312-39 Security Operations And Management — Timed 15 Questions

Question 1

A SOC analyst receives an alert from the SIEM indicating a possible data exfiltration attempt. Before escalating, the analyst wants to enrich the alert with threat intelligence to determine if the source IP is malicious. Which type of threat intelligence feed should the analyst consult first to quickly assess the reputation of the IP address?

15 minute time limit — choose an answer to begin.

Accepted Answer

Technical threat intelligence. The analyst requires real-time, actionable information about an IP address to make a triage decision. Technical threat intelligence feeds provide exactly that: specific indicators with reputation data that can be automatically queried. Strategic, operational, and tactical intelligence serve different purposes—long-term planning, attack campaign analysis, and broader IOC sharing—and are not optimized for immediate IP reputation checks during alert handling.

Answer

Tactical threat intelligence

Answer

Strategic threat intelligence

Answer

Operational threat intelligence

Question 2

A SOC analyst is investigating a suspected insider threat. The analyst needs to correlate user activity across multiple systems, including VPN logs, endpoint detection and response (EDR) telemetry, and data loss prevention (DLP) alerts. Which data source should the analyst prioritize to establish a timeline of user actions?

Accepted Answer

EDR telemetry. For insider threat investigations, establishing a detailed timeline of user actions is crucial. EDR telemetry captures endpoint-level activities like process creation, file modifications, and network connections, which directly reflect user behavior. While VPN, DLP, and AD logs provide valuable context, they are narrower in scope. EDR data enables the analyst to see the sequence of events and correlate with other sources effectively.

Answer

Active Directory authentication logs

Answer

VPN logs

Answer

DLP alerts

Question 3

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Accepted Answer

Security Content Engineer. The Security Content Engineer is the role dedicated to authoring, tuning, and maintaining detection content such as SIEM correlation rules, use cases, and parsers. This role owns the health and efficacy of the detection pipeline, which is exactly what the question describes. Other roles focus on response, governance, or management rather than content lifecycle.

Answer

Incident Responder

Answer

Compliance Officer

Answer

SOC Manager

Question 4

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Accepted Answer

Correlation Rule Threshold. A correlation rule threshold defines how many matching events within a specified time window must occur before the rule fires an alert. To trigger only when 5 events occur in 60 seconds, you set the threshold count to 5 and the window to 60 seconds in the correlation rule. This is the exact metric that controls the 'how many, how fast' logic of alert generation.

Answer

Event Parser Configuration

Answer

Aggregation Key

Answer

Suppression Window

Question 5

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

Accepted Answer

Run host isolation playbook. Host isolation is the fastest way to stop an active threat from spreading laterally or exfiltrating data, and it preserves the endpoint state for later forensics. In a SOAR playbook, isolation is typically the first automated containment action because it is reversible and low-impact compared to network-wide changes.

Answer

Reset all user passwords

Answer

Perform full forensic imaging

Answer

Update the firewall rule base

Question 6

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Accepted Answer

MSSP. An MSSP (Managed Security Service Provider) is a third-party provider that delivers outsourced security monitoring and management services — such as 24/7 SOC operations, SIEM monitoring, and incident response — while the client organization retains ownership and control of its security posture and policies. This matches the scenario of outsourcing monitoring while retaining internal control.

Answer

Virtual SOC

Answer

Internal SOC

Answer

Hybrid Cloud SOC

Question 7

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Accepted Answer

MTTA. MTTA (Mean Time to Acknowledge) measures the average time between an alert being generated and an analyst acknowledging or being assigned to it, which is exactly the detection-to-assignment interval the SOC wants to optimize. Analyzing MTTA isolates delays in triage routing, queue assignment, or analyst availability. MTTR, by contrast, covers the entire lifecycle through resolution and would mask where the bottleneck actually sits.

Answer

MTTR

Answer

False Positive Rate

Answer

Dwell Time

Question 8

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

Accepted Answer

Level 3. Level 3 (Defined) in the CMMI-based SOC maturity model is characterized by documented, standardized processes that are consistently applied across the organization, but which still rely heavily on manual execution rather than automation. Since the SOC has documented standard processes but lacks consistent automation, it has achieved Level 3. Automation and continuous optimization are hallmarks of the higher levels (Level 4 Quantitative Managed and Level 5 Optimizing), not Level 3.

Answer

Level 5

Answer

Level 2

Answer

Level 1

Question 9

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring alerts, performing initial triage, and filtering out false positives. They validate whether an alert is a genuine security incident and escalate only confirmed incidents to Tier 2. This tier requires foundational skills and follows documented procedures to ensure basic incident filtering.

Answer

Tier 3

Answer

SOC Manager

Answer

Tier 2

Question 10

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Accepted Answer

Standardized handover and documentation. Follow-the-Sun relies on handing off active incidents between geographically distributed teams at the end of each shift, so standardized handover procedures and consistent documentation are the critical enablers. Without a uniform template covering incident status, actions taken, and next steps, the incoming team loses context and response stalls. This is a process and people requirement, not a technology purchase.

Answer

Purchasing a new SIEM license

Answer

Moving all logs to the cloud

Answer

Increasing the number of Tier 3 analysts

Question 11

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Accepted Answer

Updating correlation rules based on new IOCs. A Threat Intelligence analyst's core function is to collect, analyze, and operationalize threat data, which includes translating new indicators of compromise (IOCs) into detection content such as SIEM correlation rules, IDS signatures, and blocklists. Updating correlation rules based on new IOCs directly connects intelligence to detection, closing the loop between research and SOC operations. This is the defining responsibility that distinguishes the role from other SOC functions.

Answer

Hardening server images

Answer

Managing SOC budget

Answer

Writing compliance reports

Question 12

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

Accepted Answer

UPN. The User Principal Name (UPN) is a unique, user-centric identifier (typically formatted like an email address) that remains consistent across platforms, making it the most reliable field for correlating a single user's activity across SIEM and EDR data sources. Unlike IP addresses or device names, the UPN does not change when the user moves between hosts or networks. This makes it the anchor field for identity-based correlation.

Answer

Timestamp

Answer

Device Name

Answer

Source IP

Question 13

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

Accepted Answer

Eliminating the threat. The Eradication phase in the Incident Response lifecycle focuses on removing the threat from the environment. This involves actions such as deleting malware, disabling breached user accounts, and patching vulnerabilities that were exploited. The primary goal is to ensure the threat is completely eliminated so that the system can be safely restored to normal operations.

Answer

Identifying the source

Answer

Blocking traffic

Answer

Restoring backups

Question 14

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Accepted Answer

Threat Hunter and Tier 2/3 Analyst. Threat hunters and Tier 2/3 analysts need frequent communication to pivot between tactical and strategic investigations.

Answer

SOC Manager and IT Support

Answer

Tier 1 Analyst and Compliance Officer

Answer

SOC Manager and HR

Question 15

Which THREE components are essential to include in a SOC Incident Response plan?

Accepted Answer

Defined roles and responsibilities. A is correct because a SOC Incident Response plan must define roles and responsibilities (e.g., incident commander, tier-1/tier-2 analysts, forensics, legal liaison) so each responder knows their authority and tasks during an incident. C is correct because a communication escalation matrix specifies who is notified, in what order, and through which channels (e.g., phone, email, ticketing) as severity increases, ensuring timely stakeholder and management engagement. E is correct because Standard Operating Procedures provide the repeatable, step-by-step playbooks for detection, triage, containment, eradication, and recovery, which are the operational backbone of any IR plan. B is not relevant because physical security building permits are facility-management concerns, not incident response planning components. D is not relevant because a list of office vacation days is an HR/scheduling matter and does not contribute to detecting, responding to, or recovering from security incidents.

Answer

Physical security building permits

Answer

List of office vacation days