Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 12

Question 110

A central log collector is a single point of failure for the entire SOC. Which availability design best addresses this dependency?

  1. Use redundant collectors and durable queues during failover
  2. Run the SIEM dashboard on a larger screen
  3. Send all sources to one unmanaged workstation with no backup
  4. Disable collection from high-volume security devices during outages

Explanation

Correct Answer

A:

Redundancy and buffering reduce the window in which a collector outage causes permanent loss of audit events.

Incorrect Answers

B:

Presentation equipment does not improve availability or ensure event delivery when ingestion infrastructure fails.

C:

Consolidation onto one fragile host amplifies the failure mode rather than removing it.

D:

Suppressing major sources creates a blind spot, especially when attacks may be occurring during a failure.

Question 111

A case is under legal hold while the general retention policy would normally delete its relevant log records tomorrow. What is the correct approach?

  1. Copy the logs into an analyst's personal account without tracking
  2. Allow automatic deletion and assume summary statistics will suffice
  3. Suspend deletion for evidence subject to the legal hold
  4. Edit the events to remove identities before any preservation decision

Explanation

Correct Answer

C:

A hold overrides routine expiration for relevant material, with controlled access, retention documentation, and eventual release processes.

Incorrect Answers

A:

Uncontrolled transfers create chain-of-custody and confidentiality problems and may not satisfy preservation requirements.

B:

Aggregates may omit material facts; destroying scoped evidence during a hold undermines preservation obligations.

D:

Altering original evidence may undermine integrity; privacy protections should use controlled access and separately documented derived copies.

Question 112

A SIEM rule has not fired for a week, but the monitored firewall also stopped sending heartbeats. Which conclusion is best supported?

  1. The telemetry outage prevents assurance about detection coverage
  2. All endpoint agents must be operating at maximum efficiency
  3. The monitored network is unquestionably free of attacks
  4. The firewall must have blocked every attempted connection

Explanation

Correct Answer

A:

An absent alert cannot be interpreted as benign activity when required telemetry is missing, so monitor data-source health separately.

Incorrect Answers

B:

One firewall feed's state offers no evidence about performance or health of unrelated endpoint collectors.

C:

No detections from a silent source provide no assurance about actual traffic or adversary behavior.

D:

A missing heartbeat does not establish security enforcement outcomes or packet disposition.

Question 113

An enterprise wants to correlate endpoint processes, firewall traffic, and identity sign-ins in one investigation interface. Which platform capability is central?

  1. A vulnerability scanner with only periodic configuration checks
  2. Use a SIEM for normalized cross-source search and correlation
  3. A standalone packet-filtering rule set without retained logs
  4. An endpoint antivirus quarantine folder only

Explanation

Correct Answer

B:

SIEM analysis links events across disparate sources, enabling detection rules and timeline construction when collection and field mappings are configured.

Incorrect Answers

A:

Scanning finds exposure at intervals; it does not replace continuous log ingestion and real-time event correlation.

C:

A firewall can enforce traffic policy but cannot by itself join identity and endpoint histories from unrelated systems.

D:

Quarantine artifacts help investigate individual hosts but do not provide the requested cross-source correlation and search layer.

Question 114

A new VPN gateway sends events to the SIEM, but destination country searches return no records even though raw text contains addresses. What should be checked first?

  1. Change dashboard geographic filters while leaving the VPN source-IP field unmapped
  2. The configured threshold for a database backup alert
  3. Parsing, field mapping, and geolocation enrichment for VPN source addresses
  4. Expand the country threat-intelligence list before confirming address extraction

Explanation

Correct Answer

C:

Raw events may be present while analytic attributes are missing; correct extraction and enrichment make address-based visualizations usable.

Incorrect Answers

A:

Filtering changes which existing enriched records appear, but cannot create geographic values when the address-to-field parsing and enrichment pipeline is broken.

B:

A separate backup detector does not determine whether VPN records have valid mapped network fields.

D:

More geographic intelligence cannot enrich an address if the parser never extracts it into a usable normalized field from the raw VPN message.

Question 115

A SIEM performs well during the day but drops security events whenever batch jobs run overnight. Which sizing measurement deserves attention?

  1. Base throughput planning exclusively on the daytime CPU utilization average
  2. Size SIEM infrastructure from daily average events per second and storage capacity only
  3. Peak event rate and bytes per second including bursts, not only daily averages
  4. Only the total count of analyst usernames

Explanation

Correct Answer

C:

Ingestion and parsing capacity must accommodate realistic peak loads and buffering to prevent loss during short high-volume intervals.

Incorrect Answers

A:

Daytime CPU averages can appear healthy while a nighttime workload creates an unmeasured peak in event bytes, parsing cost, or transport backpressure.

B:

An average can hide brief overnight ingest bursts that exceed processing or queue capacity, resulting in dropped messages despite acceptable daily totals.

D:

Staffing is relevant to triage capacity, but the observed loss occurs at the event ingestion layer.

Question 116

A branch collector forwards logs from six network appliances, but every event is displayed as originating from the collector. Investigators cannot identify which appliance generated a policy change. What should the SIEM engineer fix?

  1. Deduplicate records solely by their shared relay IP address
  2. Preserve the original device ID inside forwarded log events
  3. Raise incident severity for all events that share a collector address
  4. Join events by collector arrival timestamp while ignoring reported device names

Explanation

Correct Answer

B:

Relay transport identity is not the same as the originating appliance. Verifying per-device identifiers and parser mappings restores source-specific attribution.

Incorrect Answers

A:

Suppressing events by the forwarding address can hide different devices and does not recover the original sender field needed to identify a change.

C:

Severity changes triage priority but does not distinguish six underlying appliances or identify the device responsible for an administrative action.

D:

Arrival times can interleave traffic from several devices. Ordering alone cannot establish which original log producer reported a policy change.

Question 117

A managed SOC operates separate customers in one analysis platform. Which design is most important to prevent customer A from reading customer B's logs?

  1. Enforced tenant-scoped access control and data segregation throughout queries and exports
  2. Giving every analyst unrestricted access to a global index
  3. Use separate customer dashboards while both tenants retain a shared unrestricted index
  4. Relying on customer names in file titles

Explanation

Correct Answer

A:

Tenant identity must constrain searches, dashboards, alerts, and administration; UI filters alone are insufficient for isolation.

Incorrect Answers

B:

Shared administrative visibility without need-based segregation violates customer boundaries and increases data exposure.

C:

A dashboard visual boundary does not enforce query and export authorization, so a user with underlying index access could still retrieve another customer’s records.

D:

Human naming conventions can be bypassed and do not provide authoritative permissions at the data layer.

Question 118

A company has strict requirements that certain raw audit records remain in its own controlled data center, but it wants cloud-based threat analytics. Which approach may meet both?

  1. Forward every unrestricted raw record to the cloud without classification
  2. Turn off all threat detection until regulations change
  3. Assume a cloud dashboard automatically stores all bytes in the local data center
  4. A hybrid logging architecture with documented data residency and selective forwarding

Explanation

Correct Answer

D:

Data can be retained within the required boundary while approved derived signals or subsets reach cloud analytics, if contractual and technical controls allow.

Incorrect Answers

A:

Unfiltered export can violate residency and privacy constraints, regardless of analytics convenience.

B:

Residency limits require a compliant design, not abandonment of monitoring where local or hybrid options exist.

C:

Control over a web console does not determine the physical region or storage location of ingested raw telemetry.

Question 119

A primary SIEM search node fails during a live incident. Which resilience measure best preserves investigative continuity?

  1. Daily manual screenshots of the alert list
  2. Suppressing all alerts whenever the search node restarts
  3. Keep replicated search indexes with tested query-tier failover
  4. A larger monitor attached to the failed query node

Explanation

Correct Answer

C:

Search availability requires more than redundant ingestion; indexes, query components, authentication, and routing must also remain accessible.

Incorrect Answers

A:

Images omit searchable context and do not enable live investigation or pivoting across raw events.

B:

Silencing detections can hide active compromise and does not solve the failure of the query tier.

D:

Presentation hardware cannot restore lost service availability or provide replica access to incident data.

Question 120

A correlation rule compares host usernames from EDR with account principals from identity logs. It misses matches because one uses DOMAIN\user and the other user@domain. What is needed?

  1. Normalize identities to a stable principal key
  2. Replacing the identity logs with firewall packet counters
  3. Raising the alert threshold so fewer names are compared
  4. Discarding domain information from all records

Explanation

Correct Answer

A:

Consistent entity resolution lets the rule associate different string forms with one account while preserving original fields.

Incorrect Answers

B:

Traffic counters have less account context and do not solve the entity matching problem.

C:

Threshold tuning does not resolve equivalent accounts expressed in incompatible identity formats.

D:

Blindly stripping domain context can incorrectly merge different users with the same short name.

Certified SOC Analyst (312-39) Practice Tests