Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 10

Question 90

A firewall calls an address src_ip and an EDR uses sourceAddress. A cross-source rule fails to join them. What change addresses the mismatch?

  1. Force both devices to transmit their records at exactly the same second
  2. Raise the severity of every network event to critical
  3. Map both source fields into a common normalized schema
  4. Delete one of the data sources to remove the mismatch

Explanation

Correct Answer

C:

Field normalization enables analytics to refer to one logical source-address attribute despite differing vendor formats.

Incorrect Answers

A:

Time alignment alone cannot fix a rule that queries incompatible field names.

B:

Severity changes do not rename fields or provide correlation across the two schemas.

D:

Discarding EDR or firewall events reduces detection breadth instead of reconciling their representations.

Question 91

A collector receives valid text logs, but queries cannot filter by user or HTTP status because the records remain one unstructured string. What pipeline component is missing?

  1. An endpoint isolation action on the sending web server
  2. An additional incident severity label on the same record
  3. Field parsing or extraction suited to the log format
  4. A larger monitor showing more lines of raw text

Explanation

Correct Answer

C:

A parser identifies structured values within each event so the SIEM can search and correlate semantic fields.

Incorrect Answers

A:

Containment affects the host but cannot transform the collector's raw string into searchable structured fields.

B:

Severity metadata does not derive the missing username or HTTP status from raw message content.

D:

Display area can help manual review but does not create indexed user and status fields for analytic rules.

Question 92

A SIEM knows an IP address but analysts struggle to identify its owner and business impact. Which log pipeline enrichment helps most?

  1. Join the IP to historical inventory ownership records
  2. Convert all event severities to the same level
  3. Discard every event that lacks a public geolocation result
  4. Replace the IP address with a random label on ingestion

Explanation

Correct Answer

A:

Asset context converts a network artifact into a host, custodian, environment, and criticality relevant to triage.

Incorrect Answers

B:

A flat severity field does not tell analysts which business service owns the address.

C:

Internal IPs are often not geolocatable, so the filter would remove important events from private systems.

D:

A nonreversible random value without an asset mapping would further weaken attribution and investigative context.

Question 93

An organization has a documented 180-day searchable retention requirement for authentication records. What is the right design consideration?

  1. Keep unlimited copies in every analyst's personal cloud account
  2. Store only the latest 24 hours because analysts usually respond quickly
  3. Retain dashboard screenshots instead of original records
  4. Keep authentication events retrievable for all 180 required days

Explanation

Correct Answer

D:

Retention design must cover ingestion, search availability, access permissions, and reliable deletion after applicable obligations end.

Incorrect Answers

A:

Uncontrolled copies create confidentiality, integrity, and deletion problems rather than governed retention.

B:

Short retention violates the stated requirement and prevents investigation of older identity events.

C:

Screenshots cannot support field-based searches, complete timelines, or verification of original event attributes.

Question 94

Incident responders must demonstrate that exported log evidence has not been altered after acquisition. Which control directly supports this?

  1. Disable read permissions for everyone including the evidence custodian
  2. Compress the export without retaining acquisition metadata
  3. Rename the evidence file to include the word verified
  4. Record cryptographic hashes and preserve the original evidence

Explanation

Correct Answer

D:

A recorded digest allows later integrity checks; custody and secure storage connect that technical check to the evidence history.

Incorrect Answers

A:

Overly restrictive access may obstruct the investigation and does not provide a verifiable hash or custody record.

B:

Compression may reduce size but does not by itself establish provenance, integrity, or who handled the file.

C:

A filename is mutable metadata and provides no cryptographic evidence that file content stayed unchanged.

Question 95

A regulated SOC wants an adversary with standard SIEM analyst permissions to be unable to modify archived audit records. Which storage approach is best?

  1. Grant all analysts permission to edit archival files for convenience
  2. Use immutable archives managed outside routine analyst permissions
  3. Trust a naming convention to indicate records should not be changed
  4. Keep a single writable file on the endpoint generating events

Explanation

Correct Answer

B:

Enforced immutability reduces tampering opportunities, especially when archive permissions are isolated from day-to-day search users.

Incorrect Answers

A:

Broad edit privileges defeat tamper resistance and permit alteration of records by compromised analyst identities.

C:

Labels do not enforce write protection; storage controls and auditable privileges are needed for integrity.

D:

An attacker controlling the endpoint may overwrite or delete the sole copy before responders can preserve it.

Question 96

After a collector upgrade, event volume falls 80% despite stable production workload. What should the logging team check first?

  1. Assume an 80% decrease in attacker activity has been proven
  2. Inspect collector queues, errors, source health, and drop counters
  3. Delete alerts based on now-missing logs without investigation
  4. Increase the incident severity of every record remaining in the index

Explanation

Correct Answer

B:

A sudden volume change may be a telemetry outage rather than a threat reduction; pipeline diagnostics can locate the break.

Incorrect Answers

A:

Ingestion count is not a direct measurement of malicious events and can decline because the collection path failed.

C:

A collection outage should be tracked as a visibility gap, not treated as evidence that previously detected threats vanished.

D:

Reclassifying surviving events does not restore missing sources or explain collector failures.

Question 97

Branch devices lose connectivity to the central SIEM for short intervals but must avoid losing audit records. Which design supports recovery?

  1. Local durable buffering with retry and backpressure-aware forwarding
  2. Replace the event stream with once-a-week dashboard screenshots
  3. Disable local event generation whenever the network is down
  4. Send each event exactly once over an unacknowledged best-effort link

Explanation

Correct Answer

A:

A queue can retain events during brief outages and forward them when connectivity returns, if capacity and replay behavior are monitored.

Incorrect Answers

B:

Periodic images are not a loss-resistant transport or chronological archive for security telemetry.

C:

Stopping audit collection creates permanent blind spots precisely when central connectivity is unavailable.

D:

Best-effort transmission has no assurance that events survive a link outage or congestion.

Question 98

The SIEM counts duplicate events because the same firewall sends logs directly and through a relay. What adjustment most directly fixes this inflation?

  1. Ignore the issue because every duplicate increases confidence in compromise
  2. Change the dashboard title to indicate a larger event count
  3. Disable all firewall logging so no events arrive
  4. Remove duplicate forwarding paths or deduplicate by event identity

Explanation

Correct Answer

D:

Removing duplicate paths or deduplicating by stable event identity and timing preserves meaning while avoiding double-counted alerts.

Incorrect Answers

A:

Two copies of one underlying event are not independent observations and should not be treated as corroboration.

B:

Renaming the visualization does not remove duplicate underlying records or inflated analytic results.

C:

Suppressing the entire source eliminates an important detection input instead of correcting an ingestion configuration error.

Question 99

An application begins emitting JSON records containing action, actor, object, and request ID. What advantage should the SOC preserve during ingestion?

  1. Drop the actor field to reduce the message length
  2. Parse JSON into typed, searchable fields
  3. Treat the existence of JSON as proof the application is secure
  4. Convert the entire JSON payload into an unindexed screenshot

Explanation

Correct Answer

B:

Structured fields enable precise search and event joins, particularly when request IDs connect application and service records.

Incorrect Answers

A:

Losing principal identity undermines attribution and weakens detection of inappropriate operations.

C:

A parseable format supports monitoring but does not guarantee trustworthy content or safe application behavior.

D:

An image destroys straightforward machine filtering and correlation on actor, action, and request identifier.

Question 100

A syslog collector sees a severity and facility value at the start of a message. What do these fields communicate?

  1. The retention expiry date enforced by the storage engine
  2. The complete packet payload for the triggering network session
  3. The username and password used to authenticate to the application
  4. Syslog facility and severity

Explanation

Correct Answer

D:

Syslog facility categorizes origin and severity ranks message criticality; neither field alone proves hostile activity.

Incorrect Answers

A:

Storage lifecycle settings are separate from a syslog message's source-category and severity indicators.

B:

Syslog priority values are compact classifications and do not contain full traffic captures.

C:

Facility and severity are message metadata and are not credentials or proof of application authentication.

Certified SOC Analyst (312-39) Practice Tests