Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 13

Question 120

A correlation rule compares host usernames from EDR with account principals from identity logs. It misses matches because one uses DOMAIN\user and the other user@domain. What is needed?

  1. Normalize identities to a stable principal key
  2. Replacing the identity logs with firewall packet counters
  3. Raising the alert threshold so fewer names are compared
  4. Discarding domain information from all records

Explanation

Correct Answer

A:

Consistent entity resolution lets the rule associate different string forms with one account while preserving original fields.

Incorrect Answers

B:

Traffic counters have less account context and do not solve the entity matching problem.

C:

Threshold tuning does not resolve equivalent accounts expressed in incompatible identity formats.

D:

Blindly stripping domain context can incorrectly merge different users with the same short name.

Question 121

An analyst must detect five failed logins from one user within ten minutes. Which correlation technique is appropriate?

  1. Trigger on a single failed login regardless of prior events
  2. Count all failures across all users for the entire month
  3. Group failures by user in a ten-minute window
  4. Alert only after a successful password reset

Explanation

Correct Answer

C:

Grouping by identity and bounded event time distinguishes repeated attempts from isolated failures while controlling alert volume.

Incorrect Answers

A:

One failure does not meet the required threshold and would create excessive alerts for normal typing errors.

B:

A global monthly total loses both per-user attribution and the ten-minute temporal constraint.

D:

Reset events are not part of the specified repeated failed-logon sequence.

Question 122

A detection use case needs to fire when a suspicious script runs and the same host connects to a rare domain within two minutes. Which rule design is best?

  1. A time-bounded ordered sequence keyed by host identity
  2. Separate script and DNS count alerts without a common host correlation key
  3. A rare-domain match alone without evidence of script execution on the host
  4. Independent daily summaries of script and DNS events across all devices

Explanation

Correct Answer

A:

The rule must connect process and DNS or network events on the same endpoint with a meaningful order and interval.

Incorrect Answers

B:

Unconnected counts may indicate activity independently but cannot show that one affected host executed the script and contacted the rare domain.

C:

A destination-only indicator lacks the required execution sequence and could trigger on benign DNS lookups unrelated to the script.

D:

Daily aggregates lose the two-minute order and per-host linkage needed to distinguish the suspicious sequence from normal fleet activity.

Question 123

Before deploying a new detection for mass mailbox forwarding changes, what should an engineer define to make it testable?

  1. Only the largest possible alert severity value
  2. Testable hypothesis, required fields, and validation cases
  3. Only an attention-grabbing name for the detection
  4. Only the number of SOC analysts who can view dashboards

Explanation

Correct Answer

B:

An explicit analytic contract lets the SOC verify that the rule observes the malicious behavior without flagging authorized administration indiscriminately.

Incorrect Answers

A:

Severity alone does not validate logic or prevent false positives from normal mailbox changes.

C:

A title helps analysts locate a rule but does not establish its data prerequisites or expected behavior.

D:

Viewer staffing is separate from specifying what event pattern the rule must identify.

Question 124

A reliable SIEM rule suddenly becomes noisy after the organization deploys a new endpoint-management tool. What step best fits detection lifecycle management?

  1. Delete all previous incident labels and start counting fresh alerts
  2. Review labeled detections and adjust approved exclusions
  3. Permanently disable every rule that mentions the endpoint-management vendor
  4. Increase rule severity so analysts can close alerts faster

Explanation

Correct Answer

B:

Detection rules need post-deployment validation as benign behavior changes, with regression tests to protect true-positive coverage.

Incorrect Answers

A:

Discarding validated outcomes removes evidence needed to distinguish useful tuning from harmful suppression.

C:

Broad suppression may hide real threats using the same processes or tools and ignores narrower conditions.

D:

A severity change does not improve precision and may escalate a flood of expected administrative actions.

Question 125

A detection has no named owner and begins failing after a field-name change. Which operational practice would prevent prolonged silent failure?

  1. Assign rule ownership, version control, and regression checks
  2. Allow any analyst to edit production queries without review
  3. Require no documentation for detections once initially enabled
  4. Measure only how many user accounts exist in the directory

Explanation

Correct Answer

A:

An accountable maintainer can detect schema drift, repair queries, and verify the rule still produces expected test findings.

Incorrect Answers

B:

Uncontrolled changes increase error risk and provide no accountability for breakage or validation.

C:

Unrecorded prerequisites and lack of tests make future schema changes difficult to assess and repair.

D:

Directory size cannot reveal that a query depends on a stale field name.

Question 126

A cloud ingestion outage causes three-hour-old events to arrive suddenly. A rule using ingest time reports suspicious activity as happening now. What concept should be corrected?

  1. Assume all late-arriving events were generated at ingestion time
  2. Correlate using event time, monitoring ingestion delay separately
  3. Disable every time condition in all SIEM rules
  4. Delete the delayed batch before investigating it

Explanation

Correct Answer

B:

Event timestamps represent when activity occurred; ingestion timestamps describe when it reached the platform and may lag significantly.

Incorrect Answers

A:

Transport delays do not rewrite the original sequence of attacker or application behavior.

C:

Unbounded correlation can mix unrelated events and create misleading activity sequences.

D:

Late data may contain important evidence and should be labeled and processed, not discarded without assessment.

Question 127

A low-confidence alert appears on a domain controller and a similar one on a lab workstation. Which triage factor should help rank them?

  1. The alphabetical position of each hostname
  2. The operating system desktop background
  3. Combine asset criticality with detection confidence
  4. The number of icons displayed beside each alert

Explanation

Correct Answer

C:

A privileged identity infrastructure component can raise impact, although evidence and business context still determine actual incident severity.

Incorrect Answers

A:

Hostname ordering does not reflect operational importance, access level, or the quality of threat evidence.

B:

A wallpaper image does not estimate the business impact or attack pathways associated with the asset.

D:

Interface decoration is not a validated measure of likelihood or consequences of compromise.

Question 128

Several low-confidence alerts concern one identity: unfamiliar device, risky OAuth grant, and impossible access to sensitive data. What analytic approach is useful?

  1. Combine signals in an explainable entity risk score
  2. Disable cross-source correlation to avoid complex cases
  3. Count unrelated alerts from every user as one identity's risk
  4. Treat each signal as proof of compromise independently

Explanation

Correct Answer

A:

Correlated weak signals on the same principal can justify escalation, especially when score components and time windows are explainable.

Incorrect Answers

B:

Separating evidence loses the behavior chain needed to recognize multi-stage attacks.

C:

An aggregate across unrelated principals cannot justify the same user-centered security conclusion.

D:

Low-confidence events may be benign; combined context improves prioritization without creating absolute certainty.

Question 129

An organization maintains a small approved list of vulnerability-scanner IPs. How should it be used in a scan detection?

  1. As a substitute for recording the original source IP in each event
  2. As proof that any other address must be malicious
  3. As a narrowly governed allowlist or enrichment with ownership and expiry
  4. As a permanent exclusion for all traffic from those IPs in every analytic rule

Explanation

Correct Answer

C:

Known authorized scanners can explain particular probing patterns, but their addresses and approvals should be reviewed to avoid hiding compromised assets.

Incorrect Answers

A:

Losing the raw address prevents verification of which host produced the observed traffic.

B:

Unlisted systems may scan for legitimate reasons, and maliciousness still requires behavioral and authorization context.

D:

A blanket bypass would conceal unrelated malicious activity if a trusted scanner became compromised.

Question 130

A failed-login rule creates one alert per failure and overwhelms the queue during a password attack. What change can preserve the pattern while reducing volume?

  1. Group by account and source, issuing one windowed summary
  2. Remove timestamps from failed-logon events
  3. Create a separate high-severity case for every rejected password
  4. Erase all authentication failures from the SIEM

Explanation

Correct Answer

A:

Grouping related failures retains their count and temporal significance while preventing redundant analyst tickets.

Incorrect Answers

B:

Timestamps are necessary to recognize rate-based attack patterns and avoid unrelated event aggregation.

C:

One-to-one alerting is the current source of queue overload, and higher priority would amplify the problem.

D:

Removing those records prevents investigation of password attacks and destroys useful supporting data.

Certified SOC Analyst (312-39) Practice Tests