Certified SOC Analyst 312-39 practice test

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell pr…

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you t…

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved chang…

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which…

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the command…

Which THREE factors should be considered when determining the severity level of an incident?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should…

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Which THREE factors contribute to 'dwell time' in a security incident?

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Which document should you reference first to determine the communication path during a high-severity security incident?

Which TWO of the following are key components of a successful SIEM use case development process?

A SOC analyst is reviewing a threat intelligence report that lists a new C2 domain. The SIEM has no prior detection rule for this domain. Which action best uses the diamond model t…

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection…

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a…

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endp…

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on…

Which THREE factors should be considered when determining the log retention period in a SOC environment?

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?