Free 312-39 sample questions

Correct answers: Assign a lower confidence score or risk rating to the problematic feed.; Create a suppression rule or whitelist for the known CDN IP ranges.

Correct answer: Windows Security Event Logs showing service creation events (Event ID 4697) on target machines.

PsExec works by installing a temporary service (PSEXESVC) on the remote machine to execute commands. This action generates a 'A service was installed in the system' event with Event ID 4697 in the Windows Security Log on the target host. Searching for this specific event across multiple workstations is a high-fidelity method for detecting PsExec usage. While firewall logs show the necessary SMB traffic, they don't confirm what the traffic is for. DNS logs are too generic. Process creation logs on the source machine would show `psexec.exe` running, but logs on the target machine provide definitive proof of the lateral movement.

Correct answer: SIEM correlation rules are poorly tuned, leading to a high volume of false positives.

MTTD measures the time from when an attack occurs until it is detected. A rising MTTD indicates a problem with the detection capabilities. This is often caused by poorly tuned SIEM rules, outdated threat intelligence, or gaps in log source coverage, leading to alerts being missed or delayed. Since MTTR (the time from detection to resolution) is stable, it means the response team is performing their job effectively once an incident is identified. Therefore, the problem lies in the detection phase, not the response phase.

Correct answer: True

True. According to the Lockheed Martin Cyber Kill Chain model, the 'Installation' phase, where malware establishes persistence on the victim's system, precedes the 'Command and Control' (C2) phase. During the C2 phase, the installed malware 'calls home' to the attacker's infrastructure to receive instructions. Persistence must be established first to ensure the C2 channel can be maintained.

Correct answer: Removing the malware and any associated artifacts from the affected systems.

The Eradication phase of the incident response lifecycle focuses on completely removing the threat from the environment. This includes deleting the malware, removing persistence mechanisms (like registry keys or scheduled tasks), and eliminating any other tools or backdoors left by the attacker. Isolation is part of Containment, restoring data is part of Recovery, and lessons learned is the final post-incident phase.

Correct answer: index=wineventlog EventCode=4624 | iplocation src_ip | search Country!=US

This query correctly filters for the specific Windows event for a successful logon (EventCode=4624), then uses the `iplocation` command to enrich the events with geographic data based on the source IP address (`src_ip`). Finally, it uses a `search` command to filter those enriched events to show only those where the `Country` field is not equal to 'US'. The other options are incorrect or less efficient.

Correct answer: Implement a data tiering strategy, moving logs older than 90 days to cheaper 'cold' storage.

A data tiering strategy is the industry-standard solution for balancing performance and cost in long-term log retention. Logs are kept in expensive, high-performance 'hot' storage for a short period (e.g., 30-90 days) for immediate analysis. After that, they are moved to cheaper, slower 'warm' or 'cold' storage (like AWS S3 Glacier or an on-premise NAS). This meets the compliance requirement for retention without the exorbitant cost of keeping all data in hot storage. Data can still be re-ingested or queried from cold storage if needed for a forensic investigation, albeit more slowly.

Correct answer: Tactic, Technique, and Procedure (TTP)

This scenario describes a specific Tactic, Technique, and Procedure (TTP). The tactic is 'Persistence' or 'Defense Evasion', the technique is 'Valid Accounts', and the specific procedure is the use of a dormant account to access resources. An IoC is the evidence itself (e.g., the log entry), not the methodology. Zero-day and DoS are types of attacks, but the concept of using a dormant account is a classic TTP employed by attackers to blend in and avoid detection.

Correct answer: It provides continuous 24x7 monitoring without requiring overnight shifts for analysts.

The primary advantage of a 'follow-the-sun' model is its ability to provide continuous, 24/7 security monitoring by handing off operations between geographically distributed teams. As one team's business day ends, another team's day begins, ensuring that alerts are always handled by an active, alert team working regular business hours. This avoids the analyst burnout and potential for error associated with overnight shifts.

Correct answer: Command Injection

This is a classic example of a Command Injection attack. The attacker is using a semicolon (`;`) to terminate the expected parameter (`id=123`) and inject a new, arbitrary operating system command (`cat /etc/passwd`). If the backend application is vulnerable, it will execute this command on the server, potentially revealing the contents of the password file. SQL injection involves database commands, while XSS involves injecting scripts into a web page to be executed by a user's browser.