312-39 Proactive Threat Detection — Timed 20 Questions

Question 1

A SOC analyst is reviewing logs and finds that a server is attempting to connect to multiple external IPs on port 445. What is the most likely cause of this behavior, and what is the primary threat?

Accepted Answer

Lateral movement attempt using an automated exploit tool. Scanning for SMB (port 445) is a classic indicator of a worm or lateral movement activity within a network.

Answer

A misconfigured web application load balancer

Answer

Standard user traffic to a file share

Answer

Normal background updates for the operating system

Question 2

A SOC analyst is performing proactive threat detection on a Windows environment and wants to identify malicious processes that have established network connections without corresponding disk-based executables. Which Sysinternals tool should the analyst use to correlate running processes with their network endpoints in real time?

Accepted Answer

TCPView. TCPView is specifically designed to show all active network connections and the processes that own them, making it ideal for identifying processes with network activity but no disk executable. This supports proactive detection of fileless malware and unauthorized communication. Other tools focus on different aspects such as persistence or detailed process activity, not live network mapping.

Answer

Process Monitor

Answer

Process Explorer

Answer

Autoruns

Question 3

A SOC analyst is reviewing Windows event logs to detect credential dumping attempts. The analyst focuses on events where a process requests access to the memory of lsass.exe. Which Windows event ID and log source should the analyst monitor to detect this behavior?

Accepted Answer

Event ID 4663 in the Security log. Event ID 4663 in the Security log records object access attempts, including when a process requests access to lsass.exe memory. This is critical for detecting credential dumping tools that read lsass memory. Enabling object access auditing for the lsass process is required. Other events like 4688 or 4656 provide related but less specific information, and Sysmon Event ID 10 is not a native Windows event log.

Answer

Event ID 4688 in the Security log

Answer

Event ID 4656 in the Security log

Answer

Event ID 10 in the Sysmon log

Question 4

A SOC analyst is tasked with proactively detecting data exfiltration over HTTPS. The organization uses a web proxy that logs all outbound HTTPS connections but does not perform TLS inspection. Which detection method is most effective given this constraint?

Accepted Answer

Monitor for large outbound data transfers to newly registered domains or IP addresses with no prior history.. When TLS inspection is unavailable, the SOC must rely on metadata. Large outbound transfers to new or suspicious destinations are a classic exfiltration indicator. By baselining normal upload volumes and destinations, the analyst can detect anomalies that suggest data theft, even without decrypting traffic. This approach is practical and effective for proactive detection.

Answer

Inspect the SNI field in the TLS handshake for known malicious domain names.

Answer

Analyze the size and timing of TLS records to infer the type of data being transferred.

Answer

Alert on any HTTPS connection to a cloud storage service, as these are common exfiltration channels.

Question 5

A SOC analyst is proactively hunting for signs of a compromised host communicating with a command-and-control (C2) server using domain fronting. Which TWO network traffic characteristics should the analyst prioritize to detect this technique? (Choose two.)

Accepted Answer

TLS SNI field that differs from the HTTP Host header in the same connection.. Domain fronting hides C2 traffic by making the TLS SNI appear to be a legitimate CDN domain while the HTTP Host header points to the attacker's domain. The mismatch between SNI and Host header, or between Host header and the certificate, are the most reliable network indicators. Detecting these requires visibility into both TLS and HTTP layers, often via TLS inspection or correlated proxy logs.

Answer

Repeated connections to a known CDN IP address with high upload volume.

Answer

DNS queries for the front domain resolving to multiple IP addresses.

Answer

Outbound connections to port 443 that use self-signed certificates.

Question 6

A SOC analyst is proactively hunting for evidence of pass-the-hash attacks in a Windows environment. Which two Windows Security event IDs are most relevant to detect this technique? (Choose two.)

Accepted Answer

Event ID 4624 with Logon Type 3. Pass-the-hash attacks use NTLM hashes to authenticate over the network. Event ID 4624 with Logon Type 3 captures the successful network logon, while Event ID 4776 records the credential validation using NTLM. Together, they indicate that an account authenticated via NTLM from a source workstation. While neither event alone is conclusive, their correlation, especially for administrative accounts and unusual source IPs, is a strong indicator of pass-the-hash. Other events like 4625 or 4672 are less specific to this technique.

Answer

Event ID 4648

Answer

Event ID 4625

Answer

Event ID 4672

Question 7

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

Accepted Answer

Process access requests to lsass.exe from an unauthorized or unsigned process. Credential dumping tools such as Mimikatz must open a handle to lsass.exe and read its memory, where Windows caches plaintext credentials, NTLM hashes, and Kerberos tickets. EDR solutions detect this by monitoring process-access API calls (e.g., OpenProcess with PROCESS_VM_READ) targeting lsass.exe from processes that are unsigned, unexpected, or not on an allowlist. This behavioral signal is far more specific than generic system activity and directly maps to the MITRE ATT&CK technique T1003.001 (LSASS Memory).

Answer

Failed login attempts to the local administrator account

Answer

Increased CPU usage on the Domain Controller

Answer

Modification of registry keys in HKEY_LOCAL_MACHINE\SYSTEM

Question 8

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

Accepted Answer

The action executes a binary located in C:\Users\Public\ or C:\Windows\Temp\. Legitimate software installers place binaries in Program Files, ProgramData, or vendor-specific directories, whereas malware frequently drops executables in world-writable locations like C:\Users\Public, C:\Windows\Temp, or %AppData% to evade detection and avoid needing administrative rights. A scheduled task whose action points to a binary in one of these paths is a strong persistence indicator because attackers use it to survive reboots without touching protected directories.

Answer

The task is scheduled to run every 24 hours

Answer

The task has a generic name like 'Updater'

Answer

The task is configured to run at system startup

Question 9

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

Accepted Answer

Infrastructure. The Diamond Model of Intrusion Analysis consists of four core features: Adversary, Capability, Infrastructure, and Victim. Infrastructure refers to the physical and logical communication structures (e.g., IP addresses, domain names, email addresses, command-and-control servers) that the adversary uses to deliver capabilities and maintain control. To identify how an adversary communicates with compromised hosts, the analyst must focus on the Infrastructure component, as it encompasses the channels and mechanisms enabling interaction between the adversary and the victim.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 10

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

Accepted Answer

Analyze the variance in the time delta between consecutive connections to the destination IP. Beaconing malware typically communicates with a command-and-control (C2) server at regular intervals, resulting in low variance in the time deltas between connections. Normal user traffic is more random. Analyzing the variance (or standard deviation) of inter-connection times can reveal this periodicity, making it the most reliable statistical method.

Answer

Check the destination IP against a reputation database

Answer

Compare the total volume of data sent to the IP against a global average

Answer

Perform a DNS lookup on the destination IP address

Question 11

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Accepted Answer

Perform frequency analysis (stack counting) on the command-line arguments across the environment. Frequency analysis (stack counting) on command-line arguments across the environment reveals whether the encoded PowerShell pattern is rare and anomalous or common and benign. Legitimate admin scripts tend to recur across many hosts with similar arguments, while malicious encoded commands often appear once or in small clusters. This technique is a core threat-hunting method for triaging suspicious command lines.

Answer

Enable verbose logging on all domain controllers

Answer

Run a full antivirus scan on the affected workstation

Answer

Reimage the host immediately to prevent lateral movement

Question 12

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

Accepted Answer

Create suppression rules for alerts originating from known-good internal system administration scanners. Suppression rules scoped to known-good internal scanners eliminate the predictable, high-volume false positives those tools generate without weakening detection for genuine threats. This preserves signature fidelity for real attack traffic while directly reducing analyst triage load, which is the stated goal of balancing efficacy and workload. It is a targeted, documented tuning action rather than a blunt global change.

Answer

Update all signatures to the most restrictive settings available

Answer

Disable all low-severity alerts in the IDS management console

Answer

Set the IDS to 'Alert Only' mode for all signatures

Question 13

An organization is implementing a proactive detection strategy using the MITRE ATT&CK framework. Which phase of the implementation should the SOC prioritize to maximize detection coverage against common enterprise threats?

Accepted Answer

Map existing log sources to high-prevalence ATT&CK techniques. Mapping existing log sources to high-prevalence ATT&CK techniques is the foundational step that maximizes detection coverage efficiently, because it identifies which techniques the organization can already see and where telemetry gaps exist. It avoids wasted effort on techniques that are rare in the enterprise's threat profile. This prioritization aligns detection engineering with the most likely adversary behaviors.

Answer

Purchase every available threat intelligence feed on the market

Answer

Rewrite all existing SIEM correlation rules from scratch

Answer

Focus only on detecting the 'Command and Control' phase

Question 14

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

Accepted Answer

Mapping of STIX observable types to local incident categories and severity levels. For automated ingestion of STIX/TAXII indicators to drive incident response, the mandatory configuration is mapping STIX observable types (e.g., ipv4-addr, domain-name, file hashes) to the SIEM's local incident categories and severity levels. Without this mapping, indicators arrive but cannot be triaged, prioritized, or routed into the IR workflow.

Answer

Disabling SSL verification for the incoming feed

Answer

Configuration of the TAXII server's internal clock synchronization

Answer

Setting the API polling interval to 24 hours

Question 15

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

Accepted Answer

Implement multi-stage correlation rules that require high-confidence indicators to fire. Multi-stage correlation rules require multiple high-confidence indicators to align before generating an alert, which directly reduces false positives and improves the Signal-to-Noise ratio. By chaining events (e.g., a suspicious login followed by unusual data access), the SIEM fires only on genuinely suspicious behavior rather than on isolated low-fidelity events. This is the standard SOC practice for tuning detection content to combat alert fatigue.

Answer

Increase the retention period for all raw log data

Answer

Lower the threshold for all IDS alerts to catch more threats

Answer

Outsource all monitoring to a managed security provider

Question 16

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

Accepted Answer

Windows Event Log - PowerShell Script Block Logging (Event ID 4104). PowerShell Script Block Logging (Event ID 4104) records the actual script block text that PowerShell executes, including de-obfuscated commands after certain decoding steps, making it the richest source for seeing what an attacker ran. This is especially valuable for fileless attacks where nothing touches disk. Event ID 4688 only shows that powershell.exe launched, not the commands inside it.

Answer

Disk forensic analysis of the user's browser history

Answer

Windows Security Log - Process Creation (Event ID 4688)

Answer

Network firewall traffic logs for port 5985

Question 17

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Accepted Answer

certutil.exe. certutil.exe is a legitimate Windows certificate utility that attackers abuse for Living off the Land techniques — downloading files (certutil -urlcache -f), decoding base64 payloads (certutil -decode), and even installing rogue certificates. Its use by a non-administrative user, especially with URL or decode flags, is highly anomalous and warrants immediate investigation.

Answer

mspaint.exe

Answer

calc.exe

Answer

notepad.exe

Question 18

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Accepted Answer

Network traffic logs showing SMB/RDP connections between workstations. Option A is correct because network traffic logs capturing SMB (TCP 445) and RDP (TCP 3389) connections between workstations directly reveal lateral movement paths, such as workstation-to-workstation SMB sessions or RDP logins that deviate from normal patterns. Option E is correct because Windows Security Log Event ID 4624 records successful logon events, including Logon Type 3 (Network, typical of SMB) and Logon Type 10 (RemoteInteractive, used by RDP), which are essential for identifying remote access to a host. Option B is not relevant since system clock synchronization logs only concern time accuracy (e.g., NTP/W32Time) and do not record access activity. Option C is not relevant because Microsoft Word application logs capture document or crash events, not remote access techniques. Option D is not relevant because browser cache logs only reflect web browsing artifacts and have no bearing on RDP or SMB lateral movement.

Answer

System clock synchronization logs

Answer

Application logs for Microsoft Word

Answer

Browser cache logs

Question 19

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Accepted Answer

Automate the expiration of indicators based on the intelligence aging policy. Option A is correct because indicators have a limited useful lifetime; automating expiration according to the intelligence aging policy prevents stale IOCs (e.g., old malicious IPs or domains) from generating false positives and keeps detections actionable. Option C is correct because normalizing feeds into the SIEM's schema (mapping fields such as IP, hash, domain, and timestamps to a common taxonomy like STIX/TAXII or the platform's data model) makes indicators correlatable and searchable across heterogeneous sources. Option D is correct because filtering indicators irrelevant to the current technology stack (e.g., macOS malware hashes on an all-Windows estate, or unsupported protocols) reduces noise and ensures analysts focus on threats that can actually affect the environment. Option B is not appropriate because dumping raw feeds into an unindexed archive makes the data unsearchable and unusable for real-time detection, defeating the purpose of actionable intelligence. Option E is incorrect because setting an infinite TTL on IP indicators guarantees indefinite false positives, since IP addresses are frequently reassigned and threat infrastructure changes rapidly.

Answer

Store all raw intelligence feeds in an unindexed archive

Answer

Increase the TTL for all IP-based indicators to 'infinite'

Question 20

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Accepted Answer

Establishing a baseline for outbound traffic volumes and alerting on significant deviations. Option B is correct because 'Low and Slow' exfiltration deliberately keeps transfer rates small to evade volume thresholds, so establishing a statistical baseline of normal outbound traffic volumes and alerting on significant deviations (e.g., via NetFlow/IPFIX analysis or SIEM anomaly detection) exposes the subtle, sustained increase that static thresholds miss. Option C is correct because these attacks typically rely on long-lived, low-bandwidth connections (persistent TCP sessions or periodic beaconing) to external IPs, so monitoring connection duration and bytes-per-second to external addresses reveals the abnormal persistence and destination patterns characteristic of stealthy exfiltration. Option A is not effective because a whitelist of the top 1000 websites only restricts destinations and does nothing to detect small, gradual data transfers, which can also be tunneled through allowed sites. Option D is not effective because keyword scanning of outbound email targets content, not the low-volume, long-duration network behavior that defines 'Low and Slow' exfiltration. Option E is not effective because blocking all encrypted traffic is a blunt, disruptive control that neither detects exfiltration nor distinguishes malicious from legitimate TLS, and much exfiltration is itself encrypted.

Answer

Checking all outbound traffic against a whitelist of top 1000 websites

Answer

Scanning all outgoing emails for keywords

Answer

Blocking all encrypted traffic at the firewall