Certified SOC Analyst (312-39) (312-39) — Questions 1–75

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

In a SIEM, what is the role of a 'Parser'?

Which THREE actions are part of the 'Recovery' phase?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Which THREE tools are typically used for forensic memory analysis?

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

Which THREE components are essential to include in a SOC Incident Response plan?

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

What is the primary goal of the 'Eradication' phase in incident response?

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Which TWO factors are most critical when calculating the ROI of a SOC?

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Which TWO steps are part of the 'Preparation' phase of the incident response process?

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

What is the primary benefit of using a centralized logging server compared to local logging?

What is the primary purpose of a 'War Room' during a major incident?

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

What is the main objective of the 'Post-Incident Activity' phase?

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

Your organization uses Google Cloud Platform. You need to identify which service provides VPC flow logs to monitor network traffic patterns between instances. Which service is used?

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Which document is essential for recording every action taken during an incident for legal and audit purposes?

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

A ticket is assigned to you with high priority. What is the first thing you should do?

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

Which TWO types of evidence should be collected during the identification phase of an incident?

Which component of a SIEM is responsible for identifying patterns in real-time?

Which THREE of the following factors should be considered when designing a new SIEM use case?

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Which of the following is a key advantage of utilizing a centralized SIEM platform?

An organization is implementing a proactive detection strategy using the MITRE ATT&CK framework. Which phase of the implementation should the SOC prioritize to maximize detection coverage against common enterprise threats?

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

What is a 'log source' in the context of a SIEM?

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

What does the 'False Positive' rate of a SIEM rule indicate?

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

Which TWO log types are considered critical for forensic analysis after a network intrusion?

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Which TWO methods are commonly used to achieve persistence on a Windows host?

You notice an unusual amount of outbound traffic from an Azure VM to a known malicious IP. What is the most effective way to block this traffic immediately at the network level?

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

What is the purpose of 'Dashboards' in a SIEM?

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?