Certified SOC Analyst (312-39) (312-39) — Questions 151–202

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Which of the following describes 'Event Correlation' in a SIEM?

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

Which TWO items are part of the 'Lessons Learned' process?

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

You are investigating a suspicious login. Which attribute in the Azure AD sign-in logs helps determine if the user successfully authenticated using MFA?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

Which THREE of the following are common challenges in SIEM correlation rule development?

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Which document should you reference first to determine the communication path during a high-severity security incident?

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

Which SIEM feature is used to group related events into a single incident?

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

Which TWO metrics are essential for measuring the efficiency of an incident response team?

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

Which THREE actions are appropriate during the eradication phase of a malware incident?

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

What is the primary function of a SIEM collector?

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Which TWO of the following are primary components of a cloud-native incident response plan?

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Which THREE elements are essential in an incident notification email to senior management?

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?