312-39 Security Operations And Management Practice Test 2 — 15 Questions

Question 1

Which TWO factors are most critical when calculating the ROI of a SOC?

Accepted Answer

Cost of potential data breach incidents. Option A (Cost of potential data breach incidents) is correct because ROI for a SOC is fundamentally about avoided losses — the expected financial impact of breaches (incident response, regulatory fines, legal fees, customer notification, and business disruption) represents the benefit side of the ROI equation, so it must be quantified. Option B (Total cost of security personnel and tools) is correct because ROI requires the full investment side, including SOC analyst salaries, SIEM licensing, EDR, threat intelligence subscriptions, and training, which together form the denominator of the ROI calculation. Options C, D, and E are not relevant financial factors: social media followers, office square footage, and coffee machines do not measure either the cost of the SOC or the losses it prevents, so they cannot meaningfully contribute to an ROI calculation.

Answer

Number of social media followers

Answer

Office space square footage

Answer

Number of coffee machines in the SOC

Question 2

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

Accepted Answer

Document the rationale for closure. Option B is correct because documenting the rationale for closing an alert as a False Positive creates an audit trail and preserves the analyst's reasoning for compliance, reporting, and future investigations. Option D is correct because a confirmed False Positive often reveals that the correlation rule's logic, thresholds, or field mappings are too broad, so tuning the rule reduces future noise and improves detection fidelity. Option A is wrong because simply ignoring an alert without formal closure leaves it in an unresolved state and breaks incident-handling workflow. Option C is wrong because deleting the original event log destroys forensic evidence and violates log retention and integrity requirements. Option E is wrong because a False Positive is a detection-tuning issue, not a licensing capacity problem, so requesting a new SIEM license does not address the root cause.

Answer

Ignore the alert without closure

Answer

Delete the original event log

Answer

Request a new SIEM license

Question 3

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

Accepted Answer

Alert aggregation. Alert aggregation (A) is correct because grouping related alerts from the same host, user, or campaign into a single incident reduces the number of individual notifications analysts must triage, directly lowering fatigue. Suppression of known-good patterns (C) is correct because whitelisting or suppressing alerts triggered by verified benign activity (e.g., scheduled scans, trusted admin tools) eliminates recurring false positives that waste analyst time. Rule tuning based on historical data (D) is correct because adjusting detection thresholds, correlation logic, and signatures using past alert outcomes (true/false positive rates) raises the signal-to-noise ratio and improves alert fidelity. Removing SOC Tier 1 analysts (B) is not a technique for improving alert quality—it eliminates a triage layer and worsens response capability rather than reducing fatigue. Increasing the volume of log ingestion (E) does not improve alert quality; without better correlation and tuning, more logs typically produce more noise and more fatigue.

Answer

Removing the SOC Tier 1 analysts

Answer

Increasing the volume of log ingestion

Question 4

Which TWO metrics are essential for measuring the efficiency of an incident response team?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) (B) is essential because it directly quantifies how quickly the incident response team detects, acknowledges, and begins mitigating incidents, making it a core efficiency indicator of response speed and effectiveness. Incident volume per analyst (E) is also essential because it measures team throughput and workload distribution, showing how many incidents each analyst handles and helping assess capacity, staffing, and productivity. The other options do not belong: emails sent to stakeholders (A) is a communication activity, not an efficiency metric; average analyst salary (C) is a cost/HR figure unrelated to response performance; and building security badge access logs (D) are physical security data, not incident response efficiency measurements.

Answer

Number of emails sent to stakeholders

Answer

Average salary of analysts

Answer

Building security badge access logs

Question 5

A SOC manager is documenting the team's escalation workflow. During a high-severity incident, the Tier 1 analyst must notify the Tier 2 analyst who then engages the Incident Response lead. The manager wants to formally define the sequence of notifications and responsibilities. Which document should the manager update?

Accepted Answer

Standard Operating Procedure (SOP) for escalation. The manager needs to document a detailed, repeatable operational workflow for escalating incidents. A Standard Operating Procedure (SOP) is the correct type of document for defining such step-by-step processes and assigning specific responsibilities to team members, ensuring consistency and clarity during high-pressure situations.

Answer

Business Continuity Plan (BCP)

Answer

Incident Response Plan (IRP)

Answer

Service Level Agreement (SLA)

Question 6

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound data transfer from an internal server to an unknown external IP address. To determine if this is a true positive, the analyst needs to correlate user activity with the network event. Which data source would provide the MOST direct evidence of the user or process responsible for the transfer?

Accepted Answer

Endpoint Detection and Response (EDR) process telemetry. To attribute a network event to a specific user or process, the analyst needs endpoint-level visibility. EDR process telemetry captures the process that opened the network socket, along with its parent process and user context, providing the direct correlation required to determine if the transfer was malicious or legitimate.

Answer

NetFlow records from the core router

Answer

Windows Security Event Logs from the server

Answer

Firewall logs showing the allowed outbound connection

Question 7

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

Accepted Answer

Isolate the workstation from the network using EDR. The immediate priority is to stop the malware from communicating and spreading. Isolating the endpoint via EDR achieves this by cutting off all network traffic from that host while preserving its state for investigation. This is a standard containment procedure that balances security with forensic integrity.

Answer

Run a full antivirus scan on the workstation

Answer

Block the C2 IP address at the perimeter firewall

Answer

Shut down the workstation immediately

Question 8

A SOC manager is evaluating the team's performance and wants to measure how effectively they are using threat intelligence to prioritize alerts. Which metric best indicates the proportion of high-risk alerts that were correctly identified as true positives?

Accepted Answer

True positive rate (Recall). The true positive rate, or recall, specifically measures the proportion of actual malicious events that were correctly identified. When threat intelligence is used to prioritize high-risk alerts, a high true positive rate for those alerts indicates that the team is effectively using that intelligence to catch real threats.

Answer

False positive rate

Answer

Alert volume per analyst

Answer

Mean time to detect (MTTD)

Question 9

A SOC manager at a financial services company is preparing an audit defense for a recent data breach. The auditor asks for documented proof of how the SOC's daily operational activities align with the organization's overall business objectives and risk appetite. Which component of a SOC governance framework should the manager present to satisfy this request?

Accepted Answer

A SOC charter that defines the mission, scope, authority, and reporting lines approved by executive leadership. A SOC charter is the foundational governance document that ties the SOC's purpose, scope, and authority to executive-approved business objectives and risk appetite. Auditors use it to verify that monitoring activities are intentional and sponsored at the highest level. Operational artifacts such as rule lists, rosters, or scan reports describe activity but cannot demonstrate strategic alignment or executive accountability.

Answer

A vulnerability scan report listing unpatched systems across the corporate network

Answer

A raw export of SIEM correlation rules and their last-modified timestamps

Answer

A weekly shift roster showing analyst coverage across all three SOC tiers

Question 10

A SOC analyst receives a high-severity alert indicating that a workstation is communicating with a known command-and-control domain. Before escalating to the incident response team, the analyst wants to determine whether the alert represents a true positive and gather additional context. Which action best supports this triage decision while preserving forensic evidence?

Accepted Answer

Query historical proxy and DNS logs for the workstation to correlate the domain and identify related sessions. Passive log correlation using proxy and DNS records provides the context needed to validate a high-severity C2 alert without modifying the endpoint or alerting the adversary. It reveals scope, timing, and related hosts, which strengthens the escalation. Containment and remediation actions should wait until validation is complete to preserve evidence and avoid unnecessary business disruption.

Answer

Run a full antivirus scan on the workstation and delete any detected malware

Answer

Immediately isolate the workstation from the network to prevent lateral movement

Answer

Close the alert as a false positive because the domain may be shared hosting

Question 11

You are the SOC manager at a financial institution. During a monthly review, you notice that the mean time to detect (MTTD) security incidents has increased from 15 minutes to 3 hours over the past quarter. After investigation, you find that analysts are manually correlating alerts from the SIEM with threat intelligence feeds, which is time-consuming. Which action should you take FIRST to reduce MTTD?

Accepted Answer

Implement automated threat intelligence enrichment in the SIEM to correlate alerts with external feeds.. The increased MTTD is caused by manual correlation of SIEM alerts with threat intelligence feeds. Automating threat intelligence enrichment in the SIEM streamlines this process, providing analysts with enriched alerts that include external context. This reduces manual steps, accelerates triage, and directly lowers MTTD. Other options either add resources without fixing the process, reduce coverage, or suppress alerts, which are not sustainable solutions.

Answer

Reduce the number of threat intelligence feeds to only the most critical ones to simplify correlation.

Answer

Configure the SIEM to generate fewer alerts by raising the severity threshold for threat intelligence matches.

Answer

Increase the number of analysts on each shift to handle the manual correlation workload.

Question 12

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) incidents has increased over the past quarter. Which of the following is the most likely cause for this increase?

Accepted Answer

The SOC has expanded its monitoring scope to include new log sources without additional staff.. Mean time to detect measures how long it takes to identify incidents. An increase suggests detection is slowing. Adding new log sources without scaling human or automated resources can dilute analyst attention and create backlogs, delaying detection. The other options describe improvements or changes that would typically enhance detection speed, not degrade it.

Answer

The SOC has automated the triage of low-severity alerts.

Answer

The SOC has recently implemented a new SIEM with more advanced correlation rules.

Answer

The number of false positive alerts has decreased significantly.

Question 13

A SOC is implementing a new use case to detect credential dumping on Windows endpoints. The detection engineering team wants to combine multiple telemetry sources to reduce false positives and improve coverage. Which two data sources should be prioritized to reliably detect credential dumping activity? (Choose two.)

Accepted Answer

Sysmon events for process access to the LSASS process. Credential dumping detection benefits from combining process creation telemetry, which shows what executed and with what arguments, and Sysmon process access events, which show suspicious access to LSASS. Together they provide both the actor and the target, enabling high-fidelity alerts. Network, DHCP, and email logs lack the endpoint process and memory access visibility required for this specific behavior.

Answer

NetFlow records showing outbound traffic volume from the endpoint

Answer

DHCP logs showing IP address leases for the endpoint

Answer

Email gateway logs showing inbound messages with attachments

Question 14

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

Accepted Answer

Check the firewall logs for allowed outbound connections to the suspicious IP.. To validate the potential data exfiltration alert, you need to correlate network and endpoint evidence. EDR data reveals the process responsible for the connection, while firewall logs confirm if the traffic was allowed and the volume transferred. Together, they provide a clear picture of whether data left the network. Blocking, scanning, or email review are either containment or less direct investigative steps that do not immediately confirm the true positive.

Answer

Immediately block the suspicious IP address at the perimeter firewall.

Answer

Review the user's recent email activity for signs of phishing.

Answer

Run a full antivirus scan on the affected endpoint.

Question 15

During an incident, a SOC analyst needs to preserve volatile evidence from a compromised Linux server before the incident response team arrives. The server is still running and the attacker may still be active. Which action should the analyst take first to capture the most volatile data?

Accepted Answer

Capture the contents of physical memory using a tool such as LiME or AVML. The order of volatility requires capturing the most perishable evidence first. Physical memory contains running processes, network connections, and potentially encryption keys that vanish on shutdown or over time. Memory acquisition with tools like LiME or AVML preserves these artifacts before any disk imaging, shutdown, or remediation action is taken.

Answer

Create a forensic image of the entire disk using dd

Answer

Run a full antivirus scan and quarantine detected threats

Answer

Shut down the server to prevent further attacker activity