312-39 Proactive Threat Detection Practice Test 1 — 15 Questions

Question 1

A SOC analyst is reviewing logs and finds that a server is attempting to connect to multiple external IPs on port 445. What is the most likely cause of this behavior, and what is the primary threat?

Accepted Answer

Lateral movement attempt using an automated exploit tool. Scanning for SMB (port 445) is a classic indicator of a worm or lateral movement activity within a network.

Answer

A misconfigured web application load balancer

Answer

Standard user traffic to a file share

Answer

Normal background updates for the operating system

Question 2

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Accepted Answer

Process access requests to lsass.exe from an unauthorized or unsigned process. Accessing the memory space of lsass.exe is the standard indicator of credential dumping tools like Mimikatz.

Answer

Failed login attempts to the local administrator account

Answer

Increased CPU usage on the Domain Controller

Answer

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

Question 3

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

Accepted Answer

The action executes a binary located in C:\Users\Public\ or C:\Windows\Temp\. Execution from non-standard directories like AppData or Temp, combined with obfuscated command-line arguments, is a primary indicator of persistence.

Answer

The task is scheduled to run every 24 hours

Answer

The task has a generic name like 'Updater'

Answer

The task is configured to run at system startup

Question 4

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

Accepted Answer

Infrastructure. The infrastructure node in the Diamond Model specifically maps the physical and logical communication channels used by the adversary.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 5

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Calculating the time delta between connections is the standard method for identifying the consistent heartbeat of C2 beacons.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 6

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Accepted Answer

Perform frequency analysis (stack counting) on the command-line arguments across the environment. Stack counting (frequency analysis) is a standard hunting method to isolate outliers in command-line execution patterns.

Answer

Enable verbose logging on all domain controllers

Answer

Run a full antivirus scan on the affected workstation

Answer

Reimage the host immediately to prevent lateral movement

Question 7

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

Accepted Answer

Create suppression rules for alerts originating from known-good internal system administration scanners. Context-aware tuning using known-good baselines is the standard industry practice for reducing noise in IDS alerts.

Answer

Update all signatures to the most restrictive settings available

Answer

Disable all low-severity alerts in the IDS management console

Answer

Set the IDS to 'Alert Only' mode for all signatures

Question 8

An organization is implementing a proactive detection strategy using the MITRE ATT&CK framework. Which phase of the implementation should the SOC prioritize to maximize detection coverage against common enterprise threats?

Accepted Answer

Map existing log sources to high-prevalence ATT&CK techniques. Mapping existing log sources to techniques allows the SOC to identify visibility gaps and prioritize intelligence collection.

Answer

Purchase every available threat intelligence feed on the market

Answer

Rewrite all existing SIEM correlation rules from scratch

Answer

Focus only on detecting the 'Command and Control' phase

Question 9

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. The mapping of threat attributes to incident severity and category is critical for automated workflow triggering.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 10

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

Accepted Answer

Implement multi-stage correlation rules that require high-confidence indicators to fire. Refining correlation rules to require multiple conditions (e.g., authentication failure followed by success) significantly improves alert fidelity.

Answer

Increase the retention period for all raw log data

Answer

Lower the threshold for all IDS alerts to catch more threats

Answer

Outsource all monitoring to a managed security provider

Question 11

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Accepted Answer

Windows Event Log - PowerShell Script Block Logging (Event ID 4104). Script Block Logging (Event ID 4104) captures the full, de-obfuscated script content, making it the gold standard for PowerShell analysis.

Answer

Disk forensic analysis of the user's browser history

Answer

Windows Security Log - Process Creation (Event ID 4688)

Answer

Network firewall traffic logs for port 5985

Question 12

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Accepted Answer

certutil.exe. Certutil.exe is frequently misused to download files or decode malicious payloads, making its use by standard users a red flag.

Answer

mspaint.exe

Answer

calc.exe

Answer

notepad.exe

Question 13

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Accepted Answer

Network traffic logs showing SMB/RDP connections between workstations. Success/Failure logs and network connection logs are essential for detecting lateral movement attempts.

Answer

System clock synchronization logs

Answer

Application logs for Microsoft Word

Answer

Browser cache logs

Question 14

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Actionable intelligence must be context-rich, relevant to the infrastructure, and integrated into existing workflows.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 15

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Identifying long-duration connections and baseline deviations in data volume are the most effective ways to spot slow exfiltration.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall