

Detection Details

Answer

Network Activity