Certified SOC Analyst (312-39) (312-39) — Questions 151–225

Windows Security logon events (4624, 4625, 4648) record logon type, source workstation and account, exposing pass-the-hash or remote interactive logons that reveal lateral movement across hosts. This directly satisfies the stem's requirement to detect movement between systems, which firewall or application logs cannot show.

Beaconing malware typically communicates with its C2 server at fixed intervals (e.g., every 60 seconds) to check for instructions. These connections often have similar packet sizes and occur with clock-like regularity, which stands out from normal user traffic that is bursty and varied. This pattern is a strong, reliable indicator of automated C2 communication.

CloudTrail records every API call as a management event, including the caller identity, action name, timestamp and source IP address. Querying its event history therefore reveals the exact API invocation and originating IP behind the unauthorised role login.

Low and slow exfiltration keeps each transfer small, so volume thresholds never trigger. Baselining normal outbound volume per host or destination and alerting on sustained deviations exposes the gradual, cumulative data movement that signature-based tools miss.

The Unified Audit Log records Exchange mailbox auditing events including New-InboxRule, Set-InboxRule, and forwarding configuration changes. Searching this log for the New-InboxRule operation tied to the compromised user returns the rule parameters such as ForwardTo and the client IP, directly answering the investigation question.

Defining retention periods satisfies legal, regulatory and storage constraints by specifying how long each log class is kept before archival or deletion. Without explicit retention, logs either accumulate indefinitely or are purged prematurely, undermining forensic investigations and compliance audits.

Escalation is warranted when analysis confirms genuine malicious activity or unauthorised access, since that demands incident response beyond triage. Confirmed intent or access distinguishes a real breach from benign anomalies that can be closed at tier one.

Kerberoasting requests service tickets for SPNs and cracks them offline. Event 4769 logs TGS requests; encryption type 0x17 (RC4-HMAC) is weaker and often used by attackers. Alerting on RC4 tickets for non-standard service accounts catches the attack while reducing noise from legitimate AES requests, making it the most effective detection.

Expanding monitoring scope increases the volume and variety of data, which can overwhelm existing staff and processes. Without additional analysts or automation, the team may struggle to triage and detect incidents promptly, leading to longer detection times. This is a common cause of increased MTTD in growing SOCs. Therefore, this is the most likely cause.

Hashing both source and copy with the same algorithm (SHA-256) produces matching digests, proving bit-for-bit integrity and that no alteration occurred during acquisition. This satisfies the stem's requirement to verify evidence integrity immediately after copying, establishing the copy's admissibility as an exact duplicate.

Integrating IOCs into the SIEM as correlation rules enables real-time detection of known malicious IPs, domains, or file hashes. This is a standard proactive use of threat intelligence, turning static indicators into actionable alerts. It allows the SOC to detect and respond to threats that match the IOCs, directly supporting proactive defense.

DNS tunneling often uses TXT records to exfiltrate data because they can carry more data. Long, random subdomains indicate encoded data, and large responses suggest data is being returned. This combination is highly suspicious and not typical of normal DNS traffic.

Proxy logs capture outbound HTTP/HTTPS requests with timestamps, destinations, and user agents. Analyzing them for repeated requests to the same external domain at consistent intervals is a classic beaconing detection method. The regularity and repetition distinguish C2 from normal browsing. This source is directly relevant to identifying periodic command-and-control callbacks.

Ransomware families usually leave a ransom note in each encrypted directory or on the desktop. These notes often contain the variant name, instructions for payment, and sometimes a unique identifier or onion address. This information is critical for identifying the specific ransomware strain and checking for known decryption tools. The note is a high-value, easily accessible artifact that can quickly guide the investigation and response.

Determining the business impact of the affected asset establishes how critical the system is to operations, data sensitivity, and revenue. This severity assessment is a core triage step, guiding prioritisation and escalation decisions during alert investigation.

A long-lived outbound connection from an infected process to known attacker infrastructure, especially over an unusual port like 4444, is the defining characteristic of command and control. The use of rundll32.exe loading a DLL from AppData indicates the malware is running in a stealthy manner and awaiting or exchanging instructions. This phase follows initial compromise and precedes actions on objectives, matching the observed traffic.

Legal and industry frameworks mandate minimum retention windows; GDPR, HIPAA and PCI DSS each prescribe distinct periods and breach-investigation obligations. Aligning SOC retention with these requirements satisfies the stem's compliance factor, preventing premature deletion of evidence needed for audits, legal holds or regulatory reporting.

Syslog is the standard event transport for forwarding device and server logs to a SIEM collector, typically over UDP or TCP port 514, making it the common ingestion protocol for firewalls, routers and Unix hosts.

A newly created service name is a host-based indicator because it is recorded in the endpoint's local service configuration, such as the Windows Service Control Manager registry entries. This satisfies the stem's host-based constraint, since the artefact resides on the compromised machine itself rather than in network traffic or directory data.

The process tree and command line reveal the parent process and the exact DLL path, which are essential to determine whether this is a known software updater or a malicious loader. Rundll32 is frequently abused to execute DLLs, so the arguments distinguish legitimate use from an attacker's export function call. This evidence drives all subsequent triage decisions.

Standardised handover and documentation directly satisfies the Follow-the-Sun constraint: work must pass between geographically dispersed analyst teams without losing context. Structured shift handovers, shared ticket notes and consistent escalation records ensure the incoming region inherits full incident state, preventing duplicated triage or dropped investigations across time zones.

Windows Scheduled Tasks provide a durable, recurring execution trigger that survives reboots, making them a favoured persistence mechanism. Monitoring task creation, modification and unexpected run times satisfies the stem's persistence-detection requirement, since attackers register tasks to relaunch payloads after logoff or restart without maintaining an active session.

Searching email gateway logs for the sender address and subject line is an effective way to find other recipients of the same phishing email. This helps identify the scope of the attack and potential additional victims. It is a standard triage step to determine if the phishing campaign was targeted or widespread.

TCP provides connection-oriented delivery with acknowledgments, so the sending syslog daemon can detect when the central server is unreachable and retry or queue messages. UDP, by contrast, offers no delivery guarantee and can silently drop messages during network congestion or brief outages, making TCP the appropriate choice when reliability is required.

TCP provides connection-oriented, acknowledged delivery, so the collector retransmits lost segments until the aggregator confirms receipt. This satisfies the stem's requirement for delivery confirmation between collector and aggregator, unlike connectionless UDP, which offers no acknowledgement and silently drops logs under congestion.

Automated sandboxing platforms instrument API calls and collect file system, registry, and network telemetry into a single correlated report, which is exactly the combined visibility the analyst needs. They also capture function arguments and often include behavioral signatures, making them the most efficient way to observe a sample's real-time interactions without manually wiring multiple monitors together.

Data Access audit logs record API calls that read or write user data, such as reading from a Cloud Storage bucket or querying a database. They can reveal if the compromised service account accessed sensitive data, which is essential for assessing data exfiltration or unauthorized access.

User-writable directories such as C:\Users\Public\ and C:\Windows\Temp\ let any unprivileged process drop and execute payloads, so a scheduled task pointing there signals attacker staging rather than a vendor update, which would run from Program Files or a signed system path.

The parent 'wscript.exe' launched from an email attachment is a classic spearphishing attachment vector, and the child PowerShell with '-enc' and hidden window indicates an encoded payload execution. This combination maps directly to the spearphishing attachment technique followed by script-based execution, making it the most strongly indicated technique in this scenario.

Replacing the instance's Security Group with one denying all inbound and outbound traffic severs network access while the EBS volume and instance state remain intact, satisfying the stem's requirement to isolate without deleting the volume.

STIX observable types (IP, domain, file hash) must be translated into the SIEM's own incident categories and severity levels, otherwise automated ingestion produces alerts that cannot trigger the internal response workflow. This mapping is the mandatory setting linking feed data to that workflow.

WinPmem is a reliable tool for capturing physical memory on Windows systems without requiring a reboot or shutdown. Capturing memory first preserves the most volatile evidence, including running processes, network connections, and potentially malicious code. The server remains operational, minimizing disruption to critical services. This aligns with the order of volatility, where memory is more volatile than disk.

Command and Control exists so compromised systems can receive instructions and exfiltrate results; the channel must remain persistently available across the intrusion. Maintaining persistent communication satisfies that requirement, distinguishing C2 from one-off actions such as Initial Access or Execution.

A Managed Security Service Provider (MSSP) remotely delivers monitoring, detection and response as an outsourced service, while the client retains ownership of its security posture and policies. This satisfies the constraint of outsourcing monitoring yet keeping internal control.

Automating threat intelligence enrichment allows the SIEM to automatically match alerts with external feeds, reducing manual effort and accelerating detection. This directly addresses the root cause of increased MTTD: manual correlation. By integrating feeds, analysts receive enriched alerts with context, enabling faster triage and response. This is a standard SOC efficiency improvement and aligns with the goal of reducing detection time without adding headcount.

Azure AD sign-in logs provide details about each sign-in attempt, including the applied conditional access policies, the risk level, and the location. They are designed for exactly this investigation. The analyst can filter by user, application, and status to see why the sign-in was flagged. This is the correct log for reviewing sign-in risk and policy evaluation.

Volatile memory holds encryption keys, running processes and unflushed data that a reboot would destroy, hampering forensic analysis and recovery. Disconnecting the network first isolates the host, blocking lateral spread and command-and-control traffic, while preserving that volatile evidence for investigation.

Tier 1 analysts perform initial alert triage, validating whether events are genuine incidents before escalation. This filtering role matches the manager's requirement for basic incident sorting, keeping Tier 2 and Tier 3 focused on deeper investigation and response.

Cloud Audit Logs record all API calls made in a GCP project, including the identity of the caller, the source IP address, and the specific API method. For service account key usage, the logs show the service account email and the caller's IP. By querying Cloud Audit Logs for Cloud Storage API methods, the analyst can determine if the key was used from an unauthorized location and identify the exact method invoked.

Isolating the workstation is the first containment step to prevent further communication with the malicious IP and potential lateral movement. This action stops the immediate threat while allowing the analyst to investigate. It is a standard incident response procedure for suspected malware or command-and-control communication. Once isolated, the analyst can safely perform forensic analysis and remediation.

Excluding the scanner's IP stops its benign traffic from generating alerts, removing the false positives without weakening detection of genuine threats. Tuning the rule this way is the standard approach for known, trusted internal sources.

Logstash is the data processing pipeline of the ELK Stack. It ingests data from multiple sources, parses and transforms it using filters (e.g., grok, mutate), and outputs it to a destination like Elasticsearch. In this scenario, Logstash is the component that would parse Windows Event Logs, syslog, and network logs into a common format, making it the correct answer.

DNS tunneling encodes data in subdomain labels, producing many queries with long, random-looking (high-entropy) labels to a single domain. Volume and label entropy are strong indicators. This query captures the exfiltration pattern without flagging normal DNS traffic, making it the most effective proactive detection for tunneling.

This registry key contains configuration for Windows services. Malware can create malicious services to run with high privileges and start automatically at boot. Services are a powerful persistence mechanism because they can run in the background without user interaction. Analysts should examine this key for suspicious service names, unusual binary paths, or recently modified entries. It is a common location for advanced malware and rootkits.

Firewall logs show whether the outbound connection was allowed and can provide details like source and destination ports, bytes transferred, and duration. This helps confirm if data actually left the network and the volume of transfer. It complements EDR data by providing network-level evidence. If the firewall blocked the connection, the exfiltration may have failed, changing the incident severity and response.

Running a sweep queries historical endpoint telemetry for past occurrences of the IOC, revealing earlier compromises that point-in-time detection missed. This satisfies the proactive requirement by converting a single finding into retroactive hunting across the estate.

The service 'UpdaterSvc' with an ImagePath pointing to a suspicious unsigned binary in a Temp folder, set to auto-start and run as LocalSystem, is a classic sign of persistence via service creation. Attackers often create or modify services to maintain access with high privileges. The registry key HKLM\SYSTEM\CurrentControlSet\Services\UpdaterSvc would contain this configuration. This method survives reboots and is a common technique.

Inadequate logging visibility extends dwell time because undetected malicious activity continues unobserved; without sufficient telemetry, analysts cannot identify the initial compromise, so the gap between intrusion and discovery widens, directly satisfying the stem's dwell-time factor.

The true positive rate (also known as recall or sensitivity) measures the proportion of actual positive cases that were correctly identified. In the context of threat intelligence-driven prioritization, it reflects how many high-risk alerts were correctly confirmed as true positives, directly answering the manager's question.

Stack counting command-line arguments across the estate reveals whether the encoded PowerShell pattern is rare or widespread, satisfying the need to distinguish malicious activity from routine administration. Legitimate administrative scripts recur predictably, whereas attacker tradecraft produces outliers; frequency analysis surfaces those deviations without relying on signature detection.

Firewall logs are a standard SIEM source, capturing permitted and denied traffic with source and destination IP addresses, ports and protocol. Ingesting them satisfies the stem's requirement for a recognised log type, enabling correlation of network events with other telemetry for threat detection and incident investigation.

Requirement gathering and scoping comes first, defining the threat scenarios, log sources and detection logic before any data onboarding or rule authoring. Skipping it produces use cases misaligned with business risk, so it anchors the SIEM development lifecycle.

Chain of Custody requires recording who handled the evidence, so documenting the collector's name establishes accountability and links the artefact to a responsible person. This identity record, alongside timestamps and transfer details, proves the evidence remained unaltered from seizure onward.

Process Explorer provides a hierarchical view of processes, including parent-child relationships, command-line arguments, and loaded DLLs. In this scenario, the analyst can immediately see that svchost.exe is running from an unusual path and check its parent process (e.g., explorer.exe instead of services.exe), which is a strong indicator of compromise.

Checking the reputation of the destination IP is a quick and effective first step to assess whether the transfer is likely malicious. If the IP is associated with known malicious activity, it strongly indicates a true positive. This action provides immediate context without disrupting operations, and it can be done rapidly using integrated threat intelligence in the SIEM.

The 'Task To Run' field specifies the executable or command that the scheduled task launches. This is the most critical field because it reveals what the task actually does. Malicious tasks often run scripts, PowerShell commands, or binaries from unusual locations. By examining this field, an analyst can identify suspicious actions like encoded PowerShell or execution from temp directories, which are strong indicators of persistence.

An SSL/TLS intercepting proxy terminates the malware's TLS session and re-establishes a separate one to the destination, decrypting content in transit. This satisfies the stem's constraint of inspecting encrypted C2 traffic without possessing the malware's private key, since the proxy presents its own trusted certificate to the client.

PCI-DSS requires audit trail history retention of at least twelve months, with the most recent three months immediately available for analysis. Keeping logs for one year with three months online satisfies both the retention duration and the rapid-access constraint that auditors and incident responders demand.

The random 10-character subdomains under a single domain, queried at regular intervals with NXDOMAIN responses, match DGA behavior where malware generates many candidate domains to locate its C2 server. The NXDOMAINs indicate the generated domains are not registered, a common pattern until the actor registers one. Regular 60-second intervals further support automated beaconing.

Event ID 4104 is generated when a script block is executed and Script Block Logging is enabled. It contains the actual PowerShell code, including obfuscated or malicious scripts. This is crucial for proactive detection because it reveals the intent and functionality of scripts.

Correlating proxy and DNS logs provides context about when the domain was first contacted, how frequently, and whether other hosts are involved, all without altering the endpoint. This supports a true-positive determination and enriches the escalation package. Because it is passive log analysis, it preserves volatile evidence on the workstation and avoids tipping off an attacker, making it the best triage step before incident response engagement.

Replaying the rule against historical log data validates that it fires as intended and surfaces false positives before production deployment. This satisfies the development process requirement by proving detection logic and tuning thresholds prior to operational rollout.

Recording why the alert was dismissed as a false positive creates an audit trail and supports later tuning. Without documented rationale, reviewers cannot distinguish genuine benign activity from an overlooked threat, undermining the SIEM's evidentiary value.

Ten failures within one second far exceeds human typing speed, indicating a script, brute-force tool, or misconfigured service repeatedly retrying credentials. This rapid, uniform burst is the signature of automation rather than a user mistyping a password.

The log collector receives and normalises event data from disparate sources such as firewalls, servers and applications, forwarding parsed events to the analytics tier. Without this ingestion component, the SIEM has no raw telemetry to correlate, making it a primary architectural element.

Contacting the user directly verifies whether the unusual-location login is legitimate travel or an account compromise, satisfying the need to validate the alert before escalation. User confirmation provides authoritative context that geolocation and IP reputation alone cannot, letting you dismiss a false positive or trigger incident response appropriately.

NetFlow records provide summarized information about IP traffic flows, including source and destination IPs, ports, protocol, and byte counts. By analyzing outbound flows from the database server, the analyst can identify unusually large data transfers, which may indicate exfiltration. This method is efficient and does not require full packet capture, making it suitable for high-volume environments. It directly addresses the need to detect large outbound transfers.

IOCs are forensic artefacts such as hashes, IPs or registry keys that confirm malicious activity occurred. They let analysts validate that an incident is genuine and enumerate every affected host or account, directly satisfying the requirement to validate and scope the threat.

Categorising alerts by MITRE ATT&CK technique and prioritising them is triage: assessing, enriching and ranking detections to filter noise before deeper investigation. This phase directly reduces alert fatigue by focusing analyst effort on the highest-risk events.

A correlation rule joining user and location attributes detects the same account authenticating from geographically distant sources within one window, flagging impossible travel. This directly satisfies the stem's simultaneous multi-location constraint, which single-event log review cannot surface. Microsoft Entra ID sign-in logs supply the location fields the rule aggregates.

Outbound traffic to a sinkhole IP indicates malware beaconing to command-and-control infrastructure, since sinkholes are DNS or IP addresses that security teams redirect known C2 domains to. The compromised host satisfies the stem's constraint: it is attempting C2 communication, which the sinkhole intercepts and logs.

LSASS holds credential material, so unauthorised or unsigned processes requesting access to lsass.exe memory is the strongest behavioural indicator of credential dumping tools such as Mimikatz. It targets the specific access pattern rather than generic process or file activity.

Cisco ASA syslog severity level 6 (Informational) includes messages about normal but significant conditions, such as connection built and teardown events (e.g., %ASA-6-302013, %ASA-6-302014). These are essential for tracking outbound connections and identifying potential data exfiltration. Configuring level 6 captures these events without the excessive volume of level 7 (Debugging), which includes detailed packet-level information rarely needed for this analysis.

Eradication removes the root cause and residual artefacts of an incident, such as malware, compromised accounts or vulnerable services, so the threat cannot persist or recur. This directly satisfies the phase's primary goal of eliminating the threat before recovery begins.

Events parse but map to no QID, so QRadar cannot correlate them into offenses. Creating a custom DSM that maps the event IDs to existing QIDs restores normalisation, enabling the log source to contribute to offense creation as required.