Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 11

Question 100

A syslog collector sees a severity and facility value at the start of a message. What do these fields communicate?

  1. The retention expiry date enforced by the storage engine
  2. The complete packet payload for the triggering network session
  3. The username and password used to authenticate to the application
  4. Syslog facility and severity

Explanation

Correct Answer

D:

Syslog facility categorizes origin and severity ranks message criticality; neither field alone proves hostile activity.

Incorrect Answers

A:

Storage lifecycle settings are separate from a syslog message's source-category and severity indicators.

B:

Syslog priority values are compact classifications and do not contain full traffic captures.

C:

Facility and severity are message metadata and are not credentials or proof of application authentication.

Question 101

A malicious host can currently inject forged syslog events into a trusted collector. What design change most directly reduces this risk?

  1. Increase the number of reporting dashboards
  2. Restrict authenticated senders on a protected log channel
  3. Permit every internet address to submit high-priority messages
  4. Suppress all events marked informational

Explanation

Correct Answer

B:

Sender identity validation, controlled network paths, and transport integrity make it harder for unauthorized devices to poison telemetry.

Incorrect Answers

A:

More charts do not establish which host supplied an event or whether it was altered in transit.

C:

Open ingestion enlarges the opportunity for forged events and undermines confidence in analysis.

D:

Severity filters do not address impersonation and might discard useful supporting evidence from legitimate sources.

Question 102

A payment application sends full credit-card numbers into the general-purpose SIEM. Which logging change should be prioritized?

  1. Grant every SOC account unrestricted access to raw payment records
  2. Delete the timestamp and event type while retaining the full payment number
  3. Keep the full numbers indefinitely because long retention always improves security
  4. Mask payment data before ingestion, retaining security context

Explanation

Correct Answer

D:

Event design should avoid collecting secrets unnecessarily, reducing exposure in searches, exports, and long-term storage.

Incorrect Answers

A:

Broad availability increases sensitive-data risk and usually exceeds an analyst's need to investigate events.

B:

That choice removes investigative context while preserving the sensitive field that created the problem.

C:

Retention must follow legal and business need; unnecessary storage of payment details increases harm if logs are breached.

Question 103

A junior SOC analyst needs to search alerts but must not change log retention or delete indexed evidence. Which access principle should apply?

  1. Shared superadministrator credentials for the entire SOC shift
  2. Read-only search rights through least-privilege roles
  3. Unrestricted edit rights because the analyst may need to correct logs
  4. No SIEM access at all despite the assigned investigation role

Explanation

Correct Answer

B:

Role separation limits accidental or malicious modification of audit records while preserving the analyst's investigation capability.

Incorrect Answers

A:

Shared privileged access prevents accountability and unnecessarily exposes destructive administrative functions.

C:

Investigation benefits from preserving original records; corrections should be annotations, not silent edits to source evidence.

D:

Removing every read capability blocks legitimate alert triage instead of separating read and administrative privileges.

Question 104

A log source must retain events for a year, but queries older than 30 days are rare. Which storage strategy balances search and retention?

  1. Export only the daily count of events before deleting original records
  2. Keep all logs solely in expensive memory indefinitely
  3. Delete all events after 30 days with no backup
  4. Use hot searchable storage plus governed long-term archives

Explanation

Correct Answer

D:

Different storage tiers can reduce cost while preserving required evidence, provided retrieval deadlines and integrity needs are met.

Incorrect Answers

A:

Counts cannot reconstruct individual sessions, user actions, or precise timelines when older evidence is needed.

B:

Always-hot retention may waste resources and still requires durability and access governance beyond process memory.

C:

A 30-day deletion contradicts the one-year requirement and leaves older incidents uninvestigable.

Question 105

A security team needs fast searches by source IP and account name, but neither field is indexed. Which improvement addresses query performance?

  1. Disable query time-range filtering
  2. Raise all message priority values to the maximum
  3. Index fields that match the source schema and query workload
  4. Discard source identifiers and usernames from incoming events

Explanation

Correct Answer

C:

Index design should prioritize investigative pivots while balancing ingestion overhead and storage costs.

Incorrect Answers

A:

Unbounded searches can increase scanning costs and do not compensate for missing searchable field support.

B:

Syslog severity labels do not create indexes or optimize retrieval by entity fields.

D:

Removing the exact fields analysts need would make correlation and attribution harder, not accelerate meaningful queries.

Question 106

A log forwarder emits a metric called dropped_events that spikes whenever CPU usage rises. What should the analyst report?

  1. Escalate an event-loss and pipeline-visibility gap
  2. Confirmed successful prevention of all malicious connections
  3. Proof that every remaining alert is a false positive
  4. A harmless cosmetic issue with the SIEM charts

Explanation

Correct Answer

A:

Dropped events mean the SOC may have missed relevant activity; investigate capacity, buffering, and forwarding before trusting low alert volume.

Incorrect Answers

B:

A pipeline drop metric describes data loss, not whether any security control blocked attacker traffic.

C:

Telemetry incompleteness does not determine the validity of events that were successfully retained.

D:

Missing records can directly impair triage and forensics even when the dashboard renders normally.

Question 107

A proxy truncates long URL parameters, preventing investigation of suspected web exploits. What is the core telemetry limitation?

  1. A failure of disk encryption confidentiality
  2. A certain signature of malicious endpoint persistence
  3. An incomplete asset inventory causing unknown web-server ownership in event records
  4. Loss of field completeness due to truncation

Explanation

Correct Answer

D:

Important request content may be missing from the recorded event, so investigators should review logging limits and complementary application sources.

Incorrect Answers

A:

Encryption-at-rest policies are not the same issue as a proxy dropping part of request data during logging.

B:

The fact of truncated URLs does not establish a resident malicious program or scheduled execution.

C:

Asset attribution may be useful later, but the stated loss is missing URL parameter bytes within an event rather than inability to map a host to an owner.

Question 108

A suspicious network rule appears on a firewall. Which supplemental log best identifies whether an administrator changed policy shortly before exposure?

  1. Only traffic hit counts on the rule after it became active
  2. Only router interface utilization sampled daily
  3. Only a public WHOIS record for the firewall's IP
  4. Firewall change audit logs naming the editor, rule, and time

Explanation

Correct Answer

D:

Administrative audit trails connect the final rule state to the identity and operation that altered it, aiding accountability.

Incorrect Answers

A:

Hit counts reveal use but cannot identify who created or edited the rule and when that happened.

B:

Link throughput cannot prove a particular firewall rule was created or modified by a specific administrator.

C:

Registry ownership does not reconstruct internal configuration changes or privileged console sessions.

Question 109

A SIEM correlates a VPN login at 10:03 with a file download recorded at 09:59. The application server clock is four minutes behind. What should happen before asserting impossible ordering?

  1. Assume the same user was impossible to authenticate twice
  2. Change both timestamps to the date of analysis without documentation
  3. Account for clock offsets without changing source records
  4. Delete whichever event appears to be earlier

Explanation

Correct Answer

C:

Correcting skew allows a reliable sequence while keeping raw evidence for audit and later validation.

Incorrect Answers

A:

The issue is inconsistent time references; multiple sessions are not disproved by skewed timestamps.

B:

Fabricating or overwriting source times destroys provenance and prevents trustworthy incident reconstruction.

D:

Discarding data hides the clock problem and can remove legitimate evidence from the case timeline.

Question 110

A central log collector is a single point of failure for the entire SOC. Which availability design best addresses this dependency?

  1. Use redundant collectors and durable queues during failover
  2. Run the SIEM dashboard on a larger screen
  3. Send all sources to one unmanaged workstation with no backup
  4. Disable collection from high-volume security devices during outages

Explanation

Correct Answer

A:

Redundancy and buffering reduce the window in which a collector outage causes permanent loss of audit events.

Incorrect Answers

B:

Presentation equipment does not improve availability or ensure event delivery when ingestion infrastructure fails.

C:

Consolidation onto one fragile host amplifies the failure mode rather than removing it.

D:

Suppressing major sources creates a blind spot, especially when attacks may be occurring during a failure.

Certified SOC Analyst (312-39) Practice Tests