Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 16

Question 150

A detection rule should identify possible DNS tunneling while avoiding legitimate long cloud service names. What evidence combination is strongest?

  1. Look for unusual long, high-entropy queries to rare domains
  2. Alert whenever a user visits any website with a subdomain
  3. Rely solely on the top-level domain being uncommon
  4. Block every TXT query made by corporate devices

Explanation

Correct Answer

A:

Multiple statistical and contextual signals are more discriminating than a single long domain label.

Incorrect Answers

B:

Subdomains are routine Internet naming constructs and are too broad to isolate suspicious tunneling.

C:

A rare suffix is weak without query cadence, content characteristics, and knowledge of the querying application.

D:

TXT records are used by legitimate email and domain services; unconditional blocking risks disruption.

Question 151

A server with no normal administrative role suddenly initiates RDP sessions to many peer servers using a newly privileged account. What is the best SIEM correlation?

  1. Inspect successful RDP counts without source-host role, account privilege or peer breadth
  2. Treat any one successful RDP login as sufficient confirmation of compromise
  3. Join remote logons and privileges across multiple hosts
  4. Prioritize total egress bandwidth without examining remote-login relationships

Explanation

Correct Answer

C:

Combining lateral session activity and privilege changes helps distinguish compromise from expected administration.

Incorrect Answers

A:

Simple logon counts lack the source baseline, newly granted privileges, and fan-out pattern that make this server-to-server activity suspicious.

B:

Remote administration can be authorized; the suspicious finding depends on unfamiliar initiation, account changes, and unusually broad peer access.

D:

Bandwidth anomalies can indicate some attacks, but do not link the new privilege grant to multi-host RDP activity or establish lateral access.

Question 152

A SIEM must distinguish a vulnerability scanner from a compromised laptop probing internal servers. Which enrichment is most effective?

  1. Validate the source scanner, target list, and maintenance approval
  2. Use only the operating system of the destination server
  3. Alert on all ICMP traffic regardless of source or rate
  4. Exclude all internal IP addresses from scan analytics

Explanation

Correct Answer

A:

Authorized scanning can resemble reconnaissance, so stable source attribution and scope validation reduce false positives without hiding new scanners.

Incorrect Answers

B:

The target OS is background context and cannot identify whether probing came from approved assessment infrastructure.

C:

ICMP is used for legitimate diagnostics and does not alone demonstrate meaningful port or host enumeration.

D:

Internal compromised hosts commonly perform reconnaissance, so suppressing private addresses removes valuable coverage.

Question 153

A privileged workstation uploads unusually large encrypted archives to a file-sharing service not approved by policy. Which detection best supports escalation?

  1. Correlate unusual egress with sensitive assets and process activity
  2. Rely only on hard disk free space before the upload
  3. Ignore the upload because an archive has a valid file extension
  4. Assume that all HTTPS uploads represent exfiltration

Explanation

Correct Answer

A:

Evidence of a large transfer is stronger when tied to high-value data and unauthorized destinations, with legitimate backup explanations checked.

Incorrect Answers

B:

Disk capacity does not show that data left the endpoint or that the remote service was unauthorized.

C:

A valid format says little about authorization, classification, or the legitimacy of the transfer destination.

D:

HTTPS is a common transport for authorized business services, so encryption alone cannot identify theft.

Question 154

A file server user copies hundreds of restricted documents to a removable drive. Which paired telemetry makes the investigation most credible?

  1. Only the workstation's CPU temperature trend
  2. Only the total number of successful VPN logins that day
  3. Only the removable drive vendor name
  4. Correlate sensitive file reads with removable-drive writes

Explanation

Correct Answer

D:

The combination ties a specific identity and file set to portable storage use rather than inferring theft from device insertion alone.

Incorrect Answers

A:

Hardware temperatures are unrelated to removable-media file activity or restricted data classification.

B:

Remote access volume does not establish local writes to a USB storage device.

C:

Hardware make and model do not show whether sensitive files were copied or who performed the operation.

Question 155

An employee creates an email rule forwarding messages containing invoice keywords to a personal domain. What SIEM sources should be correlated?

  1. Only the company-wide spam volume for the quarter
  2. Match new mail-forward rules to outbound mail flow
  3. Only the desktop browser version for that employee
  4. Only the corporate DNS resolver software build

Explanation

Correct Answer

B:

Forwarding configuration and actual deliveries together reveal whether the new rule routed business mail outside approved channels.

Incorrect Answers

A:

Aggregate spam counts lack the individual forwarding rule and actor context needed for this case.

C:

Browser inventory does not show mailbox rule configuration or where matching messages were delivered.

D:

Resolver version cannot identify mailbox administrative changes or unauthorized automatic forwarding.

Question 156

An identity administrator is added to a highly privileged cloud role outside the maintenance window. What should a rule join?

  1. A static list of all users without modification timestamps
  2. Only the organization's total number of cloud resources
  3. Only endpoint antivirus scan duration on the administrator's laptop
  4. Review role grants, initiating identity, and authorization records

Explanation

Correct Answer

D:

Privilege changes become actionable when the SOC can assess who made the grant and whether an authorized workflow explains it.

Incorrect Answers

A:

An inventory alone cannot expose the specific change event or the principal that authorized it.

B:

Resource count does not identify who modified a role or whether the action was approved.

C:

Scan duration cannot establish that a cloud directory role grant was legitimate.

Question 157

A file server shows rapid modification of many documents, service stopping, and suspicious remote execution. Which alerting design is strongest?

  1. Use a single rule that flags all file changes on any server
  2. Trigger only when an attacker posts a public ransom demand
  3. Correlate rapid file changes, protection tampering, and spread
  4. Require an external DNS blocklist hit before detecting encryption behavior

Explanation

Correct Answer

C:

A multi-signal analytic supports early ransomware detection and distinguishes it from some legitimate bulk file operations.

Incorrect Answers

A:

Routine backup, editing, and indexing produce file activity; the additional signals and rate are needed for discrimination.

B:

Waiting for visible extortion signs may delay containment until substantial damage has occurred.

D:

Ransomware can operate without contacting a currently known domain, so a network reputation prerequisite can miss local impact.

Question 158

A service identity that normally runs one scheduled database job begins querying HR records and invoking remote administration. Which analytic approach best fits?

  1. Alert on every successful action by every service account
  2. Use only the monthly help-desk ticket total for the database team
  3. Alert on service-account actions outside its behavioral baseline
  4. Exclude all service accounts from SIEM monitoring because they are nonhuman

Explanation

Correct Answer

C:

Service identities have narrow expected workflows, making deviations in access and execution particularly informative.

Incorrect Answers

A:

Normal automated jobs generate large event volumes; broad success-only alerts lack meaningful deviation criteria.

B:

Ticket counts are not sufficient to reveal unauthorized HR queries or remote sessions made by a service principal.

D:

Compromised automation identities can carry broad privileges and merit careful monitoring.

Question 159

A malicious IP feed changes daily. How should a SIEM use it without making every matching connection a high-severity incident?

  1. Score intelligence matches by reliability, age, and host context
  2. Treat every feed entry as permanently malicious regardless of age
  3. Remove source IPs from connection logs after enrichment
  4. Ignore all threat intelligence unless malware has already executed

Explanation

Correct Answer

A:

Indicator matches are leads whose significance depends on provenance and whether the observed connection reflects likely malicious activity.

Incorrect Answers

B:

Network addresses may be reassigned or misclassified, making stale unqualified blocking risky.

C:

Keeping the original observable enables independent verification and investigation of potential feed false positives.

D:

Intel can aid early detection and triage before definitive endpoint compromise is proven.

Question 160

A WAF blocks hundreds of suspicious requests to an application but the backend audit logs show no matching execution. How should triage characterize the evidence?

  1. Evidence that all application vulnerabilities have been remediated
  2. Likely blocked attack attempts, subject to outcome validation
  3. Certain successful compromise of the backend database
  4. Proof that the request source is benign because it was denied

Explanation

Correct Answer

B:

Blocked requests are security events; confirmed compromise requires evidence that a harmful request reached or altered the backend.

Incorrect Answers

A:

A functioning filter can mitigate observed requests but does not by itself fix unsafe application code or every bypass.

C:

A WAF detection cannot demonstrate execution when the application records show no corresponding effect.

D:

Blocking does not establish intent or innocence; the request pattern may still represent an active adversary.

Certified SOC Analyst (312-39) Practice Tests