Certified SOC Analyst (312-39) (312-39) — Questions 1–75

Ingesting logs from AWS, Azure and GCP into one SIEM correlates events across providers, giving a single pane of glass instead of per-provider consoles. This satisfies the benefit of centralised visibility spanning multiple cloud providers.

A DGA generates many pseudo-random subdomains under a parent domain so malware can locate an active C2 server without hardcoded addresses. The burst of unique subdomains, rapid timing, and predominantly failed resolutions are classic DGA fingerprints, since most generated names are unregistered and therefore return NXDOMAIN.

A parser reads raw log events and extracts individual fields, mapping vendor-specific formats into a common schema so downstream correlation and search work consistently. This normalisation satisfies the SIEM's need for comparable, structured event data across heterogeneous sources.

Monitoring for reinfection verifies that eradicated threats have not returned after systems are restored to production. It satisfies Recovery's requirement to confirm normal service while detecting residual compromise, closing the loop before the incident is formally declared resolved.

Volatility parses raw memory images, reconstructing process lists, injected code regions and network artefacts that disk-only tools miss. It identifies code injected into legitimate processes, which is precisely what the suspicious PowerShell script's in-memory behaviour requires.

A SOC charter formally links the SOC's mission to business objectives and risk appetite, and it documents executive sponsorship, scope, and authority. It is the governance artifact auditors expect to see when verifying alignment between daily operations and organizational strategy. Because it is approved at the executive level, it demonstrates that security monitoring is not an isolated IT function but a business-aligned capability with clear accountability.

The Incident Review dashboard surfaces correlated notables and displays their associated MITRE ATT&CK annotations, letting you confirm the technique mapped to the failed-login-then-success pattern. It satisfies the stem's requirement to verify ATT&CK mapping directly within Splunk Enterprise Security, rather than pivoting to separate analytic or intelligence views.

Volatility is an open-source framework that extracts digital artefacts such as processes, network connections, and injected code from memory captures. It satisfies the requirement for forensic memory analysis by parsing raw RAM images across multiple operating system profiles.

AWS CloudTrail records API activity in your account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. By filtering CloudTrail logs by the IAM user and the desired time range, the analyst can see exactly which API calls were made. This is the primary service for auditing AWS API activity.

The Azure Activity Log records subscription-level control plane operations, including role assignment creations. Each log entry contains the operation name (e.g., Microsoft.Authorization/roleAssignments/write), the caller's identity, and the caller's IP address. Querying the Activity Log for role assignment events will provide the exact information needed to assess whether the service principal's actions are malicious.

Isolating the host contains the likely malware before it can spread or communicate with command-and-control infrastructure. A legitimate svchost.exe never executes from a temp folder, indicating process masquerading. Network isolation preserves volatile evidence for later forensic analysis while preventing lateral movement, satisfying the stem's demand for the most immediate containment action.

Deduplication and correlation reduce noise by aggregating repeated events into a single alert with an occurrence count, preserving the original logs for forensic analysis while minimizing pipeline load. This maintains visibility into the number of attempts and source IPs, enabling detection of brute-force patterns without overwhelming the SIEM.

Automated playbooks execute predefined response actions, such as isolating an endpoint or blocking an IP, without manual intervention. This reduces response time and ensures consistency, directly improving efficiency. In a SOC, automation handles repetitive tasks, allowing analysts to focus on complex threats. Therefore, this change significantly enhances incident handling efficiency.

Pairing the threat hunter with Tier 2/3 analysts places proactive hypothesis-driven investigation alongside deep incident analysis, so indicators unearthed by hunting flow directly into escalation and containment. This adjacency satisfies the stem's real-time intelligence sharing requirement, since both roles operate on the same advanced telemetry and can correlate findings without intermediary handoffs.

Alert aggregation merges related detections from the same source, host or campaign into a single incident, cutting duplicate tickets that flood the queue. This directly reduces analyst fatigue while preserving the underlying evidence, satisfying the requirement to improve alert quality and lessen volume.

Blocking outbound traffic to the identified C2 address severs the callback channel at the network layer, immediately halting beaconing without disrupting other legitimate egress traffic, which satisfies the containment requirement for this specific external destination.

JA3 and JA3S are fingerprints derived from the TLS ClientHello and ServerHello packets. They can identify the client and server applications based on their TLS configuration, such as cipher suites and extensions. Malware often uses unique or default TLS libraries, resulting in distinct JA3 hashes. By comparing the fingerprint to known malicious or legitimate applications, the analyst can determine if the traffic is likely C2 without decrypting the payload. This method is passive and does not disrupt the session.

Recording the exception in the rule's documentation preserves the detection logic while preventing analysts from re-investigating the same benign administrator activity. This satisfies the requirement to document the false positive at source, giving future reviewers the context needed to tune or whitelist the rule without disabling it.

Multiple rapid failures followed by success align with automated password guessing or credential stuffing, which warrants deeper investigation before closure. The analyst should check the source IP, geolocation, and whether the account normally connects from that location. Classifying as suspicious true positive keeps the incident open for enrichment while acknowledging the alert fired on real, relevant activity.

Reviewing the user's recent login history and accessed files helps establish whether the access is anomalous or part of a pattern. This contextual information is essential to determine if the activity is malicious or benign, such as a legitimate cross-departmental project. It is a foundational triage step for insider threat investigations.

Template macros expand per-message at runtime, so $HOST resolves to each device's hostname and dynamically builds a separate directory path for every department's logs. This satisfies the stem's requirement to segregate files by hostname without defining a destination per device, unlike static paths or filters that cannot vary output location per sender.

Threat intelligence feeds ingest structured indicators such as malicious IPs directly into the SIEM, while lookup tables enrich events by matching those addresses during correlation. Both satisfy the requirement to import and reference an external IP list, unlike static correlation rules or dashboards, which cannot store or refresh indicator data.

Dynamic API resolution almost always relies on LoadLibrary plus GetProcAddress to locate function pointers at runtime, so these calls leave no static import entries. Breaking on both functions and reading the module name and procedure name arguments from the stack or registers exposes exactly which APIs the malware resolves, which can then be mapped back to the suspicious behaviors observed during execution.

The first step in triage is to validate the alert by examining the script's content, parent process, and user context to determine if it is a true positive. This helps avoid unnecessary escalation and ensures that subsequent actions are based on accurate information. Only after validation should containment or evidence collection proceed.

A DGA produces many high-entropy subdomains or domains under one parent, and malware queries them until one resolves to a live C2 server. The 30-second interval, random-looking labels, and NXDOMAIN responses are classic DGA behavior: most generated domains are unregistered, so the resolver returns NXDOMAIN. The absence of HTTP or TLS traffic indicates the malware has not yet found an active domain, which is exactly what DGA-based beaconing looks like before C2 establishment.

TXT records carry arbitrary attacker-controlled text, so malware encodes command-and-control instructions inside them and exfiltrates data via DNS queries that blend with legitimate traffic. Their high payload capacity and tolerance of unusual strings make TXT the record type most commonly abused for DNS tunnelling.

Timestamps from different artifacts may be recorded in UTC or local time, and the host clock may be skewed, so normalizing to a single time zone and documenting offset corrections is required for a valid sequence. Without this step, events can appear out of order and the reconstructed timeline becomes unreliable during the investigation.

Defined roles and responsibilities ensure each analyst knows their exact function during containment, eradication and recovery, preventing duplicated effort or gaps in a live incident. This satisfies the SOC plan's requirement for clear accountability, so escalations and handoffs occur without delay when every minute affects breach impact.

DNS tunneling often encodes data in subdomain labels, resulting in unusually long and random-looking subdomains. Attackers use this to exfiltrate data or establish command-and-control channels. Frequent queries with long, high-entropy subdomains are a strong indicator of tunneling because legitimate DNS queries typically have shorter, meaningful names. This pattern is more specific than just high volume.

Search cost scales with scanned data volume, so constraining the query to a narrow time range and only the indexes holding relevant events cuts the records processed. This directly addresses the slowness without altering detection logic or losing required events.

Removing the threat from the environment is precisely what eradication achieves, eliminating malware, compromised accounts and persistence mechanisms so the adversary loses their foothold. This satisfies the stem's requirement for the phase's primary goal, distinguishing it from containment, which merely limits spread, and recovery, which restores normal operations afterwards.

Data Access audit logs capture read and write operations on resources such as Cloud Storage objects and BigQuery datasets. When a service account is abused to exfiltrate or alter data, these entries record the principal, method, and resource, directly evidencing unauthorized use of the identity.

Setting status to 'Closed' with resolution code 'False Positive' satisfies the triage requirement to document the alert's disposition accurately. The resolution code preserves the reason for closure, enabling trend analysis and tuning of detection rules, while the closed status removes the alert from the active queue so analysts focus on genuine incidents.

Quantifying potential breach costs directly satisfies the ROI calculation's benefit side, since ROI compares SOC investment against avoided losses. Breach cost estimates — incident response, regulatory fines, customer notification, business disruption — establish the financial baseline that justifies SOC spend, making this factor essential rather than merely supportive.

Physical memory is the most volatile evidence and must be captured before any other action that could alter system state. Tools like WinPmem or Magnet RAM Capture are designed for live memory acquisition and preserve forensic integrity. Isolating the network first or running other commands would change memory contents, violating the order of volatility and potentially destroying critical artifacts such as encryption keys or injected code.

Beaconing is defined by timing regularity, not payload content, so analysing connection flow metadata for consistent intervals and low jitter detects it regardless of encryption. This directly matches the 30-second interval with 5% jitter observed.

Fixed-interval, uniform-size sessions to an unknown IP with a self-signed certificate are characteristic of beaconing. The regularity and small constant payloads are the signature of an implant checking in. This is a network-based IoC because the evidence is derived from traffic analysis, not host artifacts.

This is the most likely explanation. The backup job running at an unexpected time, using a service account with database access, and transferring a large amount of data to an external IP are classic indicators of credential compromise and data exfiltration. Attackers often use legitimate service accounts to blend in. The analyst should investigate the service account's recent activity and the external IP.

Affected system count indicates blast radius: an alert spanning many hosts signals lateral movement or worm-like propagation, demanding immediate escalation. This scope metric lets analysts rank alerts by potential spread, directly satisfying the stem's prioritisation criterion.

The TimeDateStamp field in the IMAGE_FILE_HEADER of a PE file contains the time the file was compiled, expressed as a Unix timestamp. It is a standard part of the COFF file header and can be viewed with tools like PEview or CFF Explorer. This field helps analysts correlate the binary's creation time with incident timelines.

Training personnel belongs to Preparation because readiness depends on pre-incident capability building, not live containment or eradication. It satisfies the stem's phase constraint by ensuring analysts, responders and stakeholders hold the skills, roles and escalation knowledge needed before an incident occurs, alongside plan development, tooling and communication channels.

The Lambda console and GetFunction API return the function's configuration, including its execution role, environment variables, and code location. This allows the analyst to see which IAM role the function assumes and to retrieve the code for review. It directly answers both what code ran and which role was used, making it the correct choice for this investigation.

Isolate device severs the workstation's network connections except to Defender for Endpoint, containing lateral movement and exfiltration while preserving analyst remote access for investigation. This satisfies the requirement to isolate an infected endpoint during a suspected malware incident.

Event ID 4688 captures process creation and, when command-line auditing is enabled, the full arguments used. This directly supports detecting suspicious execution such as encoded PowerShell or unusual parent-child relationships. It is a host-based artifact that maps cleanly to the Execution phase and is a primary data source for detection engineering.

Centralised collection aggregates events from multiple hosts into one repository, letting analysts correlate related entries across systems and reconstruct an incident timeline quickly. Local logging scatters evidence per machine, so this correlation and coordinated response become slow and error-prone.

A war room centralises real-time communication and coordination, satisfying the stem's requirement for managing a major incident. By co-locating responders and decision-makers, it removes communication delays and ambiguity, enabling rapid, synchronised action under a unified command structure — the defining purpose distinguishing it from routine ticketing or post-incident review.

Malicious macros execute within the Office application that opened the document, so excel.exe spawns the payload as a child process. This satisfies the stem's constraint: the parent process must be the application hosting the embedded macro, not a system process such as explorer.exe or svchost.exe.

Legitimate code pages are typically mapped as images with execute-read permissions. A private region with both write and execute permissions inside a normally non-executable host process strongly suggests injected shellcode. Memory forensics tools flag RWX private regions because they are a common hallmark of reflective loading and process hollowing, making this a direct indicator of injection.

Creating a new service whose ImagePath points to a binary in C:\Windows\Temp and whose service account is SYSTEM is a classic persistence mechanism: the service starts at boot under the highest privileges available. The prior successful authentication of 'svc_backup' is consistent with an attacker using a service account for lateral movement and then installing a persistent service on the domain controller. The combination of writable-path binary and SYSTEM context is the decisive indicator here.

Centralised aggregation pulls in every device's syslog, including verbose debug and informational entries, so analysts must filter enormous volumes of low-value noise to surface genuine security events. This directly addresses the challenge of separating signal from irrelevant data at enterprise scale.

The Startup folder path and filename are direct evidence of a persistence mechanism. Documenting the exact location, such as C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.lnk, allows responders to remove the file and understand how the malware survives reboot. This artifact is essential for the forensic report because it ties the malware to a specific autostart location.

The malicious hash confirms the email is genuinely harmful, but the user's claim of non-execution must be validated through endpoint telemetry. Checking for other recipients identifies additional potential victims of the same campaign. This outcome balances accurate classification with the investigative steps needed to confirm scope.

Azure AD Sign-in Logs capture authentication events for users and service principals, including the application ID, IP address, location, and conditional access policy status. By querying these logs, the analyst can see successful and failed sign-ins, as well as which policies were applied, providing the necessary details for investigating a compromised service principal.

The Apache combined log format places the client IP as the first space-delimited field and the request line (method, path, protocol) inside the first pair of double quotes. A regex anchored to these positions reliably extracts the IP and URL without being confused by other quoted fields such as the referrer or user agent.

The combination of a hidden, encoded PowerShell command spawned by Microsoft Word is a strong indicator of a malicious macro-based infection, often leading to code execution and further compromise. Isolating the host is the priority to prevent lateral movement and data exfiltration. This aligns with containment best practices in incident response, as the threat is active and potentially spreading.

The Infrastructure axis of the Diamond Model describes the physical and logical assets adversaries use, including command-and-control servers, domains and channels. Examining it reveals the systems compromised hosts communicate with, directly answering the analyst's requirement.

Harmless-looking payloads may still indicate probing or encoding tricks, so the analyst must verify impact rather than dismiss the alert. Reviewing destination server logs confirms whether the SQL injection actually executed or was blocked, guiding escalation.

Post-Incident Activity reviews what occurred, documents root cause and response effectiveness, and produces recommendations that strengthen future detection and containment. This directly fulfils the phase's purpose of capturing lessons learned to improve the organisation's incident response capability.

Baseline behavioural profiling establishes normal activity patterns per user and entity, so correlation rules can flag genuine deviations rather than static threshold breaches. This satisfies the stem's goal of minimising false positives by tuning detections to observed behaviour.

The CreateUser API call creates a new IAM user. In a compromised account, an attacker often creates new users to maintain persistence. Monitoring for CreateUser, especially when followed by AttachUserPolicy or CreateAccessKey, is a high-priority indicator. It is unusual for legitimate users to create new IAM users frequently, so a sudden CreateUser event warrants immediate investigation.

Threat intelligence feeds supply indicators of compromise; the analyst translates these into detection logic by updating correlation rules so the SIEM alerts on newly observed malicious infrastructure. This operationalises intelligence into detection, the role's core SOC responsibility.

Physical memory is the most volatile evidence and can contain encryption keys, running process details, network connections, and injected code. Capturing it first follows the order of volatility and preserves artifacts that would be lost if the system were shut down or if the attacker cleaned up. Tools like LiME or AVML allow memory acquisition on running Linux systems without rebooting.

Pass-the-Hash uses a stolen NTLM hash to authenticate without knowing the plaintext password. A key indicator is successful NTLM authentication to a remote host from a workstation where no interactive logon or credential prompt occurred. This mismatch between authentication success and user activity suggests the hash was used directly, which is the core behavior of Pass-the-Hash lateral movement.

Large, encoded HTTP POST requests to a newly registered, low-reputation domain outside business hours strongly suggest data exfiltration. Attackers often use HTTP POST to upload stolen data to a C2 server, encoding it to evade detection. The timing and domain characteristics further support malicious intent. This pattern is a common indicator of exfiltration, where data is sent to an attacker-controlled endpoint.

Registry Run keys are a common persistence mechanism, and a binary launching from AppData is suspicious because legitimate software rarely resides there. This is a host-based IoC because it exists on the endpoint's file system and registry, and it directly supports identifying a compromised host.

Reading another process's memory requires opening it with PROCESS_VM_READ, and LSASS holds credential material. A non-Microsoft process requesting that access right against lsass.exe is a strong indicator that credential dumping is in progress, because legitimate applications rarely need to read LSASS memory. Combined with the process identity and timing, this handle-open event provides direct evidence of the access pattern used by tools like Mimikatz and similar dumpers.

The where operator filters tabular data by a boolean predicate, letting the analyst restrict SecurityAlert rows to Severity == 'High' and the matching resource provider. It satisfies the requirement to narrow results by severity and originating provider within a single query.

DNS tunneling for C2 involves encoding data in DNS queries and responses to bypass network security controls. Attackers use long, random subdomains to carry encoded commands or exfiltrated data, and TXT records are often used to return data because they can hold more information. This pattern is a classic indicator of DNS tunneling, where the DNS protocol is abused as a covert channel.

Suppression rules scoped to known-good internal administration scanners remove predictable, benign scan traffic without disabling the signatures themselves, so genuine malicious activity on other hosts still triggers alerts. This cuts analyst triage volume while preserving detection coverage elsewhere.

Building Blocks are reusable rule components holding shared test logic, so one definition can be referenced by many correlation rules. This satisfies the tuning requirement to avoid duplicating identical conditions across rules, simplifying maintenance when detection logic changes.

Opening the attachment in a sandbox allows safe dynamic analysis of its behavior, such as file system changes, network connections, and process creation. This is crucial for detecting zero-day or obfuscated malware that may not have a known hash. Sandboxing is a best practice for analyzing potentially malicious files without risking the production environment.

The incident response log chronologically records every action, decision and timestamp during handling, providing the evidentiary trail auditors and legal teams require. Other documents, such as the final report or playbook, summarise or guide rather than capture contemporaneous actions.

Regex extraction parses raw log events during ingestion, pulling discrete fields such as timestamps, source IPs and usernames into a common schema. This transforms heterogeneous vendor formats into consistent, searchable fields, which is the essence of log normalisation in a SIEM.

Deleting the web shell removes the attacker's persistence mechanism, while rotating credentials invalidates any harvested passwords or tokens. Together these actions close the access vector the intruder used, satisfying the stem's requirement to prevent further access after identification.

Cloud storage uploads traverse TCP 443, so HTTP/HTTPS proxy logs record the destination host, URL, bytes transferred and session duration, exposing the large outbound volumes characteristic of exfiltration to services such as Dropbox or Google Drive.