How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the 312-39 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 312-39 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified SOC Analyst (312-39) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Certified SOC Analyst (312-39) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

312-39

exam code

EC-Council

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related 312-39 topic practice pages

Cyber Threats Iocs And Attack Methodology practice questions

Forensic Investigation And Malware Analysis practice questions

Incident Detection And Triage practice questions

Incident Response practice questions

Log Management practice questions

Proactive Threat Detection practice questions

Security Operations And Management practice questions

SOC For Cloud Environments practice questions

312-39 fundamentals practice questions

312-39 scenario practice questions

312-39 troubleshooting practice questions

Practice scenarios

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Which THREE of the following are common steps during the 'Alert Triage' process?

Which TWO of the following are key components of a successful SIEM use case development process?

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Which THREE factors contribute to 'dwell time' in a security incident?

Which TWO factors are most critical when calculating the ROI of a SOC?

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?