312-39 Multiple Select — 50 Questions

Question 1

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Accepted Answer

Windows Scheduled Tasks. Persistence often relies on modifying startup folders, registry keys, or scheduled tasks.

Answer

Network interface throughput

Answer

Browser history logs

Question 2

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Accepted Answer

Increased DNS request volume (DNS Tunneling). Exfiltration is characterized by large, anomalous outbound transfers and the use of unusual protocols.

Answer

Multiple failed login attempts

Answer

System clock synchronization errors

Answer

Installation of new system drivers

Question 3

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Accepted Answer

Suspicious sender address. Unusual sender addresses and urgent language are classic phishing indicators.

Answer

The email is sent during business hours

Answer

The email has a subject line

Answer

The email is from the CEO

Question 4

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Actionable intelligence must be context-rich, relevant to the infrastructure, and integrated into existing workflows.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 5

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Identifying long-duration connections and baseline deviations in data volume are the most effective ways to spot slow exfiltration.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall

Question 6

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Triage involves verification, context gathering, and determining impact.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 7

Which TWO of the following are key components of a successful SIEM use case development process?

Accepted Answer

Testing the rule against historical data before moving to production.. Aligning to threat frameworks (like MITRE ATT&CK) and testing against historical data are the pillars of effective use case engineering.

Answer

Automating the deletion of all logs after 24 hours.

Answer

Disabling all firewall logging to save disk space.

Answer

Assigning the development task to the marketing team.

Question 8

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Accepted Answer

Implement baseline behavioral profiling for users and entities.. Baseline behavioral profiling and using multiple conditions (cross-correlation) help reduce noise by ensuring that only significant deviations trigger an alert.

Answer

Set the alert severity to 'Low' for all rules.

Answer

Avoid using 'Time Window' constraints in rules.

Answer

Include only a single condition in the rule logic.

Question 9

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Accepted Answer

Number of affected systems. Business criticality, threat intelligence context, and the number of affected hosts are fundamental metrics for determining the priority of an incident.

Answer

The color scheme of the SIEM dashboard

Answer

The time of day the alert was generated

Question 10

Which THREE factors contribute to 'dwell time' in a security incident?

Accepted Answer

Inadequate logging visibility. Dwell time is the duration between the start of an intrusion and its detection.

Answer

The number of coffee machines in the SOC

Answer

The speed of the network

Question 11

Which TWO factors are most critical when calculating the ROI of a SOC?

Accepted Answer

Cost of potential data breach incidents. ROI in a SOC is calculated by comparing the reduction in risk (potential cost of breach) and the operational costs (tools/personnel).

Answer

Number of social media followers

Answer

Office space square footage

Answer

Number of coffee machines in the SOC

Question 12

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Accepted Answer

Modification of CloudTrail or logging configurations. Unauthorized changes to IAM policies, disabling of logging services, and unexpected creation of resources in unfamiliar regions are top indicators of compromise.

Answer

Increased usage of free-tier services

Answer

Standard scheduled system reboots

Question 13

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Accepted Answer

Enable global service events. Enabling global service events and log file integrity ensure that all actions are captured and that logs remain tamper-proof.

Answer

Disable SNS notifications

Answer

Limit logs to one region

Answer

Encrypt logs with a public key

Question 14

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

Accepted Answer

Newly created service name. Host-based IoCs are artifacts found on the endpoint itself, such as files, registry changes, or running processes.

Answer

SMTP server response codes

Answer

Malicious URL visited

Answer

Source IP address of an attack

Question 15

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Recording the exact time of collection and the identity of the person collecting it are fundamental requirements for chain of custody.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 16

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Accepted Answer

Obtaining instructions from the threat actor. C2 allows the attacker to maintain access and send instructions to the compromised host.

Answer

Exploiting a zero-day vulnerability

Answer

Gathering system information

Answer

Encrypting files for ransom

Question 17

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Accepted Answer

Active network connections. Volatile data is lost when power is removed, making it the highest priority for collection.

Answer

Browser history files

Answer

Registry hive files on disk

Answer

Hard drive partition table

Question 18

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis focuses on file properties, strings, and structural headers to identify potential malicious intent without execution.

Answer

Memory usage patterns

Answer

Network latency to the server

Question 19

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Accepted Answer

Implementing Risk-Based Alerting (RBA).. Tuning thresholds and using risk-based alerting are key strategies.

Answer

Disabling all alerts during off-hours.

Answer

Using wildcard searches for all rules.

Answer

Increasing log retention to 10 years.

Question 20

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Accepted Answer

Dynamic analysis requires a sandbox or isolated environment. Static analysis examines code without executing it, while dynamic analysis observes behavior during execution.

Answer

Static analysis is always faster than dynamic analysis

Answer

Static analysis cannot identify malicious intent

Answer

Dynamic analysis is only used for Linux systems