312-39 Proactive Threat Detection — 10 Questions

Question 1

A SOC analyst is reviewing logs and finds that a server is attempting to connect to multiple external IPs on port 445. What is the most likely cause of this behavior, and what is the primary threat?

Accepted Answer

Lateral movement attempt using an automated exploit tool. Scanning for SMB (port 445) is a classic indicator of a worm or lateral movement activity within a network.

Answer

A misconfigured web application load balancer

Answer

Standard user traffic to a file share

Answer

Normal background updates for the operating system

Question 2

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Accepted Answer

Process access requests to lsass.exe from an unauthorized or unsigned process. Accessing the memory space of lsass.exe is the standard indicator of credential dumping tools like Mimikatz.

Answer

Failed login attempts to the local administrator account

Answer

Increased CPU usage on the Domain Controller

Answer

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

Question 3

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

Accepted Answer

The action executes a binary located in C:\Users\Public\ or C:\Windows\Temp\. Execution from non-standard directories like AppData or Temp, combined with obfuscated command-line arguments, is a primary indicator of persistence.

Answer

The task is scheduled to run every 24 hours

Answer

The task has a generic name like 'Updater'

Answer

The task is configured to run at system startup

Question 4

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

Accepted Answer

Infrastructure. The infrastructure node in the Diamond Model specifically maps the physical and logical communication channels used by the adversary.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 5

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Calculating the time delta between connections is the standard method for identifying the consistent heartbeat of C2 beacons.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 6

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Accepted Answer

Perform frequency analysis (stack counting) on the command-line arguments across the environment. Stack counting (frequency analysis) is a standard hunting method to isolate outliers in command-line execution patterns.

Answer

Enable verbose logging on all domain controllers

Answer

Run a full antivirus scan on the affected workstation

Answer

Reimage the host immediately to prevent lateral movement

Question 7

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

Accepted Answer

Create suppression rules for alerts originating from known-good internal system administration scanners. Context-aware tuning using known-good baselines is the standard industry practice for reducing noise in IDS alerts.

Answer

Update all signatures to the most restrictive settings available

Answer

Disable all low-severity alerts in the IDS management console

Answer

Set the IDS to 'Alert Only' mode for all signatures

Question 8

An organization is implementing a proactive detection strategy using the MITRE ATT&CK framework. Which phase of the implementation should the SOC prioritize to maximize detection coverage against common enterprise threats?

Accepted Answer

Map existing log sources to high-prevalence ATT&CK techniques. Mapping existing log sources to techniques allows the SOC to identify visibility gaps and prioritize intelligence collection.

Answer

Purchase every available threat intelligence feed on the market

Answer

Rewrite all existing SIEM correlation rules from scratch

Answer

Focus only on detecting the 'Command and Control' phase

Question 9

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. The mapping of threat attributes to incident severity and category is critical for automated workflow triggering.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 10

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

Accepted Answer

Implement multi-stage correlation rules that require high-confidence indicators to fire. Refining correlation rules to require multiple conditions (e.g., authentication failure followed by success) significantly improves alert fidelity.

Answer

Increase the retention period for all raw log data

Answer

Lower the threshold for all IDS alerts to catch more threats

Answer

Outsource all monitoring to a managed security provider