312-39 Proactive Threat Detection Practice Test 2 — 15 Questions

Question 1

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Accepted Answer

Windows Event Log - PowerShell Script Block Logging (Event ID 4104). PowerShell Script Block Logging (Event ID 4104) records the actual script block text that PowerShell executes, including de-obfuscated commands after certain decoding steps, making it the richest source for seeing what an attacker ran. This is especially valuable for fileless attacks where nothing touches disk. Event ID 4688 only shows that powershell.exe launched, not the commands inside it.

Answer

Disk forensic analysis of the user's browser history

Answer

Windows Security Log - Process Creation (Event ID 4688)

Answer

Network firewall traffic logs for port 5985

Question 2

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Accepted Answer

certutil.exe. certutil.exe is a legitimate Windows certificate utility that attackers abuse for Living off the Land techniques — downloading files (certutil -urlcache -f), decoding base64 payloads (certutil -decode), and even installing rogue certificates. Its use by a non-administrative user, especially with URL or decode flags, is highly anomalous and warrants immediate investigation.

Answer

mspaint.exe

Answer

calc.exe

Answer

notepad.exe

Question 3

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Accepted Answer

Network traffic logs showing SMB/RDP connections between workstations. Option A is correct because network traffic logs capturing SMB (TCP 445) and RDP (TCP 3389) connections between workstations directly reveal lateral movement paths, such as workstation-to-workstation SMB sessions or RDP logins that deviate from normal patterns. Option E is correct because Windows Security Log Event ID 4624 records successful logon events, including Logon Type 3 (Network, typical of SMB) and Logon Type 10 (RemoteInteractive, used by RDP), which are essential for identifying remote access to a host. Option B is not relevant since system clock synchronization logs only concern time accuracy (e.g., NTP/W32Time) and do not record access activity. Option C is not relevant because Microsoft Word application logs capture document or crash events, not remote access techniques. Option D is not relevant because browser cache logs only reflect web browsing artifacts and have no bearing on RDP or SMB lateral movement.

Answer

System clock synchronization logs

Answer

Application logs for Microsoft Word

Answer

Browser cache logs

Question 4

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Option A is correct because indicators have a limited useful lifetime; automating expiration according to the intelligence aging policy prevents stale IOCs (e.g., old malicious IPs or domains) from generating false positives and keeps detections actionable. Option C is correct because normalizing feeds into the SIEM's schema (mapping fields such as IP, hash, domain, and timestamps to a common taxonomy like STIX/TAXII or the platform's data model) makes indicators correlatable and searchable across heterogeneous sources. Option D is correct because filtering indicators irrelevant to the current technology stack (e.g., macOS malware hashes on an all-Windows estate, or unsupported protocols) reduces noise and ensures analysts focus on threats that can actually affect the environment. Option B is not appropriate because dumping raw feeds into an unindexed archive makes the data unsearchable and unusable for real-time detection, defeating the purpose of actionable intelligence. Option E is incorrect because setting an infinite TTL on IP indicators guarantees indefinite false positives, since IP addresses are frequently reassigned and threat infrastructure changes rapidly.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 5

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Option B is correct because 'Low and Slow' exfiltration deliberately keeps transfer rates small to evade volume thresholds, so establishing a statistical baseline of normal outbound traffic volumes and alerting on significant deviations (e.g., via NetFlow/IPFIX analysis or SIEM anomaly detection) exposes the subtle, sustained increase that static thresholds miss. Option C is correct because these attacks typically rely on long-lived, low-bandwidth connections (persistent TCP sessions or periodic beaconing) to external IPs, so monitoring connection duration and bytes-per-second to external addresses reveals the abnormal persistence and destination patterns characteristic of stealthy exfiltration. Option A is not effective because a whitelist of the top 1000 websites only restricts destinations and does nothing to detect small, gradual data transfers, which can also be tunneled through allowed sites. Option D is not effective because keyword scanning of outbound email targets content, not the low-volume, long-duration network behavior that defines 'Low and Slow' exfiltration. Option E is not effective because blocking all encrypted traffic is a blunt, disruptive control that neither detects exfiltration nor distinguishes malicious from legitimate TLS, and much exfiltration is itself encrypted.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall

Question 6

Which THREE actions should be taken after an indicator of compromise (IOC) is identified to ensure it is effectively used in a proactive detection program?

Accepted Answer

Configure the EDR to perform a 'Sweep' for historical occurrences of the IOC. Option A is correct because running a 'Sweep' in the EDR allows the organization to retroactively search historical endpoint telemetry for past occurrences of the IOC, which is essential for proactive detection and scoping any prior compromise. Option C is correct because validating the IOC against internal sandbox results confirms its malicious nature and reduces false positives before it is operationalized into detection logic. Option D is correct because adding the IOC to a SIEM watchlist enables real-time correlation and alerting against incoming log and event data, turning the IOC into continuous proactive monitoring. Option B is incorrect because publicly sharing an IOC on social media before internal investigation can tip off attackers, expose sensitive incident details, and is not part of a controlled detection program. Option E is incorrect because IOC age alone does not determine relevance; older IOCs can still be valuable for detecting long-dwell threats or recurring adversary infrastructure.

Answer

Share the IOC publicly on social media before internal investigation

Answer

Ignore the IOC if it is older than 30 days

Question 7

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

Accepted Answer

HKCU\Software\Classes\CLSID. Option B (HKCU\Software\Classes\CLSID) is correct because per-user COM object registrations under the Classes\CLSID hive can be hijacked or created to point to malicious DLLs, enabling persistence via COM hijacking when a legitimate application instantiates the CLSID. Option C (HKLM\System\CurrentControlSet\Services) is correct because this key stores Windows service definitions, including the ImagePath and ServiceDLL values that attackers modify or add to run malicious code as a service at boot. Option E (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is correct because Run keys are a classic autostart location whose values execute programs at user logon, a very common persistence mechanism. Option A is not a persistence location; the Nls\Language key holds locale/language configuration data. Option D is also not a persistence location; FontSubstitutes merely maps font substitution names and does not execute code.

Answer

HKLM\System\CurrentControlSet\Control\Nls\Language

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

Question 8

A SOC analyst is reviewing a threat intelligence report that lists a new C2 domain. The SIEM has no prior detection rule for this domain. Which action best uses the diamond model to proactively operationalize this intelligence for future detection?

Accepted Answer

Extract the domain and associated adversary, capability, and victim metadata to build a detection rule that correlates DNS queries with subsequent network connections.. The diamond model structures threat intelligence around adversary, infrastructure, capability, and victim, enabling analysts to pivot and build detection logic. Extracting and correlating these elements into a SIEM rule transforms a single IOC into a durable, context-aware detection that supports proactive hunting and reduces reliance on fragile indicators like IPs. This approach aligns with operationalizing intelligence for sustained visibility.

Answer

Submit the domain to a public blocklist and wait for other organizations to report activity.

Answer

Add the domain to a watchlist and manually review alerts daily.

Answer

Create a firewall block rule for the domain's IP address only.

Question 9

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

Accepted Answer

Event ID 4769 with encryption type 0x17 (RC4) for service accounts that normally use AES.. Kerberoasting detection relies on identifying anomalous TGS requests. A user requesting multiple service tickets for different SPNs in a short window indicates enumeration, while RC4 encryption requests for accounts that normally use AES signal an attempt to obtain easily crackable tickets. Together, these behaviors provide high-fidelity detection with fewer false positives than generic logon or group-change events.

Answer

A service account being added to the Domain Admins group.

Answer

Event ID 4771 for Kerberos pre-authentication failures from a single source.

Answer

Event ID 4624 logon type 3 (network) from a workstation to a domain controller.

Question 10

A SOC analyst is configuring network monitoring to detect beaconing behavior from a compromised host. Which network traffic characteristic is the most reliable indicator of C2 beaconing?

Accepted Answer

Periodic connections to the same external IP address at regular intervals with consistent packet sizes.. Beaconing is defined by automated, periodic check-ins from an infected host to a C2 server. Regular intervals and consistent packet sizes are hallmarks of this behavior, distinguishing it from normal bursty traffic. Monitoring for such patterns, often using flow data or proxy logs, allows SOC analysts to detect compromised hosts even when the C2 domain or IP is not yet known to be malicious.

Answer

A large volume of outbound traffic to multiple external IP addresses on port 443.

Answer

Inbound connections from external IP addresses to internal hosts on port 3389.

Answer

DNS queries for long, random-looking domain names with high entropy.

Question 11

A SOC analyst is performing a proactive threat hunt for data exfiltration over DNS. The environment uses a corporate DNS resolver at 10.10.10.53. Which data source should the analyst query FIRST to identify high-volume, anomalous DNS TXT queries to external domains?

Accepted Answer

DNS resolver query logs forwarded to the SIEM. DNS resolver query logs are the authoritative, indexed source for DNS query content and volume. They let the analyst aggregate TXT queries per domain and per client, which is the core signal of DNS tunneling exfiltration. Packet capture, firewall denies, and NetFlow each miss the query-level detail needed for a fast, accurate proactive hunt.

Answer

Firewall deny logs for outbound port 53

Answer

Full packet capture (PCAP) stored for the last 7 days on the core switch

Answer

NetFlow records exported from the edge router

Question 12

A SOC analyst is proactively hunting for DNS tunneling used by malware to exfiltrate data from a compromised host. The SIEM has DNS query logs from all internal resolvers. Which detection query would most effectively surface potential DNS tunneling activity?

Accepted Answer

Alert on hosts issuing an unusually high volume of DNS queries with long, high-entropy subdomain labels to a single external domain.. DNS tunneling works by encoding stolen data into subdomain labels of queries sent to an attacker-controlled authoritative server. The telltale signs are a high volume of queries to one domain and subdomains with long, random-looking labels that carry the encoded payload. Detecting these patterns proactively reveals exfiltration attempts that signature-based tools may miss.

Answer

Alert on any DNS query for a domain that is not present in the organization's approved domain allowlist.

Answer

Alert on DNS queries that use TCP instead of UDP.

Answer

Alert on any DNS query for a domain that resolves to an internal RFC1918 address.

Question 13

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The analyst wants to alert on the specific event that indicates a service ticket was requested with weak RC4 encryption for an account with a Service Principal Name. Which Windows security event ID and field combination should be used?

Accepted Answer

Event ID 4769 with Ticket Encryption Type 0x17 and a non-machine account name in the Service Name field. Kerberoasting is detected by monitoring Kerberos service ticket requests. Event ID 4769 with RC4 encryption (0x17) and a user account SPN is the signature of a tool requesting a crackable ticket. TGT events, logon events, and pre-auth failures do not capture the weak service ticket request, so they cannot reliably detect this technique.

Answer

Event ID 4771 with Failure Code 0x18 and a service account in the Client User Name field

Answer

Event ID 4624 with Logon Type 3 and a service account in the TargetUserName field

Answer

Event ID 4768 with Ticket Encryption Type 0x12 and a user account in the TargetUserName field

Question 14

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The SIEM ingests Windows Security event logs. Which event ID and condition should the analyst alert on to detect a Kerberoasting attempt?

Accepted Answer

Event ID 4769 with Ticket Encryption Type 0x17 and a service name that is not a known service account.. Kerberoasting involves requesting TGS tickets for service accounts and cracking them offline. Event 4769 records TGS requests. Attackers often request RC4 (0x17) encryption because it is easier to crack. Alerting on RC4 tickets for service accounts that are not expected to use RC4 detects the attack with fewer false positives than monitoring all TGS requests.

Answer

Event ID 4768 with Ticket Options 0x40810010 and a failed pre-authentication.

Answer

Event ID 4624 with Logon Type 3 and a source IP outside the corporate network.

Answer

Event ID 4662 with access mask 0x100 and object type indicating a user account.

Question 15

A SOC analyst is proactively hunting for unauthorized remote access tools. The analyst wants to identify hosts where a remote desktop client was used to connect to an external IP address. Which Windows artifact should the analyst examine to find the most recent outbound RDP connection targets?

Accepted Answer

Registry key HKCU\Software\Microsoft\Terminal Server Client\Servers. The Terminal Server Client Servers registry key is the client-side history of outbound RDP connections. It lists target hosts and MRU values, making it the best artifact for identifying external RDP destinations. Server-side logs and inbound logon events only show connections to the local host, not from it.

Answer

TerminalServices-RemoteConnectionManager operational log

Answer

Security event log 4624 Logon Type 10

Answer

RemoteDesktopServices-RdpCoreTS operational log