How should I use these Incident Response practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Incident Response questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Incident Response domain.

312-39 · topic practice

Incident Response practice questions

Practise Certified SOC Analyst (312-39) Incident Response practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Incident Response

Practice 10 questions Browse domain →

What the exam tests

What to know about Incident Response

Incident Response questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Incident Response exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Incident Response questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Incident Response explanation →

In an IR scenario involving a compromised Microsoft 365 account, which command in the Security & Compliance PowerShell module is used to force sign-out of all active sessions?

Trap 1: Clear-M365Session

This command does not exist.

Trap 2: Disable-Mailbox

This disables the account, which is too aggressive for session termination.

Trap 3: Disconnect-ExchangeOnline

This only disconnects the local shell session.

Study all Incident Response common traps →

A
Clear-M365Session
Why wrong: This command does not exist.
B
Disable-Mailbox
Why wrong: This disables the account, which is too aggressive for session termination.
C
Revoke-AzureADUserAllRefreshToken
This command revokes all refresh tokens and active sessions.
D
Disconnect-ExchangeOnline
Why wrong: This only disconnects the local shell session.

Incident Response practice questions

What to know about Incident Response

Common Incident Response exam traps

Incident Response questions

In an IR scenario involving a compromised Microsoft 365 account, which command in the Security & Compliance PowerShell module is used to force sign-out of all active sessions?

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

What is the primary purpose of a 'War Room' during a major incident?

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

Which document should you reference first to determine the communication path during a high-severity security incident?

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

Track your progress over time

Start a Incident Response only practice session

Related 312-39 topic practice pages

Cyber Threats Iocs And Attack Methodology practice questions

Forensic Investigation And Malware Analysis practice questions

Incident Detection And Triage practice questions

Incident Response practice questions

Log Management practice questions

Proactive Threat Detection practice questions

Security Operations And Management practice questions

SOC For Cloud Environments practice questions

312-39 fundamentals practice questions

312-39 scenario practice questions

312-39 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid