How should I use these Cyber Threats Iocs And Attack Methodology practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

312-39 · topic practice

Cyber Threats Iocs And Attack Methodology practice questions

Q: Can I practise just Cyber Threats Iocs And Attack Methodology questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Cyber Threats Iocs And Attack Methodology domain.

Practise Certified SOC Analyst (312-39) Cyber Threats Iocs And Attack Methodology practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

17 questionsDomain: Cyber Threats Iocs And Attack Methodology

Practice 10 questions Browse domain →

What the exam tests

What to know about Cyber Threats Iocs And Attack Methodology

Cyber Threats Iocs And Attack Methodology questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Cyber Threats Iocs And Attack Methodology exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Cyber Threats Iocs And Attack Methodology questions

17 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Cyber Threats Iocs And Attack Methodology explanation →

During an investigation of an APT, you observe a process executing from C:\Users\Public\ and reaching out to a suspicious domain. Which TTP from the MITRE ATT&CK framework is primarily being demonstrated?

Trap 1: T1059: Command and Scripting Interpreter

This refers to shell execution, not the file location.

Trap 2: T1105: Ingress Tool Transfer

This is about moving files to the target, not executing them.

Trap 3: T1204: User Execution

This requires user interaction, which isn't specified.

Study all Cyber Threats Iocs And Attack Methodology common traps →

A
T1547: Boot or Logon Autostart Execution
Storing and executing files in user directories is a key persistence method.
B
T1059: Command and Scripting Interpreter
Why wrong: This refers to shell execution, not the file location.
C
T1105: Ingress Tool Transfer
Why wrong: This is about moving files to the target, not executing them.
D
T1204: User Execution
Why wrong: This requires user interaction, which isn't specified.

Cyber Threats Iocs And Attack Methodology practice questions

What to know about Cyber Threats Iocs And Attack Methodology

Common Cyber Threats Iocs And Attack Methodology exam traps

Cyber Threats Iocs And Attack Methodology questions

During an investigation of an APT, you observe a process executing from C:\Users\Public\ and reaching out to a suspicious domain. Which TTP from the MITRE ATT&CK framework is primarily being demonstrated?

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Which of the following is considered a 'Network-based' IoC?

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

Track your progress over time

Start a Cyber Threats Iocs And Attack Methodology only practice session

Related 312-39 topic practice pages

Cyber Threats Iocs And Attack Methodology practice questions

Forensic Investigation And Malware Analysis practice questions

Incident Detection And Triage practice questions

Incident Response practice questions

Log Management practice questions

Proactive Threat Detection practice questions

Security Operations And Management practice questions

SOC For Cloud Environments practice questions

312-39 fundamentals practice questions

312-39 scenario practice questions

312-39 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid