20+ practice questions focused on Incident Response — one of the most tested topics on the Certified SOC Analyst (312-39) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Incident Response PracticeIn an IR scenario involving a compromised Microsoft 365 account, which command in the Security & Compliance PowerShell module is used to force sign-out of all active sessions?
Explanation: Revoke-AzureADUserAllRefreshToken is the official command to invalidate existing refresh tokens and force re-authentication.
You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?
Explanation: In Wireshark display filter syntax, 'ip.src == 192.168.1.50' isolates packets whose IPv4 source address matches the suspicious host. This is the correct field name and operator for source-IP filtering. It captures only outbound traffic from that IP, which is what 'source IP' means.
You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?
Explanation: PowerShell Script Block Logging (Event ID 4104) captures the full text of script blocks as they execute, including deobfuscated content and command-line arguments passed to scripts. This is the required setting to see the actual PowerShell commands attackers run. It must be enabled via Group Policy or registry under the PowerShell operational log.
You are auditing user access logs for a potential privilege escalation. What indicates that a user has successfully used 'runas' to switch context?
Explanation: Event ID 4624 with Logon Type 9 indicates a successful logon using the 'runas' command, which switches the user context by creating a new logon session with alternate credentials. Logon Type 9 is specifically defined as 'NewCredentials' and is used when a process is started with different credentials via runas /netonly or similar mechanisms. This is the definitive indicator that runas was used successfully.
Which TWO types of evidence should be collected during the identification phase of an incident?
Explanation: During the identification phase of incident response, the goal is to gather volatile and non-volatile data that can confirm whether an incident has occurred and establish its scope. Option A, system event logs, is correct because logs from the OS, applications, and security tools (e.g., Windows Event Log, syslog, SIEM feeds) provide the primary timeline and indicators of compromise needed to validate and characterize the incident. Option C, disk images, is correct because forensic bit-for-bit copies of storage media preserve file system metadata, deleted files, and artifacts that support deeper analysis and evidentiary integrity during identification. The other options do not belong: employee performance reviews (B) are HR records unrelated to technical incident evidence, coffee machine logs (D) are irrelevant IoT/device telemetry with no investigative value for this scenario, and building access badges (E) are physical security records that may support a broader investigation but are not the technical evidence types collected in the identification phase.
+15 more Incident Response questions available
Practice all Incident Response questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Incident Response. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Incident Response questions on the 312-39 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Incident Response is tested as part of the Certified SOC Analyst (312-39) blueprint. Practicing with targeted Incident Response questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 312-39 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Incident Response is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Incident Response practice session with instant scoring and detailed explanations.
Start Incident Response Practice →