Certified SOC Analyst (312-39) 312-39 Questions 301–328 | Page 5/5

301

MCQmedium

A SOC analyst is triaging a Microsoft Defender for Endpoint alert on a workstation. The alert shows 'lsass.exe' was accessed by an unsigned process named 'rundll32.exe' launched from a user's temp folder. The analyst needs to determine the appropriate triage priority. Which factor should most strongly influence the priority of this alert?

A.The alert should be deprioritized because rundll32.exe is a legitimate Windows binary and is commonly used by many applications.

B.The alert should be triaged only after all higher-severity server alerts are resolved, because endpoint alerts are inherently less urgent.

C.The alert was generated on a workstation rather than a server, so it should be treated as low priority.

D.The process accessing lsass.exe is unsigned and running from a user temp folder, which is a strong indicator of credential dumping activity.

AnswerD

Unsigned processes executing from user-writable temp directories and accessing lsass.exe memory match the behavioral pattern of credential dumping tools such as Mimikatz loaders. This combination of unsigned binary, suspicious path, and sensitive process access elevates the alert because it indicates an active attempt to harvest credentials, which is a high-impact threat requiring immediate investigation.

Why this answer

The strongest priority driver is the behavioral combination: an unsigned executable running from a user temp directory accessing lsass.exe. This matches credential dumping tradecraft and indicates an active attempt to steal credentials. Because stolen credentials enable lateral movement and privilege escalation, this alert warrants high-priority investigation regardless of whether the affected asset is a workstation or server.

Exam trap

The trap here is allowing the legitimate reputation of rundll32.exe to mask the malicious context of an unsigned parent process in a temp folder accessing lsass.exe.

Full explanation →

302

MCQmedium

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a handful resolving to short-lived IP addresses. The analyst wants to map this behavior to the most likely stage of the Cyber Kill Chain and the corresponding IOC category. Which of the following best describes this activity?

A.Weaponization using malicious macros as registry-based IoCs

B.Command and Control (C2) using Domain Generation Algorithm (DGA) domains as network-based IoCs

C.Exfiltration using DNS tunneling as file-based IoCs

D.Reconnaissance using DNS zone transfer attempts as host-based IoCs

AnswerB

DGA domains with high NXDOMAIN ratios and short-lived resolutions are classic C2 IoCs. The endpoint is attempting to locate its controller, which is the Command and Control stage of the Cyber Kill Chain. This matches the observed network behavior and the IOC category perfectly.

Why this answer

Algorithmically generated domains with many NXDOMAIN responses and occasional short-lived resolutions indicate a host trying to find its C2 server, which is the Command and Control phase. Because the evidence is DNS traffic, it is a network-based IoC. The other choices misattribute the phase or the IoC category.

Exam trap

The trap here is assuming any unusual DNS activity indicates exfiltration, when high NXDOMAIN churn with algorithmic names is actually a beaconing signature.

Full explanation →

303

MCQhard

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

A.The SIEM storage is full.

B.The polling interval for the API is set too high.

C.The cloud provider is down.

D.The SIEM license limit is reached.

AnswerB

Polling pulls events from the API at fixed intervals, so a long interval delays collection and therefore alert generation. Lowering the polling interval reduces that lag, directly addressing the high latency described in the stem.

Why this answer

The polling interval determines how frequently the SIEM queries the cloud provider's API for new log data. If this interval is set too high (e.g., every 15 minutes instead of every minute), logs accumulate between polls and alerts are only generated after the next poll cycle, producing the observed high latency. Reducing the polling interval (or switching to a push/streaming mechanism like webhooks or syslog forwarding) directly decreases alert generation delay.

Exam trap

The trap here is conflating capacity/availability failures (full storage, license limits, provider outage) with latency, when the question is specifically about delayed alerting caused by a configuration parameter — the polling interval.

How to eliminate wrong answers

Option A is wrong because a full SIEM storage volume would cause ingestion failures, dropped events, or write errors — not a consistent delay in alert generation while ingestion continues. Option C is wrong because a cloud provider outage would halt log delivery entirely and typically trigger its own availability alerts, rather than producing a steady latency pattern. Option D is wrong because reaching a license limit causes ingestion to stop or events to be dropped/rejected, not delayed alerting on events that are still being received.

Full explanation →

304

Multi-Selecthard

A SOC is implementing a new use case to detect credential dumping on Windows endpoints. The detection engineering team wants to combine multiple telemetry sources to reduce false positives and improve coverage. Which two data sources should be prioritized to reliably detect credential dumping activity? (Choose two.)

Select 2 answers

A.NetFlow records showing outbound traffic volume from the endpoint

B.Sysmon events for process access to the LSASS process

C.DHCP logs showing IP address leases for the endpoint

D.Windows Security event log entries for process creation with command-line arguments

E.Email gateway logs showing inbound messages with attachments

AnswersB, D

Sysmon event ID 10 records process access, including access to LSASS with suspicious granted access rights. This is a high-fidelity indicator of credential dumping because legitimate processes rarely request the memory-reading permissions that tools like Mimikatz require. Combining Sysmon process access with process creation telemetry gives both the action and the target, significantly improving detection accuracy and reducing false positives.

Why this answer

Credential dumping detection benefits from combining process creation telemetry, which shows what executed and with what arguments, and Sysmon process access events, which show suspicious access to LSASS. Together they provide both the actor and the target, enabling high-fidelity alerts. Network, DHCP, and email logs lack the endpoint process and memory access visibility required for this specific behavior.

Exam trap

The trap here is assuming that network-centric telemetry such as NetFlow can detect credential dumping, when the behavior is primarily local and requires endpoint process and memory access visibility.

Full explanation →

305

MCQhard

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

A.Reset all user passwords

B.Perform full forensic imaging

C.Run host isolation playbook

D.Update the firewall rule base

AnswerC

Running the host isolation playbook immediately severs network connectivity for the compromised endpoint, preventing lateral movement and further exfiltration. This directly satisfies the stem's requirement to move from Detection into Containment, since isolating the affected host is the fastest way to limit incident scope before deeper forensic investigation or eradication begins.

Why this answer

Host isolation is the fastest way to stop an active threat from spreading laterally or exfiltrating data, and it preserves the endpoint state for later forensics. In a SOAR playbook, isolation is typically the first automated containment action because it is reversible and low-impact compared to network-wide changes.

Exam trap

312-39 often tests the confusion between containment and eradication/recovery actions — candidates pick password resets or imaging when the question asks for the first containment step.

How to eliminate wrong answers

Option A is wrong because resetting all user passwords is disruptive, does not stop an active adversary already inside the environment, and is a remediation action rather than immediate containment. Option B is wrong because full forensic imaging is time-consuming and is an investigation/preservation step, not a containment action — imaging before isolation lets the attacker keep operating. Option D is wrong because updating the firewall rule base is a network-level change that requires knowing the C2 infrastructure; it is slower and less targeted than isolating the compromised host.

Full explanation →

306

Multi-Selecthard

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

Select 2 answers

A.Event ID 4769 with encryption type 0x17 (RC4) for service accounts that normally use AES.

B.A single user account requesting multiple Kerberos service tickets (TGS) for different SPNs within a short time window.

C.A service account being added to the Domain Admins group.

D.Event ID 4771 for Kerberos pre-authentication failures from a single source.

E.Event ID 4624 logon type 3 (network) from a workstation to a domain controller.

AnswersA, B

Kerberoasting tools often request RC4-encrypted TGS tickets because they are easier to crack. If service accounts are configured to support AES, a sudden RC4 request is anomalous. Event ID 4769 logs TGS requests; filtering for RC4 when AES is expected highlights potential Kerberoasting, as attackers downgrade encryption to simplify offline cracking.

Why this answer

Kerberoasting detection relies on identifying anomalous TGS requests. A user requesting multiple service tickets for different SPNs in a short window indicates enumeration, while RC4 encryption requests for accounts that normally use AES signal an attempt to obtain easily crackable tickets. Together, these behaviors provide high-fidelity detection with fewer false positives than generic logon or group-change events.

Exam trap

The trap here is focusing on authentication failures or group membership changes, which are unrelated to the ticket-request behavior that defines Kerberoasting.

Full explanation →

307

Multi-Selectmedium

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Select 2 answers

A.Network traffic logs showing SMB/RDP connections between workstations

B.System clock synchronization logs

C.Application logs for Microsoft Word

D.Browser cache logs

E.Windows Security Log - Event ID 4624 (Logon events)

AnswersA, E

Network traffic logs capture SMB and RDP sessions between workstations, revealing the connection patterns lateral movement produces. This satisfies the stem's requirement for detecting remote access techniques, since authentication logs alone may not show the network path used.

Why this answer

Option A is correct because network traffic logs capturing SMB (TCP 445) and RDP (TCP 3389) connections between workstations directly reveal lateral movement paths, such as workstation-to-workstation SMB sessions or RDP logins that deviate from normal patterns. Option E is correct because Windows Security Log Event ID 4624 records successful logon events, including Logon Type 3 (Network, typical of SMB) and Logon Type 10 (RemoteInteractive, used by RDP), which are essential for identifying remote access to a host. Option B is not relevant since system clock synchronization logs only concern time accuracy (e.g., NTP/W32Time) and do not record access activity.

Option C is not relevant because Microsoft Word application logs capture document or crash events, not remote access techniques. Option D is not relevant because browser cache logs only reflect web browsing artifacts and have no bearing on RDP or SMB lateral movement.

Exam trap

The trap is selecting generic log sources (application logs, browser cache) that seem plausible but lack authentication or network connection data — candidates must know that 4624 and SMB/RDP network logs are the specific artifacts for lateral movement.

Full explanation →

308

Multi-Selectmedium

Which TWO of the following are primary components of a cloud-native incident response plan?

Select 2 answers

A.Resource Provisioning

B.Budget Optimization

C.Hardware Refresh

D.Containment

E.Eradication

AnswersD, E

Containment is a primary component because it limits the blast radius once a cloud-native incident is detected, isolating compromised identities, workloads or network segments. It satisfies the stem's requirement for a core response phase, sitting between detection and eradication within the incident response lifecycle.

Why this answer

Containment (D) is a primary component of a cloud-native incident response plan because it focuses on limiting the blast radius of a compromise—for example, by isolating affected workloads, revoking IAM credentials, or applying security group and network policy changes to stop lateral movement. Eradication (E) is equally essential, as it removes the root cause and residual artifacts of the incident, such as deleting malicious containers or images, patching exploited vulnerabilities, and rotating compromised keys, before returning to normal operations. Together, containment and eradication form the core response phases that follow detection and analysis in frameworks like NIST SP 800-61.

Resource Provisioning (A) is an operational or infrastructure activity, not an incident response phase, and is not specific to handling security incidents. Budget Optimization (B) is a financial governance concern unrelated to incident response procedures. Hardware Refresh (C) is a lifecycle management task and is largely irrelevant in cloud-native environments where infrastructure is abstracted and ephemeral.

Exam trap

The trap here is confusing general cloud operational activities (provisioning, budgeting, hardware) with the formal incident response lifecycle phases — candidates must recall NIST SP 800-61 phases, not generic cloud management tasks.

Full explanation →

309

Multi-Selectmedium

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

Select 3 answers

A.Automate the expiration of indicators based on the intelligence aging policy

B.Store all raw intelligence feeds in an unindexed archive

C.Normalize data formats into the SIEM's schema

D.Filter indicators to remove those irrelevant to the current technology stack

E.Increase the TTL for all IP-based indicators to 'infinite'

AnswersA, C, D

Indicators decay as attackers rotate infrastructure, so stale entries generate false positives. Automating expiry against the intelligence aging policy enforces the stem's actionability requirement by removing indicators once their validity window lapses, keeping SIEM detections current.

Why this answer

Option A is correct because indicators have a limited useful lifetime; automating expiration according to the intelligence aging policy prevents stale IOCs (e.g., old malicious IPs or domains) from generating false positives and keeps detections actionable. Option C is correct because normalizing feeds into the SIEM's schema (mapping fields such as IP, hash, domain, and timestamps to a common taxonomy like STIX/TAXII or the platform's data model) makes indicators correlatable and searchable across heterogeneous sources. Option D is correct because filtering indicators irrelevant to the current technology stack (e.g., macOS malware hashes on an all-Windows estate, or unsupported protocols) reduces noise and ensures analysts focus on threats that can actually affect the environment.

Option B is not appropriate because dumping raw feeds into an unindexed archive makes the data unsearchable and unusable for real-time detection, defeating the purpose of actionable intelligence. Option E is incorrect because setting an infinite TTL on IP indicators guarantees indefinite false positives, since IP addresses are frequently reassigned and threat infrastructure changes rapidly.

Exam trap

The trap is that candidates confuse 'store everything' with 'be thorough,' when the exam is testing that actionable threat intel requires normalization, filtering, and lifecycle management — not hoarding raw feeds.

Full explanation →

310

MCQeasy

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

A.Increases the log ingestion rate.

B.Provides real-time context to alerts.

C.Replaces the need for a SOC team.

D.Automates all incident response.

AnswerB

Threat intelligence feeds enrich incoming events with indicators such as malicious IPs, domains and hashes, so alerts carry immediate context about known adversary infrastructure. This reduces triage time and improves prioritisation, which is the primary benefit sought from SIEM integration.

Why this answer

Threat intelligence integration enriches SIEM alerts with real-time context such as known malicious IPs, domains, file hashes, and adversary tactics. This context helps analysts quickly determine whether an alert is benign or part of a known campaign, improving triage speed and accuracy. It does not replace human analysts or automate response; it augments detection and investigation.

Exam trap

312-39 often tests whether candidates overstate threat intelligence as replacing SOC staff or automating response, when its actual primary benefit is providing real-time context to alerts.

How to eliminate wrong answers

Option A is wrong because threat intelligence enriches and contextualizes existing data; it does not increase the rate at which logs are ingested. Option C is wrong because threat intelligence is a supporting capability, not a replacement for the human judgment, hunting, and response a SOC team provides. Option D is wrong because threat intelligence informs decisions but does not by itself automate all incident response, which requires orchestration, playbooks, and human oversight.

Full explanation →

311

MCQeasy

A SOC analyst is reviewing security alerts in an AWS environment and notices a finding that an S3 bucket has been configured with public read access. The analyst needs to identify the IAM principal that made the bucket public. Which AWS service should the analyst check to find the identity that performed the PutBucketAcl or PutBucketPolicy action?

A.AWS Trusted Advisor

B.Amazon GuardDuty

C.Amazon S3 Access Logs

D.AWS CloudTrail

AnswerD

CloudTrail logs all API calls, including PutBucketAcl and PutBucketPolicy, and records the identity of the caller, such as an IAM user, role, or AWS service. By searching CloudTrail for these events, the analyst can determine which principal made the bucket public, along with the source IP and timestamp, which is essential for incident response.

Why this answer

CloudTrail is the definitive source for API activity in AWS, including S3 bucket configuration changes. It logs events like PutBucketAcl and PutBucketPolicy, along with the identity of the caller, enabling the analyst to pinpoint the responsible IAM principal. S3 Access Logs, Trusted Advisor, and GuardDuty each provide different types of information but lack the ability to identify the actor behind a bucket permission change.

Exam trap

The trap here is confusing S3 Access Logs, which record object-level access, with CloudTrail, which records bucket-level configuration changes and the identity of the caller.

Full explanation →

312

MCQmedium

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

A.netstat -ano

B.nslookup

C.arp -a

D.tracert

AnswerA

netstat -ano lists active connections with the owning process identifier in the final column, so the analyst can filter the output for PID 4212 and immediately map each connection to that process. The -a switch shows all connections and listening ports, -n keeps addresses numeric for speed, and -o appends the PID, making it the correct built-in choice for this live triage task.

Why this answer

The analyst needs a live mapping of connections to the owning process on a Windows host using only built-in tooling. The netstat utility with the -a, -n, and -o switches enumerates all connections in numeric form and appends the owning PID, allowing direct correlation to PID 4212. None of the other utilities expose socket ownership, so they cannot answer the question.

Exam trap

The trap here is assuming any network utility will reveal process ownership, when only netstat's -o switch (or equivalent Get-NetTCPConnection with OwningProcess) ties a connection to a PID.

Full explanation →

313

MCQhard

A SOC analyst receives an alert that a domain controller is generating a high volume of Kerberos ticket-granting service (TGS) requests with RC4 encryption for various service principal names. The analyst suspects a Kerberoasting attack. Which Windows event ID should the analyst prioritize to confirm the attack?

A.Event ID 4769 (A Kerberos service ticket was requested)

B.Event ID 4771 (Kerberos pre-authentication failed)

C.Event ID 4624 (An account was successfully logged on)

D.Event ID 4768 (A Kerberos authentication ticket (TGT) was requested)

AnswerA

Event ID 4769 is logged on domain controllers when a Kerberos service ticket is requested. In a Kerberoasting attack, an adversary requests TGS tickets for service accounts and extracts the encrypted portion for offline cracking. Analyzing 4769 events for RC4 encryption type (0x17) and unusual service names helps confirm the attack. This event directly corresponds to the TGS request behavior observed in the alert.

Why this answer

Kerberoasting exploits Kerberos TGS requests by requesting service tickets for accounts with SPNs and then cracking the encrypted ticket offline. Domain controllers log these requests as Event ID 4769. The presence of RC4 encryption (type 0x17) in 4769 events is a strong indicator because Kerberoasting tools often request RC4 tickets for easier cracking.

Monitoring 4769 for anomalous service names and encryption types enables detection.

Exam trap

The trap here is confusing Kerberos TGT requests (4768) with TGS requests (4769), when Kerberoasting specifically abuses service ticket requests.

Full explanation →

314

MCQmedium

A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?

A.keep-hostname(yes);

B.use-dns(yes);

C.dns-cache(yes);

D.chain-hostnames(yes);

AnswerB

The use-dns(yes) option in syslog-ng enables reverse DNS lookups on incoming log messages, replacing IP addresses with hostnames when possible. This directly addresses the scenario where devices do not send hostnames, allowing the centralized server to resolve them. It is a global option typically set in the syslog-ng.conf file under the options block.

Why this answer

To replace IP addresses with hostnames in syslog-ng, the use-dns(yes) option must be enabled. This triggers reverse DNS lookups on incoming messages, resolving IPs to hostnames when the sending device does not provide one. The other options either preserve existing hostnames, cache lookups, or handle relay chains, but none enable the necessary DNS resolution.

Exam trap

The trap here is confusing hostname preservation with hostname resolution, leading to selection of keep-hostname instead of use-dns.

Full explanation →

315

MCQmedium

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

A.Deploying a remote access trojan

B.Exploiting a software vulnerability

C.Scanning for open ports and services

D.Encrypting data for ransom

AnswerC

Reconnaissance is the kill chain's first phase, where adversaries gather information about the target. Scanning for open ports and services fits here, since it identifies exposed attack surface before weaponisation, delivery or exploitation occur. Other phases involve action, not discovery.

Why this answer

The Reconnaissance phase of the Cyber Kill Chain (Lockheed Martin's seven-phase model) is the first stage, where the adversary gathers information about the target before launching an attack. Scanning for open ports and services is a classic active reconnaissance technique (e.g., using nmap or masscan) that maps the attack surface and identifies exploitable services. This aligns with the phase's goal of intelligence gathering to inform later weaponization and delivery stages.

Exam trap

The trap here is confusing the Reconnaissance phase with later phases like Exploitation or Installation, since candidates often associate 'scanning' with active attacks rather than pre-attack intelligence gathering.

How to eliminate wrong answers

Option A is wrong because deploying a remote access trojan belongs to the 'Installation' or 'Command and Control' phase, not reconnaissance. Option B is wrong because exploiting a software vulnerability is the 'Exploitation' phase, which occurs after delivery. Option D is wrong because encrypting data for ransom is part of the 'Actions on Objectives' phase (impact/ransomware execution), the final stage of the kill chain.

Full explanation →

316

MCQmedium

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

A.Cloud Trace

B.Security Command Center

C.Deployment Manager

D.Cloud Billing

AnswerB

Security Command Center's IAM findings continuously scan for service accounts granted excessive permissions, surfacing over-privileged identities through its built-in misconfiguration detectors. This directly satisfies the requirement to detect a service account created with excessive permissions in GCP, unlike audit logs or policy analysers that report activity rather than flagging the risky entitlement itself.

Why this answer

Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It surfaces misconfigurations, vulnerabilities, and threats — including IAM-based findings such as service accounts granted excessive permissions — through built-in detectors and Security Health Analytics.

Exam trap

The trap is selecting a monitoring or IaC tool (Cloud Trace, Deployment Manager) because it sounds security-adjacent — the exam expects recognition that SCC is the dedicated security posture and threat detection service in GCP.

How to eliminate wrong answers

Option A is wrong because Cloud Trace is a distributed tracing tool for latency analysis, not a security posture tool. Option C is wrong because Deployment Manager is an infrastructure-as-code service for provisioning GCP resources, not for detecting permission issues. Option D is wrong because Cloud Billing reports cost and usage, not IAM or security findings.

Full explanation →

317

MCQhard

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

A.Check the destination IP against a reputation database

B.Compare the total volume of data sent to the IP against a global average

C.Analyze the variance in the time delta between consecutive connections to the destination IP

D.Perform a DNS lookup on the destination IP address

AnswerC

Beaconing produces periodic connections with low variance in inter-arrival times, whereas normal user traffic is bursty and irregular. Measuring variance in the time delta between consecutive connections to the destination IP exposes that regularity, reliably separating automated callbacks from genuine high-volume activity.

Why this answer

Beaconing malware typically communicates with a command-and-control (C2) server at regular intervals, resulting in low variance in the time deltas between connections. Normal user traffic is more random. Analyzing the variance (or standard deviation) of inter-connection times can reveal this periodicity, making it the most reliable statistical method.

Exam trap

The trap is selecting reputation database checks or DNS lookups because they are common first steps, but they don't distinguish beaconing from normal traffic; the question asks for statistical analysis, which points to variance in time deltas.

How to eliminate wrong answers

Option A is wrong because checking destination IP against a reputation database may miss new or compromised IPs and doesn't analyze traffic patterns. Option B is wrong because comparing total data volume to a global average is too coarse; beaconing may involve small, consistent data transfers that don't stand out. Option D is wrong because a DNS lookup only resolves the IP to a hostname, providing no behavioral analysis.

Full explanation →

318

Multi-Selectmedium

A SOC analyst is building detection content for credential access techniques on Windows endpoints. Which two artifacts would most reliably indicate an attempt to dump credentials from LSASS? (Choose two.)

Select 2 answers

A.A new local administrator account created outside change management windows

B.An increase in Kerberos TGS requests using RC4 encryption for many service accounts

C.Sysmon Event ID 10 showing a non-Microsoft signed process requesting access to lsass.exe

D.A process opening lsass.exe with read-access rights and subsequently writing a file with a .dmp extension

E.Event ID 4625 failures followed by a 4624 success for the same account from a new source workstation

AnswersC, D

Sysmon process access events capture the source image, target process, and granted access rights. A process not signed by Microsoft requesting access to lsass.exe is a high-fidelity signal because legitimate Windows components rarely do this outside known security tooling, making it a reliable detection point for credential dumping attempts.

Why this answer

Credential dumping from LSASS requires both accessing the protected process memory and persisting or transmitting the extracted secrets. Detections that combine a suspicious process opening lsass.exe with subsequent dump file creation, or that flag non-Microsoft signed processes requesting access to lsass.exe through Sysmon, directly capture those steps and are far more reliable than authentication-failure or account-creation artifacts.

Exam trap

The trap here is conflating any credential-related event, such as failed logons or Kerberoasting, with LSASS memory dumping, when only process access and dump artifacts prove that technique.

Full explanation →

319

MCQmedium

A SOC analyst is triaging an alert from a network detection system indicating a possible internal port scan. The scan originated from a workstation and targeted multiple servers on TCP port 445. Before escalating, the analyst needs to determine whether this is malicious or benign. Which action provides the most relevant context for this decision?

A.Review the firewall rules to confirm that port 445 is allowed between the workstation and the targeted servers.

B.Identify the process, user account, and parent process responsible for generating the scan traffic on the workstation.

C.Check the workstation's patch level to determine if it is missing any critical security updates.

D.Check the antivirus signature version on the targeted servers to ensure they are protected against known threats.

AnswerB

Determining the process, user, and parent process identifies whether the scan is from an authorized tool, a scheduled vulnerability scan, or malicious code. This context is the most direct way to classify the activity as benign or malicious. It also guides containment, such as terminating a malicious process or excluding a legitimate scanner from future alerts.

Why this answer

The most relevant context for classifying an internal port scan is the endpoint behavior behind it. Identifying the process, user, and parent process reveals whether the scan is from an approved tool, a misconfigured application, or malicious code such as a worm or attacker reconnaissance tool. This directly supports the benign-versus-malicious decision and informs the appropriate response.

Exam trap

The trap here is focusing on network or patch context instead of endpoint process attribution, which is what actually distinguishes an authorized scanner from malicious scanning activity.

Full explanation →

320

MCQmedium

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

A.Unions only support structured data.

B.Joins allow matching records between two datasets based on a common field.

C.Joins consume less memory than unions.

D.Unions cannot be used in detection rules.

AnswerB

Joins correlate records across SecurityEvent and SigninLogs by matching a shared field, such as account or IP address, which is essential for linking authentication activity to endpoint events during lateral movement. A union merely stacks rows from both tables without relating them, so it cannot satisfy the requirement to correlate the two datasets.

Why this answer

A join in KQL combines rows from two tables based on a matching key, such as correlating a SecurityEvent's Account field with SigninLogs' UserPrincipalName. This allows the rule to detect lateral movement by linking authentication events with sign-in activity on a common identifier. Union, by contrast, simply appends rows and does not match records.

Exam trap

The trap is assuming union can correlate records across tables; candidates confuse union's row-appending behavior with join's key-based matching, leading them to pick union for correlation tasks.

How to eliminate wrong answers

Option A is wrong because unions work with both structured and semi-structured data in KQL; the limitation is not data structure. Option C is wrong because joins are generally more resource-intensive than unions since they require matching keys and can produce large intermediate results. Option D is wrong because unions are absolutely allowed in Sentinel detection rules; they are commonly used to combine multiple tables with similar schemas.

Full explanation →

321

Multi-Selecthard

Which THREE elements are essential in an incident notification email to senior management?

Select 3 answers

A.Business impact assessment

B.The personal phone number of the attacker

C.High-level summary of the incident

D.The full raw packet dump

E.Expected next steps/timeline

AnswersA, C, E

Senior management needs to gauge severity and prioritise resourcing, so the notification must quantify operational, financial and reputational damage. Without a business impact assessment, executives cannot judge whether the incident warrants escalation, crisis-team activation or regulatory disclosure, making this element essential for informed decision-making.

Why this answer

A is correct because a business impact assessment tells senior management how the incident affects operations, revenue, customers, or compliance, which is the primary concern for executive decision-making. C is correct because a high-level summary gives leadership a concise, non-technical understanding of what happened, when it was detected, and its current status without overwhelming them with operational detail. E is correct because expected next steps and a timeline set expectations for containment, eradication, recovery, and communication, enabling management to allocate resources and manage stakeholder messaging.

B is not appropriate because the attacker's personal phone number is irrelevant, likely unavailable, and not actionable for management. D is not appropriate because a full raw packet dump is highly technical, voluminous, and belongs in forensic evidence handling rather than an executive notification email.

Exam trap

312-39 often tests whether candidates understand the audience for executive communications, tempting them to include technical artifacts (packet dumps) or irrelevant data (attacker contact info) instead of business-oriented content.

Full explanation →

322

Multi-Selectmedium

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Select 2 answers

A.Multiple failed login attempts

B.System clock synchronization errors

C.Installation of new system drivers

D.Increased DNS request volume (DNS Tunneling)

E.High volume of outbound traffic to a foreign IP

AnswersD, E

DNS tunnelling encodes stolen data within DNS queries and responses, so exfiltration produces abnormally high DNS request volumes. This satisfies the stem because the surge in query count, often to a single domain, signals covert outbound data transfer rather than normal resolution traffic.

Why this answer

Option D is correct because DNS tunneling is a classic data exfiltration technique: malware encodes stolen data into DNS queries (often TXT, NULL, or CNAME records) sent to an attacker-controlled authoritative name server, so a sudden spike in DNS request volume—especially long or high-entropy subdomain labels—signals data being smuggled out through port 53. Option E is correct because exfiltration inherently requires outbound transfer, and a high volume of outbound traffic to an unfamiliar or foreign IP address (particularly over common ports like 80/443 or via protocols such as FTP/SMTP) indicates data being sent to an external command-and-control or collection server. Option A does not belong because multiple failed logins indicate a brute-force or password-guessing attempt (an access/authentication attack), not the transfer of data out of the environment.

Option B does not belong because system clock synchronization errors point to NTP misconfiguration or time drift, which is a reliability/availability issue rather than evidence of data theft. Option C does not belong because installing new system drivers is a host configuration or persistence/rootkit-related change, not an indicator of outbound data exfiltration.

Exam trap

The trap is confusing initial-access indicators (failed logins) or persistence indicators (new drivers) with exfiltration indicators — the exam expects you to distinguish the attack stage, not just 'suspicious activity'.

Full explanation →

323

MCQmedium

A SOC analyst in an AWS environment receives an alert that an EC2 instance is making unusual outbound DNS queries to a domain associated with command-and-control activity. The analyst needs to identify the full chain of API calls that led to the instance's current state, including any IAM role assumptions or network modifications. Which AWS service should the analyst use to retrieve this information?

A.AWS CloudTrail

B.AWS Config

C.Amazon VPC Flow Logs

D.Amazon GuardDuty

AnswerA

CloudTrail records all API activity in the account, including RunInstances, ModifyNetworkInterfaceAttribute, and AssumeRole events. By correlating the instance ID with CloudTrail events, the analyst can reconstruct the sequence of API calls that created or modified the instance and its associated IAM role, providing the full chain of actions needed for incident response.

Why this answer

CloudTrail is the authoritative source for API activity in AWS, capturing management and data events across services. In this scenario, the analyst needs to correlate the EC2 instance's activity with API calls such as RunInstances, ModifyNetworkInterface, and AssumeRole to understand how the instance was compromised or configured. GuardDuty, AWS Config, and VPC Flow Logs each provide partial visibility but lack the comprehensive API call history that CloudTrail delivers.

Exam trap

The trap here is confusing threat detection findings (GuardDuty) or network logs (VPC Flow Logs) with the API-level audit trail needed to reconstruct the sequence of events.

Full explanation →

324

MCQeasy

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

A.AWS Artifact

B.AWS Security Hub

C.AWS Shield

D.AWS Trusted Advisor

AnswerB

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie and Config across all accounts into one pane, using the AWS Foundational Security Best Practices standard to flag misconfigurations organisation-wide. This satisfies the stem's centralised, cross-organisation visibility requirement, which single-service tools cannot deliver.

Why this answer

AWS Security Hub is a centralized security and compliance service that aggregates findings from multiple AWS services and partner tools, providing a dashboard to identify misconfigurations and security issues across an organization. It runs automated checks against best practices and standards like CIS AWS Foundations and AWS Foundational Security Best Practices.

Exam trap

The trap is confusing Trusted Advisor (broad best-practice recommendations) with Security Hub (dedicated security findings aggregation and standards compliance) — candidates must recognize Security Hub's specific role as a centralized security dashboard.

How to eliminate wrong answers

Option A is wrong because AWS Artifact is a self-service portal for accessing AWS compliance reports and agreements, not a misconfiguration dashboard. Option C is wrong because AWS Shield is a managed DDoS protection service, not a security posture dashboard. Option D is wrong because AWS Trusted Advisor provides best-practice recommendations including some security checks, but it is not specifically designed as a centralized security misconfiguration dashboard across an organization and lacks the aggregation and standards-based findings of Security Hub.

Full explanation →

325

Multi-Selectmedium

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Select 2 answers

A.Implementing Risk-Based Alerting (RBA).

B.Disabling all alerts during off-hours.

C.Using wildcard searches for all rules.

D.Setting thresholds based on baselined activity.

E.Increasing log retention to 10 years.

AnswersA, D

Risk-Based Alerting aggregates many low-fidelity detections into risk scores per entity, so isolated events do not each raise an alert. Only accumulated risk crossing a threshold triggers investigation, which suppresses the noisy single-event false positives the stem targets.

Why this answer

Option A, Implementing Risk-Based Alerting (RBA), is correct because RBA aggregates multiple low-severity detections into a single risk-scored entity (user, host, or IP) rather than alerting on each event individually, which dramatically reduces the volume of isolated false-positive alerts and lets analysts focus on correlated, higher-risk behavior. Option D, Setting thresholds based on baselined activity, is correct because establishing a normal behavioral baseline (for example, typical login counts, data-transfer volumes, or process execution rates per host) allows thresholds to be tuned to the environment so that only statistically anomalous deviations trigger alerts, minimizing noise from legitimate activity. Option B is wrong because disabling all alerts during off-hours creates dangerous blind spots that attackers commonly exploit and does nothing to improve alert fidelity.

Option C is wrong because wildcard searches for all rules broaden matching logic, producing more spurious hits and worsening false positives rather than reducing them. Option E is wrong because increasing log retention to 10 years affects storage and forensic availability, not the precision or false-positive rate of SIEM alert rules.

Exam trap

312-39 often tests the misconception that disabling alerts or using wildcards reduces false positives, when in fact they increase noise or miss threats; the correct answers focus on prioritization and baselining.

Full explanation →

326

MCQhard

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

A.Azure Policy Compliance dashboard

B.Azure Monitor Metrics

C.Microsoft Entra ID Sign-in logs

D.Azure Service Health

AnswerC

Microsoft Entra ID Sign-in logs record each authentication attempt with geographic location, IP address, and device risk level, giving the investigation data needed. They are the portal location for reviewing suspicious VM sign-in patterns and assessing risk.

Why this answer

Microsoft Entra ID (formerly Azure AD) Sign-in logs capture authentication events including the geographic location (via IP geolocation), device details, and risk level (when Identity Protection is enabled). This is the correct place to investigate suspicious VM or user sign-in patterns.

Exam trap

The trap is confusing Azure Monitor (performance/operational telemetry) with Entra ID Sign-in logs (identity/authentication events) — candidates pick Azure Monitor Metrics because it sounds like the general monitoring place.

How to eliminate wrong answers

Option A is wrong because Azure Policy Compliance dashboard reports resource configuration compliance against policies, not authentication events. Option B is wrong because Azure Monitor Metrics stores numeric time-series performance data, not sign-in details or risk levels. Option D is wrong because Azure Service Health reports platform outages and planned maintenance affecting Azure services, not user sign-in activity.

Full explanation →

327

MCQeasy

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

A.Alert frequency.

B.Log source vendor.

C.Asset Criticality.

D.Number of alerts per user.

AnswerC

Asset criticality maps each alert to the business value of the affected system, so triage effort follows potential impact rather than raw severity or volume. It directly satisfies the stem's requirement to prioritise on business impact.

Why this answer

Asset Criticality is the most important metric for prioritizing incidents by business impact because a compromise on a domain controller, database server, or executive workstation carries far greater risk than one on a test machine. SIEM triage workflows weight alerts by the criticality of the affected asset to focus analyst attention where it matters most. This aligns detection response with business risk.

Exam trap

312-39 often tests prioritization logic — candidates pick volume-based metrics like alert frequency instead of recognizing that business impact is driven by asset criticality, not alert count.

How to eliminate wrong answers

Option A is wrong because alert frequency measures volume, not impact — a noisy low-risk alert can fire hundreds of times while a single high-impact alert fires once. Option B is wrong because the log source vendor is an infrastructure detail with no direct relationship to business impact. Option D is wrong because the number of alerts per user is a workload or behavioral metric, not a measure of business criticality of the affected asset.

Full explanation →

328

Multi-Selecthard

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)

Select 2 answers

A.DNS query logs

B.Web proxy logs

C.System performance logs

D.Firewall logs

E.Authentication logs

AnswersB, D

Web proxy logs capture HTTP/HTTPS requests, including URLs, user agents, and bytes sent/received. They are crucial for identifying data exfiltration via web protocols, such as uploads to cloud storage or file-sharing sites. The logs can show the volume of data transferred and the destination, directly addressing the scenario's need to determine method and volume. They complement firewall logs by providing application-layer details.

Why this answer

Firewall logs and web proxy logs are the most critical for determining data exfiltration method and volume. Firewall logs show outbound connections and byte counts, while proxy logs provide application-layer details like URLs and payload sizes. Together, they allow the analyst to identify the channel and quantify the data transferred.

Other logs like DNS or authentication may provide context but lack the direct volume and method information.

Exam trap

The trap here is overemphasizing logs that indicate intent or access, such as authentication or DNS, rather than focusing on logs that directly record data transfer volumes and destinations.

Full explanation →

Certified SOC Analyst (312-39) (312-39) — Questions 301–328