Certified SOC Analyst (312-39) (312-39) — Questions 76–150

Verifying the alert and scoping the incident confirms whether the detection is a true positive and establishes affected assets, accounts and blast radius. This satisfies the high-priority ticket's demand for immediate triage before containment or eradication, ensuring subsequent response actions target the actual compromise rather than an unconfirmed alert.

User identity and department information are directory-sourced attributes describing who performed the action. Enrichment correlates an alert's raw account identifier with organisational context, letting analysts judge whether the activity fits that person's normal role and access.

Sysmon Event ID 1 records process creation including the full command line, parent process ID, parent image, hashes, and user context. This directly answers the lineage and command-line question. If Sysmon is deployed with the appropriate configuration, the analyst can pivot from the initial executable to the dropped file and its child process, capturing the exact invocation used.

The correlation engine applies rules and logic to normalised events from multiple sources, detecting patterns and triggering alerts in real time. It is the SIEM component that turns raw log streams into actionable security incidents.

Use case design depends on whether the required log sources exist and are reliable, since detection logic cannot function on missing or malformed events. Data availability and quality therefore determine feasibility before rule authoring begins.

Encoded PowerShell commands (-enc) execute obfuscated, base64 payloads using a trusted, pre-installed Windows binary, so no malware is dropped. This native-tool abuse is the defining signature of Living off the Land, satisfying the stem's LotL indicator requirement.

AWS CloudTrail logs all API calls, including PutBucketAcl, which modifies an S3 bucket's ACL. The event record includes the bucket name, the identity of the caller, and the request parameters. By querying CloudTrail for PutBucketAcl events, the analyst can determine when and by whom the bucket was made public, directly addressing the investigation.

Embedded strings expose hard-coded artefacts such as C2 domains, IP addresses, file paths and registry keys without executing the sample, satisfying the static-analysis constraint. Unlike dynamic techniques, string extraction reads the binary's raw bytes directly, revealing infrastructure the malware author left in plaintext or lightly obfuscated.

Checking the CMDB's Business Criticality and Owner fields establishes whether the 50GB transfer to a known cloud storage IP is sanctioned backup activity, satisfying triage's need to validate intent before escalation. Asset context distinguishes routine scheduled replication from genuine exfiltration, letting analysts prioritise response accurately rather than treating every large transfer as malicious.

Azure Policy evaluates resource properties against defined rules and enforces compliance by denying non-compliant deployments or remediating existing resources. It satisfies the stem's requirement for automatic enforcement preventing unauthorised configuration changes, unlike role-based access control, which governs permissions rather than resource settings.

A SIEM aggregates and correlates logs from firewalls, endpoints, identity and cloud sources into one platform, giving analysts a single pane across otherwise siloed layers. That consolidation is the core advantage over per-tool monitoring, satisfying the stem's centralisation requirement.

Physical memory is highly volatile and contains running processes, network connections, and encryption keys that vanish on reboot. Capturing RAM first aligns with the order of volatility and preserves ephemeral evidence like the beaconing process and its C2 configuration. Waiting even minutes risks losing critical artifacts if the malware has a kill-switch or the system crashes.

Mapping existing log sources to high-prevalence ATT&CK techniques first reveals which common enterprise threats are already detectable and where telemetry gaps remain, directing coverage investment. This satisfies the stem's goal of maximising detection coverage proactively.

NTP ensures that all devices have synchronized clocks, which is fundamental for correlating events across different log sources. Using authenticated NTP prevents time spoofing. Without synchronized clocks, timestamps can drift, causing events to appear out of order and breaking correlation rules. This practice directly addresses the root cause of timestamp inconsistency.

TLS-based forwarding encrypts syslog or log payloads in transit using certificates, providing confidentiality and integrity between the remote web server and the SIEM. Plain TCP or UDP syslog sends cleartext, so TLS satisfies the requirement for the highest protection during transmission.

pdfid and pdf-parser are static analysis tools that examine PDF structure without rendering or executing it. They can list keywords like /JavaScript, /JS, /OpenAction, and /EmbeddedFile, which indicate potential malicious content. This directly answers whether the PDF contains JavaScript or an embedded executable, and it is fast and safe.

Browser hijacking manipulates browser settings such as the homepage, search engine and new-tab page, typically through malicious or unsigned extensions installed without consent. The unsigned extension altering the homepage directly matches this methodology, satisfying the stem's evidence of unauthorised browser configuration changes rather than credential theft or code execution.

Dynamic analysis executes the sample and observes its behaviour, so it demands a sandbox or isolated environment to contain infection. Static analysis inspects code without running it. This containment requirement is a defining operational difference between the two approaches.

A log source is any device or application that emits security-relevant events, such as firewalls, servers, or identity systems, which the SIEM collects and normalises. This definition satisfies the scenario's requirement to identify what feeds event data into the platform.

Run keys under the user's registry hive cause the referenced program to execute automatically each time that user signs in. An unsigned binary in AppData referenced from a Run key after a suspicious email attachment is a textbook persistence mechanism, ensuring the attacker's code survives reboots and re-establishes its foothold.

VPN providers publish known exit-node IP ranges, so matching the observed source IP against threat intelligence feeds of those ranges reveals whether traffic originated from a commercial VPN, undermining the attacker's IP-hiding attempt and supporting attribution.

Web server access logs, such as Apache's access.log or IIS logs, record each HTTP request with the source IP, timestamp, request method, URL, and status code. They capture the full URL including encoded characters, allowing the analyst to identify SQL injection patterns. By correlating the source IP across multiple requests, the analyst can determine if the activity is malicious. Access logs are the primary source for web request analysis.

The SIEM alert indicates that suspicious activity has been detected. The next step is analysis to determine if it is a true positive. This phase encompasses identifying and validating potential security incidents. The failed logins are a detection trigger, and the analyst must analyze the pattern to decide if it constitutes an incident, such as a brute force attack.

A false positive is a benign event misclassified as an attack, so the rate measures legitimate activity flagged as malicious. This directly satisfies the stem's request for what the metric indicates, distinguishing it from false negatives, which measure missed genuine threats.

APTs develop bespoke implants, exploits and tooling rather than reusing commodity malware, evading signature detection and tailoring capabilities to the specific target's defences. This customisation, combined with persistence and stealth, distinguishes APT campaigns from opportunistic attacks.

Threat Explorer provides real-time visibility into email and collaboration threats, including delivery status and user interactions such as URL clicks. It allows SOC analysts to filter by sender, recipient, and URL, and to see whether the message was blocked or delivered. This directly answers both the delivery and click-event questions in the scenario.

A hot tier for recent logs ensures fast search for active investigations. Transitioning to a warm tier, which still supports immediate search but at lower cost, meets the one-year retention with accessibility. This balances performance and cost, as warm storage is cheaper than hot but remains searchable.

VirusTotal aggregates results from over seventy antivirus engines and file-analysis tools, letting the analyst submit a hash and immediately see prior community detections without uploading the binary itself. This directly satisfies the requirement to check a file hash's reputation across dozens of engines, which no single-vendor sandbox or SIEM can match.

Automation rules evaluate findings against criteria such as severity label and can update fields, suppress findings, or route them. By matching HIGH and CRITICAL severity and setting a workflow status or suppressing informational findings, the team can ensure only high-severity findings proceed to the ticketing integration.

After containment, the NIST lifecycle moves to eradication, where the analyst removes malware, eliminates the root cause, and cleans affected systems. This phase ensures the threat is fully removed before recovery begins, making it the correct next step in the sequence for this malware outbreak.

Mentioning the security manager in the Work notes triggers ServiceNow's native notification engine, which routes an email or in-platform alert directly to that user's account. This satisfies the escalation requirement without altering assignment, state, or priority fields, keeping the ticket's audit trail intact while ensuring the manager is notified.

An SOP provides detailed, step-by-step instructions for routine operations. Defining the exact sequence of notifications, who to contact, and at what severity level is a classic operational procedure, making the SOP the correct document to update for this specific workflow requirement.

Excluding the scanner's IP and its known vulnerability signatures suppresses only those noisy detections while the SIEM continues logging and correlating all other activity from that host, preserving visibility without disabling monitoring of the scanner entirely.

Online URL analysis services like URLScan.io and VirusTotal allow analysts to submit URLs and receive detailed reports without exposing the corporate network. These services use sandboxed environments to visit the URL, capture screenshots, and analyze redirects, scripts, and associated files. They also provide community reputation data. This method is safe, efficient, and provides valuable threat intelligence, making it the best choice for analyzing a suspicious URL.

Firewall traffic logs record permitted and denied connections with source, destination, port and timestamp, letting investigators reconstruct the intrusion's ingress path, lateral movement and exfiltration attempts. This session-level evidence is essential for scoping the breach and identifying compromised hosts.

The netstat command with -a displays all connections and listening ports, -n shows addresses and port numbers in numerical form, -o includes the owning process ID, and -b shows the executable involved in creating each connection. This provides the process-to-connection mapping needed to identify malicious network activity on the live workstation.

Application logs typically record user actions, process IDs, and commands, providing the necessary context to identify who or what initiated the transfer. They can show authentication, file access, and transfer commands. This is the most direct source to determine if the transfer was authorized and by which user or process.

A static 500MB threshold ignores normal variation, so legitimate bulk transfers trigger noise. Baselining typical traffic volume per host or user and alerting on statistical deviation satisfies the accuracy requirement by flagging only genuinely anomalous exfiltration-sized transfers.

Registry Run keys, under HKCU or HKLM Software\Microsoft\Windows\CurrentVersion\Run, cause Windows to launch a specified program automatically at each user logon or system start. This satisfies the persistence requirement by surviving reboots without further attacker interaction, and requires only registry write access rather than a scheduled task or service installation.

Attackers often create services to maintain persistence, especially with binaries in non-standard locations like Temp and running with high privileges such as LocalSystem. The recent creation time and lack of change management approval further support malicious activity. This is a common technique mapped to MITRE ATT&CK's Create or Modify System Process: Windows Service (T1543.003).

AWS CloudTrail records S3 data and management API activity, including the identity, timestamp and source of each bucket request. Consulting its event history satisfies the stem's requirement to review API calls made to the bucket during triage.

This is the correct triage step. The analyst must validate whether the alert is a true positive by enriching the source IP with threat intelligence (e.g., known malicious IPs) and examining the account's normal behavior. If the IP is external and the logon is unusual, it indicates a successful compromise. This evidence-based approach ensures appropriate prioritization and response.

DNS resolver query logs provide a searchable, timestamped record of every query, including query name, type, and client. This is the primary data source for detecting DNS tunneling behavior such as high-volume TXT queries to a single external domain. Forwarding these logs to the SIEM enables fast aggregation and anomaly detection without manual packet analysis.

Raising the failed-attempt threshold within the lookback window means the correlation search only fires once genuinely abnormal volumes occur, filtering out the low-count bursts that generate the false positives while preserving detection of real brute-force activity.

The timestamp includes a +02:00 offset, meaning the local time is two hours ahead of UTC. To convert to UTC, subtract two hours from the local time. Thus, 14:23:45 becomes 12:23:45 UTC. This correctly accounts for the time zone offset and ensures the event is ordered accurately in the SIEM.

A suspicious sender address is a primary phishing indicator: mismatched domains, spoofed display names or lookalike characters reveal deception attempts. Monitoring it lets analysts correlate the sender against known-bad lists and block the campaign's origin.

Dashboards aggregate and render correlated event data as charts, tables and timelines. This visualisation lets analysts monitor trends, spot anomalies and track security posture over time, rather than reviewing individual raw log entries in isolation.

AWS CloudTrail logs all API calls, including those made with temporary credentials from an assumed IAM role. The logs include the role's session name and the identity of the role, allowing the analyst to trace actions back to the specific instance or role. By filtering CloudTrail events by the role's ARN or session name, the analyst can see what actions were performed and from which IP address.

Process Monitor captures real-time file system, registry and process/thread activity in a single unified event stream, letting you filter by process name to see precisely which files and registry keys the persistent malware touches as it executes.

Checking whether the firewall allowed or blocked the outbound connection establishes whether the threat is real or already contained, which determines the urgency and direction of the remaining triage. This verification precedes host isolation or escalation, since a blocked connection requires no containment action.

Event ID 4104 records PowerShell script block logging, capturing the actual command text executed. It fires when PowerShell logs a script block to the operational log, giving analysts the decoded commands. Other IDs cover engine lifecycle or module loading, not executed command blocks.

Cloud Storage Data Access logs record object-level operations, including `storage.objects.get` calls that name each file read from a bucket. This satisfies the requirement to identify specific file names during exfiltration, since Admin Activity logs only capture configuration changes, not per-object reads.

Recording each affected host's current status gives responders the live containment picture: which systems are isolated, powered off, or still compromised. This satisfies the report's requirement to document containment progress, enabling stakeholders to verify that no threat remains active before recovery begins.

Event ID 4769 is logged when a Kerberos service ticket is requested. Encryption type 0x17 is RC4-HMAC, which is weak and commonly requested by Kerberoasting tools. Filtering for non-machine accounts with an SPN reduces noise from legitimate computer accounts. This combination directly identifies the behavior of requesting a crackable service ticket for a user account.

Automated playbooks execute predefined response actions—isolating endpoints, disabling accounts, blocking indicators—directly from SIEM alerts, satisfying the stem's demand for effective incident response. They cut containment time from hours to seconds, ensuring consistent, repeatable handling of detected threats without waiting for manual analyst intervention.

A forensic image creates a bit-for-bit copy of the disk, preserving all data including deleted files, slack space, and metadata. This is essential for legal proceedings and detailed analysis. Performing this before remediation ensures that no evidence is altered or destroyed. The image can later be analyzed without touching the original, maintaining chain of custody and allowing for verification via hashing.

A suspicious domain name is a network-based IoC because it describes an indicator observable in network traffic, such as DNS queries or HTTP requests, rather than host artefacts like file hashes or registry keys. This satisfies the question's requirement for an indicator tied to network communications.

Business impact determines how much revenue, productivity or reputation is affected, directly driving whether an incident is rated low, medium or critical. It is one of the three factors, alongside data sensitivity and affected scope, used to assign severity.

A sandboxed or isolated browser environment contains any malicious payload the link delivers, preventing compromise of the investigator's host system. This satisfies the phishing investigation constraint by allowing safe observation of redirects, drive-by downloads and credential-harvesting pages without exposing production credentials or data.

/etc/logrotate.conf is logrotate's primary configuration file, holding global directives such as rotation frequency, retention count and compression. It satisfies the stem's requirement for defining retention and compression settings, and typically includes per-application stanzas from /etc/logrotate.d/, making it the correct location.

Level 3 requires documented, standardised processes applied across the organisation, yet still permits reliance on manual effort. Since automation is absent, the SOC sits at Level 3 rather than Level 4, where processes are quantitatively measured and managed.

certutil.exe is a signed Microsoft binary abused for downloading payloads, decoding Base64 files, and installing certificates. Legitimate non-administrative use is rare, so its invocation by a standard user satisfies the stem's LotL detection constraint and warrants immediate investigation.

A known malicious IP address is observable evidence that a system or network has been breached or targeted, which is exactly what an Indicator of Compromise represents. It is artefact-based and can be matched against logs or traffic, unlike a vulnerability or a control weakness.

The windows.psscan plugin scans memory for pool tags associated with process objects, allowing it to find processes that may have been unlinked from the active process list by rootkits. It can detect hidden or terminated processes that are not visible in windows.pslist. This makes it essential for identifying stealthy malware that attempts to hide its process.

Understanding the user's baseline behavior is crucial. If the user typically accesses the file server during business hours from the office, the 3:00 AM access from a foreign IP is highly anomalous. However, if the user is on vacation and has a history of remote access, it might be legitimate. Comparing current activity against the established baseline is the most reliable way to determine if the activity is malicious.

Regular, machine-timed beaconing to a rare external endpoint with non-browser TLS characteristics is the defining network signature of command and control. The implant is checking in for tasking and the self-signed certificate and unusual JA3 reinforce that this is attacker infrastructure rather than legitimate application traffic.

GuardDuty's S3 protection analyses CloudTrail management events by default, but detecting unusual object-level activity such as GetObject or PutObject requires S3 Data Events enabled on the target buckets. That data source supplies the object-level telemetry the scenario demands.

Authentication logs show where and when the compromised account logged in, while endpoint telemetry reveals what actions were performed on those systems. Correlating these sources provides a comprehensive view of the attacker's movements and accessed resources. This is the most effective method to determine the scope of compromise, as it covers both access points and post-authentication activity.

The lookback window sets how far back the correlation engine examines events when evaluating a rule, so related activity spread across time is grouped. It bounds the temporal scope of analysis, preventing unrelated older events from triggering the rule.

Reviewing the user's file access history helps establish a baseline and identify anomalies. If the user has never accessed this file share before or is accessing an unusual volume of files, it increases suspicion. This action provides valuable context for triage, allowing the analyst to determine if the behavior is consistent with the user's role or indicative of malicious intent.

The time window must match realistic attack velocity: too long dilutes the attempt rate below threshold, too short misses slower attacks. Calibrating it against observed attempts per second ensures the rule fires on genuine brute force rather than normal authentication noise.

MTTA measures the interval from alert detection to an analyst acknowledging and beginning work on it, directly exposing delays between detection and assignment. MTTR would obscure this, since it spans the entire incident lifecycle through to resolution, masking the specific escalation bottleneck the audit identified.

EDR solutions continuously record detailed process-level activity, including network connections initiated by each process. This telemetry directly links a specific process (and often the user context under which it runs) to the outbound connection, providing the most direct evidence of responsibility.

Active network connections exist only while sessions remain open; they disappear once endpoints close or the host reboots. Capturing connection tables early preserves volatile evidence such as remote IPs and ports, satisfying the order-of-volatility requirement.

Command and Control exists so compromised hosts can receive tasking from the operator, satisfying the requirement to obtain instructions. The C2 channel carries inbound commands to the implant, distinguishing it from exfiltration or lateral movement, which handle outbound data and internal propagation respectively.