312-39 Proactive Threat Detection — Timed 10 Questions

Question 1

A SOC analyst is reviewing logs and finds that a server is attempting to connect to multiple external IPs on port 445. What is the most likely cause of this behavior, and what is the primary threat?

Accepted Answer

Lateral movement attempt using an automated exploit tool. Scanning for SMB (port 445) is a classic indicator of a worm or lateral movement activity within a network.

Answer

A misconfigured web application load balancer

Answer

Standard user traffic to a file share

Answer

Normal background updates for the operating system

Question 2

A SOC analyst is performing proactive threat detection on a Windows environment and wants to identify malicious processes that have established network connections without corresponding disk-based executables. Which Sysinternals tool should the analyst use to correlate running processes with their network endpoints in real time?

Accepted Answer

TCPView. TCPView is specifically designed to show all active network connections and the processes that own them, making it ideal for identifying processes with network activity but no disk executable. This supports proactive detection of fileless malware and unauthorized communication. Other tools focus on different aspects such as persistence or detailed process activity, not live network mapping.

Answer

Process Monitor

Answer

Process Explorer

Answer

Autoruns

Question 3

A SOC analyst is reviewing Windows event logs to detect credential dumping attempts. The analyst focuses on events where a process requests access to the memory of lsass.exe. Which Windows event ID and log source should the analyst monitor to detect this behavior?

Accepted Answer

Event ID 4663 in the Security log. Event ID 4663 in the Security log records object access attempts, including when a process requests access to lsass.exe memory. This is critical for detecting credential dumping tools that read lsass memory. Enabling object access auditing for the lsass process is required. Other events like 4688 or 4656 provide related but less specific information, and Sysmon Event ID 10 is not a native Windows event log.

Answer

Event ID 4688 in the Security log

Answer

Event ID 4656 in the Security log

Answer

Event ID 10 in the Sysmon log

Question 4

A SOC analyst is tasked with proactively detecting data exfiltration over HTTPS. The organization uses a web proxy that logs all outbound HTTPS connections but does not perform TLS inspection. Which detection method is most effective given this constraint?

Accepted Answer

Monitor for large outbound data transfers to newly registered domains or IP addresses with no prior history.. When TLS inspection is unavailable, the SOC must rely on metadata. Large outbound transfers to new or suspicious destinations are a classic exfiltration indicator. By baselining normal upload volumes and destinations, the analyst can detect anomalies that suggest data theft, even without decrypting traffic. This approach is practical and effective for proactive detection.

Answer

Inspect the SNI field in the TLS handshake for known malicious domain names.

Answer

Analyze the size and timing of TLS records to infer the type of data being transferred.

Answer

Alert on any HTTPS connection to a cloud storage service, as these are common exfiltration channels.

Question 5

A SOC analyst is proactively hunting for signs of a compromised host communicating with a command-and-control (C2) server using domain fronting. Which TWO network traffic characteristics should the analyst prioritize to detect this technique? (Choose two.)

Accepted Answer

TLS SNI field that differs from the HTTP Host header in the same connection.. Domain fronting hides C2 traffic by making the TLS SNI appear to be a legitimate CDN domain while the HTTP Host header points to the attacker's domain. The mismatch between SNI and Host header, or between Host header and the certificate, are the most reliable network indicators. Detecting these requires visibility into both TLS and HTTP layers, often via TLS inspection or correlated proxy logs.

Answer

Repeated connections to a known CDN IP address with high upload volume.

Answer

DNS queries for the front domain resolving to multiple IP addresses.

Answer

Outbound connections to port 443 that use self-signed certificates.

Question 6

A SOC analyst is proactively hunting for evidence of pass-the-hash attacks in a Windows environment. Which two Windows Security event IDs are most relevant to detect this technique? (Choose two.)

Accepted Answer

Event ID 4624 with Logon Type 3. Pass-the-hash attacks use NTLM hashes to authenticate over the network. Event ID 4624 with Logon Type 3 captures the successful network logon, while Event ID 4776 records the credential validation using NTLM. Together, they indicate that an account authenticated via NTLM from a source workstation. While neither event alone is conclusive, their correlation, especially for administrative accounts and unusual source IPs, is a strong indicator of pass-the-hash. Other events like 4625 or 4672 are less specific to this technique.

Answer

Event ID 4648

Answer

Event ID 4625

Answer

Event ID 4672

Question 7

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Accepted Answer

Process access requests to lsass.exe from an unauthorized or unsigned process. Credential dumping tools such as Mimikatz must open a handle to lsass.exe and read its memory, where Windows caches plaintext credentials, NTLM hashes, and Kerberos tickets. EDR solutions detect this by monitoring process-access API calls (e.g., OpenProcess with PROCESS_VM_READ) targeting lsass.exe from processes that are unsigned, unexpected, or not on an allowlist. This behavioral signal is far more specific than generic system activity and directly maps to the MITRE ATT&CK technique T1003.001 (LSASS Memory).

Answer

Failed login attempts to the local administrator account

Answer

Increased CPU usage on the Domain Controller

Answer

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

Question 8

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

Accepted Answer

The action executes a binary located in C:\Users\Public\ or C:\Windows\Temp\. Legitimate software installers place binaries in Program Files, ProgramData, or vendor-specific directories, whereas malware frequently drops executables in world-writable locations like C:\Users\Public, C:\Windows\Temp, or %AppData% to evade detection and avoid needing administrative rights. A scheduled task whose action points to a binary in one of these paths is a strong persistence indicator because attackers use it to survive reboots without touching protected directories.

Answer

The task is scheduled to run every 24 hours

Answer

The task has a generic name like 'Updater'

Answer

The task is configured to run at system startup

Question 9

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

Accepted Answer

Infrastructure. The Diamond Model of Intrusion Analysis consists of four core features: Adversary, Capability, Infrastructure, and Victim. Infrastructure refers to the physical and logical communication structures (e.g., IP addresses, domain names, email addresses, command-and-control servers) that the adversary uses to deliver capabilities and maintain control. To identify how an adversary communicates with compromised hosts, the analyst must focus on the Infrastructure component, as it encompasses the channels and mechanisms enabling interaction between the adversary and the victim.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 10

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Beaconing malware typically communicates with a command-and-control (C2) server at regular intervals, resulting in low variance in the time deltas between connections. Normal user traffic is more random. Analyzing the variance (or standard deviation) of inter-connection times can reveal this periodicity, making it the most reliable statistical method.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address