201 questions total · 3pages · All types, answers revealed
Page 3 of 3
Which of the following describes 'Event Correlation' in a SIEM?
Correlation provides the 'story' behind individual events.
Why this answer
Correlation relates disparate events to identify a security threat.
In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?
This phase formally identifies the incident and its characteristics.
Why this answer
The Detection and Analysis phase focuses on identifying, validating, and scoping the incident.
You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?
These are the fundamental entities of any security incident.
Why this answer
Context like the source, destination, and user activity is required to assess risk.
Which TWO items are part of the 'Lessons Learned' process?
Core goal of the meeting.
Why this answer
Identifying what went wrong and what went right improves future responses.
You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?
Event ID 4698 captures scheduled task creation.
Why this answer
The Task Scheduler event logs, specifically Event ID 4698, document the creation of scheduled tasks.
You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?
Event ID 4104 records the full content of executed PowerShell blocks, including dynamically generated commands.
Why this answer
Script Block Logging (Event ID 4104) captures the full, de-obfuscated script content, making it the gold standard for PowerShell analysis.
This indicates whether MFA was satisfied.
You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?
The Process Tree displays the parent-child relationships of execution.
Why this answer
The Process Tree in CrowdStrike Falcon visualizes the genealogy of the process that triggered the detection.
You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?
Scheduling restricts when the rule evaluates data.
Why this answer
Time-based scheduling is a core feature for managing alert relevance in SIEMs.
You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?
UPN is a unique identity anchor.
Why this answer
The UPN (User Principal Name) or SID provides the unique identifier needed for correlating activity across multiple disparate systems.
Which THREE of the following are common challenges in SIEM correlation rule development?
Noise is the biggest challenge in SIEM.
Why this answer
Noise, data quality, and skill requirements are major challenges.
During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?
This command lists current SMB sessions.
Why this answer
The 'net sessions' or 'net file' command provides info on local sessions, but 'Get-SmbSession' is the modern PowerShell equivalent for this analysis.
Which TWO actions should be taken when you find a rogue VM in your GCP environment?
Crucial for capturing the state before investigation proceeds.
Why this answer
Isolating the VM (network restrictions) and taking a disk snapshot for forensic analysis are the mandatory first steps in response.
Which document should you reference first to determine the communication path during a high-severity security incident?
IRP provides the necessary communication structure.
Why this answer
The Incident Response Plan (IRP) specifically defines the roles, responsibilities, and communication channels for incidents.
You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?
Context from threat intel is vital for triage.
Why this answer
Cloud-based IPs are often legitimate proxies or malicious botnets; context is key.
An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?
Frequently used by malware to run at specific intervals or boot.
Why this answer
Persistence mechanisms ensure malware survives reboots or user logoffs; common locations include scheduled tasks, registry keys, and startup folders.
When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?
Regex allows for precise extraction of fields from log lines.
Why this answer
Regular Expressions (Regex) are the industry standard for extracting specific patterns from unstructured string data.
In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?
Defender for Servers provides EDR capabilities to monitor processes on virtual machines.
Why this answer
Microsoft Defender for Cloud (specifically the Endpoint protection or integrated EDR) provides process-level visibility and alerts for suspicious activity on VMs.
Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?
The aggregator is the central hub for receiving and parsing.
Why this answer
The Log Aggregator (or collector) receives data, normalizes it, and routes it to storage.
Which SIEM feature is used to group related events into a single incident?
Correlation links disparate events into meaningful incidents.
Why this answer
Correlation engines or incident management modules group events based on shared attributes.
An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?
This field tracks data egress volume.
Why this answer
In common flow logs like NetFlow or firewall logs, 'bytes_sent' or 'bytes_out' indicates the amount of data transferred.
You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?
Errors in logs will point to the root cause (e.g., certificate expiry).
Why this answer
Checking the SIEM ingestion logs or agent logs is the logical step to identify why the data is not reaching the SIEM.
Which TWO metrics are essential for measuring the efficiency of an incident response team?
Direct measure of response speed.
Why this answer
MTTR and total number of incidents handled are standard metrics for operational efficiency.
During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?
Memory is volatile and must be captured before disk.
Why this answer
Always capture volatile memory first, then disk, as memory changes constantly.
You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?
DIE is the standard tool for identifying if an executable is packed or protected.
Why this answer
Detect It Easy (DIE) is a tool that identifies file types and packers based on entropy and signature analysis.
While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?
WHOIS contains registration history and dates.
Why this answer
WHOIS databases provide registration details for domain names.
You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?
Hashing allows you to detect unauthorized changes.
Why this answer
Cryptographic hashing of log files at intervals provides an verifiable proof of log integrity.
During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?
The -p flag shows the PID associated with the socket.
Why this answer
The 'netstat -tulnp' or 'ss -tulnp' command shows the process ID alongside the listening socket.
Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?
This role focuses on SIEM rules and tuning.
Why this answer
The SOC Engineer manages the underlying SIEM infrastructure and rule efficacy.
Which THREE actions are appropriate during the eradication phase of a malware incident?
Prevents re-infection.
Why this answer
Cleaning the malware, patching the vulnerability, and scanning the environment are core eradication steps.
You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?
wecutil es displays the status of event subscriptions.
Why this answer
wecutil es (enum-subscriptions) is the standard utility for managing and checking WEF subscriptions.
An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?
The Unified Agent is specifically designed for cross-environment collection.
Why this answer
The Unified CloudWatch Agent is designed to collect logs and metrics from both EC2 and on-premises servers.
What is the primary function of a SIEM collector?
Collectors act as the ingestion point for the SIEM.
Why this answer
Collectors gather data from various sources and forward it to the main processing engine.
You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?
VirusTotal checks hashes against a massive engine database.
Why this answer
VirusTotal aggregates results from multiple AV vendors, providing a comprehensive report on a file hash.
You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?
COM hijacking is a sophisticated method used for persistence.
Why this answer
Run keys, Services, and COM hijack locations are classic persistence vectors.
When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?
Frequent polling is required for near-real-time alerts.
Why this answer
API polling intervals are the most common source of latency in cloud log ingestion.
During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?
Isolation is the primary containment step.
Why this answer
Isolating the affected asset prevents lateral movement before moving to eradication.
A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?
Direct workstation-to-workstation connections on administrative ports are highly suspicious.
Why this answer
Success/Failure logs and network connection logs are essential for detecting lateral movement attempts.
Which TWO of the following are primary components of a cloud-native incident response plan?
Containment is necessary to stop the spread of the incident.
Why this answer
Containment and Eradication are essential phases in the standard NIST IR lifecycle as applied to cloud environments.
When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?
Stale intelligence leads to false positives and inefficient alerting.
Why this answer
Actionable intelligence must be context-rich, relevant to the infrastructure, and integrated into existing workflows.
What is the primary benefit of 'Threat Intelligence' integration in a SIEM?
Context allows analysts to make informed decisions.
Why this answer
Threat intelligence provides context (IP reputation, malware hashes) to events.
Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?
Scanning is a primary recon activity to map the attack surface.
Why this answer
Reconnaissance involves gathering information to identify vulnerabilities before launching an attack.
You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?
SCC monitors IAM policies and detects misconfigurations.
Why this answer
Security Command Center (SCC) provides a dashboard of findings, including misconfigurations and overly permissive IAM roles.
During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?
C2 beacons exhibit low variance in time intervals, unlike human-generated traffic.
Why this answer
Calculating the time delta between connections is the standard method for identifying the consistent heartbeat of C2 beacons.
You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?
Joins are essential for correlating disparate data sources.
Why this answer
Joins allow for the association of different data types based on common entities like IP addresses or hostnames.
Which THREE elements are essential in an incident notification email to senior management?
Management cares about the bottom line.
Why this answer
Management needs to know the impact, current status, and next steps.
Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?
DNS tunneling uses small, frequent requests to move data.
Why this answer
Exfiltration is characterized by large, anomalous outbound transfers and the use of unusual protocols.
Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?
Security Hub is the central console for AWS security findings.
Why this answer
AWS Security Hub aggregates findings from various AWS security services like GuardDuty, Inspector, and Config into a single view.
Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?
RBA aggregates risk, reducing individual alert noise.
Why this answer
Tuning thresholds and using risk-based alerting are key strategies.
In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?
Sign-in logs are the primary source for identity-based access investigation.
Why this answer
Azure AD (Microsoft Entra ID) Sign-in logs provide detailed information about user authentication attempts, including risk flags and location data.
When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?
High-value assets require immediate attention regardless of the attack type.
Why this answer
Asset criticality helps determine the priority of an incident in a real-world SOC environment.
Page 3 of 3
Practice 312-39 by domain
Target a specific domain to shore up weak areas.