Free 312-39 sample questions

Correct answer: Retrieve the full event log from the SIEM to decode the Base64 string.

The most critical immediate step is to understand what the PowerShell command is attempting to do. Blocking the IP or isolating the host are containment actions that should be taken, but not before gaining context. Without understanding the payload, the analyst cannot determine the scope or severity of the incident. Decoding the Base64 string from the full log entry will reveal the actual commands being executed, providing the necessary intelligence to guide subsequent containment and eradication steps.

Correct answer: The rule fails to account for encoded or obfuscated attack strings, leading to high false negatives.

Modern attackers rarely use plain-text SQL injection strings. They employ various encoding techniques (URL encoding, Base64, etc.) and obfuscation methods to bypass simple string-matching rules. A rule that only looks for literal strings like 'UNION SELECT' is trivial to evade and will result in a high number of false negatives (missed attacks). A more effective rule would need to look for patterns, special characters, or use more advanced analytics that can decode and normalize log data before inspection.

Correct answers: Assign a lower confidence score or risk rating to the problematic feed.; Create a suppression rule or whitelist for the known CDN IP ranges.

Correct answer: Windows Security Event Logs showing service creation events (Event ID 4697) on target machines.

PsExec works by installing a temporary service (PSEXESVC) on the remote machine to execute commands. This action generates a 'A service was installed in the system' event with Event ID 4697 in the Windows Security Log on the target host. Searching for this specific event across multiple workstations is a high-fidelity method for detecting PsExec usage. While firewall logs show the necessary SMB traffic, they don't confirm what the traffic is for. DNS logs are too generic. Process creation logs on the source machine would show `psexec.exe` running, but logs on the target machine provide definitive proof of the lateral movement.

Correct answer: SIEM correlation rules are poorly tuned, leading to a high volume of false positives.

MTTD measures the time from when an attack occurs until it is detected. A rising MTTD indicates a problem with the detection capabilities. This is often caused by poorly tuned SIEM rules, outdated threat intelligence, or gaps in log source coverage, leading to alerts being missed or delayed. Since MTTR (the time from detection to resolution) is stable, it means the response team is performing their job effectively once an incident is identified. Therefore, the problem lies in the detection phase, not the response phase.

Correct answer: True

True. According to the Lockheed Martin Cyber Kill Chain model, the 'Installation' phase, where malware establishes persistence on the victim's system, precedes the 'Command and Control' (C2) phase. During the C2 phase, the installed malware 'calls home' to the attacker's infrastructure to receive instructions. Persistence must be established first to ensure the C2 channel can be maintained.

Correct answer: Removing the malware and any associated artifacts from the affected systems.

The Eradication phase of the incident response lifecycle focuses on completely removing the threat from the environment. This includes deleting the malware, removing persistence mechanisms (like registry keys or scheduled tasks), and eliminating any other tools or backdoors left by the attacker. Isolation is part of Containment, restoring data is part of Recovery, and lessons learned is the final post-incident phase.

Correct answer: index=wineventlog EventCode=4624 | iplocation src_ip | search Country!=US

This query correctly filters for the specific Windows event for a successful logon (EventCode=4624), then uses the `iplocation` command to enrich the events with geographic data based on the source IP address (`src_ip`). Finally, it uses a `search` command to filter those enriched events to show only those where the `Country` field is not equal to 'US'. The other options are incorrect or less efficient.

Correct answer: Implement a data tiering strategy, moving logs older than 90 days to cheaper 'cold' storage.

A data tiering strategy is the industry-standard solution for balancing performance and cost in long-term log retention. Logs are kept in expensive, high-performance 'hot' storage for a short period (e.g., 30-90 days) for immediate analysis. After that, they are moved to cheaper, slower 'warm' or 'cold' storage (like AWS S3 Glacier or an on-premise NAS). This meets the compliance requirement for retention without the exorbitant cost of keeping all data in hot storage. Data can still be re-ingested or queried from cold storage if needed for a forensic investigation, albeit more slowly.

Correct answer: Tactic, Technique, and Procedure (TTP)

This scenario describes a specific Tactic, Technique, and Procedure (TTP). The tactic is 'Persistence' or 'Defense Evasion', the technique is 'Valid Accounts', and the specific procedure is the use of a dormant account to access resources. An IoC is the evidence itself (e.g., the log entry), not the methodology. Zero-day and DoS are types of attacks, but the concept of using a dormant account is a classic TTP employed by attackers to blend in and avoid detection.