312-39 Multiple Select — 30 Questions

Question 1

Which THREE factors should be considered when determining the severity level of an incident?

Accepted Answer

Business impact. Severity level in incident response is driven by how much harm the incident can cause and how quickly it must be addressed, so Business impact (B) is correct because it measures the effect on operations, revenue, and services, which directly determines how severe the incident is. Data sensitivity (C) is correct because incidents involving regulated, confidential, or high-value data (e.g., PII, PHI, intellectual property) warrant a higher severity due to legal, compliance, and reputational consequences. Urgency (E) is correct because it reflects how time-critical the response is — for example, an active ransomware spread or ongoing data exfiltration demands immediate action and thus elevates severity. The analyst's mood (A) is a subjective human state and has no bearing on objective incident severity, and the day of the week (D) is irrelevant to the technical and business impact of an incident, even if staffing levels may vary.

Answer

The analyst's mood

Answer

The day of the week

Question 2

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Accepted Answer

Suspicious sender address. Option A (Suspicious sender address) is correct because phishing emails frequently use spoofed, look-alike, or mismatched domains (e.g., 'micros0ft.com' or a display name that doesn't match the actual SMTP envelope sender), which is a primary technical indicator analysts examine in email headers via SPF, DKIM, and DMARC checks. Option E (Urgent/threatening tone) is correct because social-engineering lures commonly pressure recipients with deadlines, account-suspension threats, or fear of consequences to bypass careful scrutiny and trigger immediate clicks or credential entry. Option B is not a reliable indicator since legitimate and malicious emails alike are often sent during business hours to blend in. Option C is not an indicator at all, as virtually every email has a subject line. Option D is not inherently suspicious; while CEO impersonation (BEC) occurs, mail genuinely from the CEO is normal, so the sender's authenticity must be verified rather than the title alone treated as a red flag.

Answer

The email is sent during business hours

Answer

The email has a subject line

Answer

The email is from the CEO

Question 3

Which THREE factors contribute to 'dwell time' in a security incident?

Accepted Answer

Inadequate logging visibility. Dwell time is the interval between an attacker's initial compromise and the moment the intrusion is detected, so any factor that delays detection extends it. Option A, inadequate logging visibility, is correct because without sufficient endpoint, network, and authentication logs (e.g., missing Windows Event ID 4624, DNS query logs, or EDR telemetry) defenders cannot see the malicious activity, so the breach goes unnoticed longer. Option D, insufficient automated alerting, is correct because if SIEM correlation rules, IDS/IPS signatures, or EDR detections do not fire and notify analysts in near real time, detection depends on manual review and dwell time grows. Option E, lack of threat intelligence, is correct because without IOCs, TTPs, and context from feeds such as STIX/TAXII or MITRE ATT&CK mappings, defenders are slower to recognize known adversary behavior and to hunt for it proactively. Option B, the number of coffee machines in the SOC, is irrelevant to detection timelines and is not a security control. Option C, the speed of the network, is not a direct contributor; faster links may even aid exfiltration, but they do not by themselves delay or accelerate detection of a compromise.

Answer

The number of coffee machines in the SOC

Answer

The speed of the network

Question 4

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Accepted Answer

Snapshot the persistent disk for forensics. Option B is correct because taking a snapshot of the persistent disk preserves volatile and non-volatile evidence (disk state, logs, files) for forensic analysis before any remediation destroys it, which is a standard incident-response step for a rogue VM. Option C is correct because restricting network ingress/egress rules (e.g., via VPC firewall rules or removing the VM's external IP) contains the threat by isolating the rogue VM and preventing lateral movement or data exfiltration while investigation proceeds. Option A is wrong because upgrading the OS image is a patching action that neither contains the rogue VM nor preserves evidence. Option D is wrong because increasing CPU quota is a performance change unrelated to incident response. Option E is wrong because deleting the VM immediately destroys forensic evidence and may tip off an attacker, so containment and snapshotting must come first.

Answer

Upgrade the VM's OS image

Answer

Increase the VM's CPU quota

Answer

Delete the VM immediately

Question 5

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Option B is correct because validating a SIEM correlation rule against historical log data in a test or staging environment confirms it detects the intended activity without generating excessive false positives before it is promoted to production. Option C is correct because mapping a use case to a specific MITRE ATT&CK technique ties the detection to a known adversary behavior, giving the rule clear scope, coverage rationale, and measurable detection value. Option A is wrong because deleting all logs after 24 hours destroys the retention needed for correlation, hunting, and forensic investigation. Option D is wrong because disabling firewall logging removes critical network telemetry that many SIEM use cases depend on. Option E is wrong because SIEM use case development requires security operations, detection engineering, or threat intelligence expertise, not marketing staff.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 6

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

Accepted Answer

A private executable memory region inside a legitimate process marked PAGE_EXECUTE_READWRITE. Injected code typically appears as executable private memory with write permissions inside a host process, or as a thread whose start address is outside any mapped module. Both artifacts deviate from normal process structure and are surfaced by memory forensics plugins. Signed DLLs, handle counts, and ordinary waiting threads are normal conditions and do not by themselves demonstrate injection.

Answer

A user-mode process with a single thread that is currently in a wait state

Answer

A signed Microsoft DLL loaded at its expected base address

Answer

A process with a high handle count and many open Registry keys

Question 7

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endpoint. Which TWO of the following are host-based IoCs that should be prioritized for collection and analysis? (Choose two.)

Accepted Answer

Unusual registry Run key entries that launch a binary from a user's AppData folder. Host-based IoCs include artifacts found on the endpoint, such as registry modifications, suspicious files, and process behaviors. Registry Run keys launching binaries from AppData and double-extension files in user folders are both host-based and commonly associated with malware persistence and execution. The other options describe network-based observations.

Answer

A sudden increase in outbound DNS queries to a newly registered domain

Answer

A spike in SMTP traffic from an internal mail server to an external IP

Answer

Anomalous TLS certificate presented by an external server during a connection

Question 8

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

Accepted Answer

Event ID 4769 with encryption type 0x17 (RC4) for service accounts that normally use AES.. Kerberoasting detection relies on identifying anomalous TGS requests. A user requesting multiple service tickets for different SPNs in a short window indicates enumeration, while RC4 encryption requests for accounts that normally use AES signal an attempt to obtain easily crackable tickets. Together, these behaviors provide high-fidelity detection with fewer false positives than generic logon or group-change events.

Answer

A service account being added to the Domain Admins group.

Answer

Event ID 4771 for Kerberos pre-authentication failures from a single source.

Answer

Event ID 4624 logon type 3 (network) from a workstation to a domain controller.

Question 9

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Accepted Answer

Regulatory compliance requirements (e.g., GDPR, HIPAA). Option A is correct because regulatory frameworks such as GDPR, HIPAA, PCI DSS, and SOX impose explicit minimum retention periods for audit and security logs, so the SOC must retain logs at least as long as the strictest applicable mandate requires. Option B is correct because log retention is bounded by available storage capacity; the volume of logs generated per day, combined with the retention window, determines the storage and archiving infrastructure needed, and insufficient capacity forces trade-offs such as shorter retention or tiered storage. Option C is correct because the average time to detect an incident (dwell time) defines how far back investigators must be able to look to reconstruct an intrusion; if logs are purged before the typical detection window, the SOC loses the evidence needed for detection, triage, and root-cause analysis. Option D is not relevant because the physical color of hardware chassis has no bearing on log retention policy or security requirements. Option E is not relevant because the scheduled time of day for backups affects backup operations, not the duration for which logs must be retained.

Answer

The color of the hardware chassis

Answer

The time of day the backup is scheduled

Question 10

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (A) are a classic persistence mechanism because an attacker can create a task that re-executes malware at logon, on a schedule, or at system startup, so analysts routinely enumerate them (e.g., schtasks /query or the Task Scheduler library) for suspicious entries. Registry 'Run' keys (C), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, are checked because they cause programs to launch automatically at user logon or system boot, making them a favorite autostart location for implants. Startup folders (D), both the per-user and all-users Startup directories, are also examined since any shortcut or executable placed there executes automatically when the user logs in. System memory dumps (B) are useful for live forensics such as extracting credentials or injected code, but they are not a standard persistence artifact, and Event log files (E) are examined for evidence of activity or tampering rather than being a persistence location themselves.

Answer

System memory dumps

Answer

Event log files

Question 11

A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)

Accepted Answer

Search the email gateway logs for the sender address and subject line.. To scope a phishing incident, the analyst should search email gateway logs for the sender and subject to find all recipients, and check proxy logs for connections to the malicious URL to identify users who clicked. These actions provide a comprehensive view of who was targeted and who interacted with the phishing page. Other actions like antivirus scans or password resets are remediation steps for specific users, not scoping.

Answer

Run an antivirus scan on the reporting user's workstation.

Answer

Interview the reporting user to ask who else might have received the email.

Answer

Reset the password for the reporting user's account.

Question 12

Which THREE of the following are common challenges in SIEM correlation rule development?

Accepted Answer

High rates of false positives.. Option A (High rates of false positives) is correct because correlation rules that are too broad or poorly tuned generate large volumes of benign alerts, overwhelming analysts and causing alert fatigue, which is a well-known SIEM tuning challenge. Option D (Poor log data quality) is correct because correlation depends on normalized, time-synchronized, and complete log sources; missing fields, inconsistent formats, or absent logs from key devices break rule logic and produce unreliable detections. Option E (Difficulty in finding skilled SIEM engineers) is correct because effective rule development requires expertise in query languages, log source parsing, threat detection logic, and tuning, and organizations frequently struggle to hire and retain personnel with these specialized skills. Options B (The SIEM is too colorful) and C (The SIEM is too small to fit in a rack) are not legitimate challenges in correlation rule development, as they describe superficial or physical characteristics rather than technical or operational issues affecting rule creation and accuracy.

Answer

The SIEM is too colorful.

Answer

The SIEM is too small to fit in a rack.

Question 13

Which TWO metrics are essential for measuring the efficiency of an incident response team?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) (B) is essential because it directly quantifies how quickly the incident response team detects, acknowledges, and begins mitigating incidents, making it a core efficiency indicator of response speed and effectiveness. Incident volume per analyst (E) is also essential because it measures team throughput and workload distribution, showing how many incidents each analyst handles and helping assess capacity, staffing, and productivity. The other options do not belong: emails sent to stakeholders (A) is a communication activity, not an efficiency metric; average analyst salary (C) is a cost/HR figure unrelated to response performance; and building security badge access logs (D) are physical security data, not incident response efficiency measurements.

Answer

Number of emails sent to stakeholders

Answer

Average salary of analysts

Answer

Building security badge access logs

Question 14

Which THREE actions are appropriate during the eradication phase of a malware incident?

Accepted Answer

Patching the underlying vulnerability. Patching the underlying vulnerability (A) is correct because eradication must close the initial attack vector so the malware cannot be re-introduced or re-exploited after cleanup. Scanning the network for other infected hosts (B) is correct because eradication requires identifying and removing all instances of the malware across the environment, not just on the initially discovered system. Removing malicious binaries (D) is correct because deleting the malware files, persistence mechanisms, and associated artifacts is the core action of eradicating the threat from affected systems. Adding the attacker on social media (C) is not an incident response action and could compromise the investigation or create operational security risks. Deleting the entire server (E) is a disproportionate, destructive action that would cause unnecessary data and service loss rather than targeted eradication.

Answer

Adding the attacker on social media

Answer

Deleting the entire server

Question 15

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

Accepted Answer

HKCU\Software\Classes\CLSID. Option B (HKCU\Software\Classes\CLSID) is correct because per-user COM object registrations under the Classes\CLSID hive can be hijacked or created to point to malicious DLLs, enabling persistence via COM hijacking when a legitimate application instantiates the CLSID. Option C (HKLM\System\CurrentControlSet\Services) is correct because this key stores Windows service definitions, including the ImagePath and ServiceDLL values that attackers modify or add to run malicious code as a service at boot. Option E (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is correct because Run keys are a classic autostart location whose values execute programs at user logon, a very common persistence mechanism. Option A is not a persistence location; the Nls\Language key holds locale/language configuration data. Option D is also not a persistence location; FontSubstitutes merely maps font substitution names and does not execute code.

Answer

HKLM\System\CurrentControlSet\Control\Nls\Language

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

Question 16

A SOC is implementing a new use case to detect credential dumping on Windows endpoints. The detection engineering team wants to combine multiple telemetry sources to reduce false positives and improve coverage. Which two data sources should be prioritized to reliably detect credential dumping activity? (Choose two.)

Accepted Answer

Sysmon events for process access to the LSASS process. Credential dumping detection benefits from combining process creation telemetry, which shows what executed and with what arguments, and Sysmon process access events, which show suspicious access to LSASS. Together they provide both the actor and the target, enabling high-fidelity alerts. Network, DHCP, and email logs lack the endpoint process and memory access visibility required for this specific behavior.

Answer

NetFlow records showing outbound traffic volume from the endpoint

Answer

DHCP logs showing IP address leases for the endpoint

Answer

Email gateway logs showing inbound messages with attachments

Question 17

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

Accepted Answer

Check the firewall logs for allowed outbound connections to the suspicious IP.. To validate the potential data exfiltration alert, you need to correlate network and endpoint evidence. EDR data reveals the process responsible for the connection, while firewall logs confirm if the traffic was allowed and the volume transferred. Together, they provide a clear picture of whether data left the network. Blocking, scanning, or email review are either containment or less direct investigative steps that do not immediately confirm the true positive.

Answer

Immediately block the suspicious IP address at the perimeter firewall.

Answer

Review the user's recent email activity for signs of phishing.

Answer

Run a full antivirus scan on the affected endpoint.

Question 18

Which TWO of the following are primary components of a cloud-native incident response plan?

Accepted Answer

Containment. Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61. Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Answer

Resource Provisioning

Answer

Budget Optimization

Answer

Hardware Refresh

Question 19

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Option B is correct because Chain of Custody documentation must identify the person who collected or handled the evidence, establishing accountability for every transfer and ensuring the evidence can be traced to a responsible individual. Option E is correct because the date and time of collection are essential custody metadata that establish when the evidence was seized, helping prove it was not altered or tampered with before analysis. Together, the collector's identity and the collection timestamp are core elements required to demonstrate an unbroken custody trail. Options A, C, and D are incorrect because hard drive casing color, CPU manufacturer, and system temperature are irrelevant hardware or environmental details that do not establish who handled the evidence or when it was collected.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 20

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Accepted Answer

Document the rationale for closure. Option B is correct because documenting the rationale for closing an alert as a False Positive creates an audit trail and preserves the analyst's reasoning for compliance, reporting, and future investigations. Option D is correct because a confirmed False Positive often reveals that the correlation rule's logic, thresholds, or field mappings are too broad, so tuning the rule reduces future noise and improves detection fidelity. Option A is wrong because simply ignoring an alert without formal closure leaves it in an unresolved state and breaks incident-handling workflow. Option C is wrong because deleting the original event log destroys forensic evidence and violates log retention and integrity requirements. Option E is wrong because a False Positive is a detection-tuning issue, not a licensing capacity problem, so requesting a new SIEM license does not address the root cause.

Answer

Ignore the alert without closure

Answer

Delete the original event log

Answer

Request a new SIEM license