Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 17

Question 160

A WAF blocks hundreds of suspicious requests to an application but the backend audit logs show no matching execution. How should triage characterize the evidence?

  1. Evidence that all application vulnerabilities have been remediated
  2. Likely blocked attack attempts, subject to outcome validation
  3. Certain successful compromise of the backend database
  4. Proof that the request source is benign because it was denied

Explanation

Correct Answer

B:

Blocked requests are security events; confirmed compromise requires evidence that a harmful request reached or altered the backend.

Incorrect Answers

A:

A functioning filter can mitigate observed requests but does not by itself fix unsafe application code or every bypass.

C:

A WAF detection cannot demonstrate execution when the application records show no corresponding effect.

D:

Blocking does not establish intent or innocence; the request pattern may still represent an active adversary.

Question 161

A Windows endpoint records an unfamiliar Run key addition associated with a program in a user-writable folder. Which analytic is appropriate?

  1. Filter exclusively on DNS query lengths
  2. Join autorun changes with the launched file and parent process
  3. Monitor only externally opened firewall ports
  4. Treat every registry change as confirmed malicious persistence

Explanation

Correct Answer

B:

Startup persistence is stronger when the registry change points to an unexpected executable and an identifiable actor.

Incorrect Answers

A:

DNS features do not directly observe modification of Windows autorun configuration.

C:

Local registry persistence may exist even with no inbound listening service or external port exposure.

D:

Administrative software routinely updates registry keys; the key path and executable context are what matter.

Question 162

An EDR flags an unsigned binary spawned from a trusted system utility; the SIEM shows its network connections to a rare destination. What combined conclusion is appropriate?

  1. Discard the EDR alert because network logs are already available
  2. Declare all binaries launched by signed Windows utilities harmless
  3. Assume a rare destination means data theft has definitely completed
  4. Investigate the host process alongside the suspicious network flow

Explanation

Correct Answer

D:

Process ancestry and outbound traffic jointly raise concern, while file provenance and authorized use still require verification.

Incorrect Answers

A:

The EDR supplies process and file context that network metadata alone cannot reconstruct.

B:

Trusted tools can be abused as parent or execution mechanisms, so signer status does not guarantee benign child activity.

C:

Rarity supports investigation but does not prove content or volume of an exfiltration transfer.

Question 163

A cloud administrator disables a security logging service and immediately creates a new access key for an unfamiliar identity. Which rule structure fits?

  1. Correlate audit-policy changes and new credentials by actor and time
  2. Assume security logging cannot be disabled in cloud environments
  3. Monitor only the CPU consumption of virtual machines
  4. Alert on every new key without considering approval or preceding logging changes

Explanation

Correct Answer

A:

Combining control-plane operations reveals potential defense evasion and persistence that neither event alone conclusively establishes.

Incorrect Answers

B:

Cloud audit controls and service integrations can have changeable configuration, making control-plane monitoring important.

C:

Control-plane changes can occur without any VM CPU anomaly, so compute metrics do not cover the targeted actions.

D:

Key creation can be normal; sequence and change authorization improve confidence and prioritization.

Question 164

A SIEM runs a rule every five minutes against the last five minutes of data, but event ingestion can lag ten minutes. What risk should the engineer address?

  1. The SIEM will automatically correct every late event without any configuration
  2. Late arrivals may be missed unless the rule uses an overlap or delayed-event strategy
  3. Converting every source timestamp to its ingest time ensures original chronology
  4. Running the query less often always increases accuracy

Explanation

Correct Answer

B:

Query cadence must account for ingestion latency, deduplication, and event time to avoid permanent coverage gaps.

Incorrect Answers

A:

Not every scheduler rechecks historic windows; assuming automatic replay can leave silent detection gaps.

C:

Ingest time can distort event order and masks the very delay that the analytic needs to handle.

D:

Reduced frequency may save compute but does not inherently repair missing late-arriving data.

Question 165

An alert says a domain controller contacted a newly malicious IP but provides no process context. What should the SOC analyst do before declaring compromise?

  1. Close the alert because domain controllers sometimes make network connections
  2. Check service role and flow context against current intelligence
  3. Assume the domain controller initiated the flow because its name appears in the title
  4. Immediately publish attribution to a named intrusion group

Explanation

Correct Answer

B:

A single address match is an indicator; host and traffic context determine whether the observation reflects malicious communication or a false positive.

Incorrect Answers

A:

Normal connectivity does not excuse traffic to a suspicious destination; the specific service and timing still require analysis.

C:

Alert labels can contain normalized or translated addresses; the underlying event must confirm direction and actor.

D:

A reputation match alone cannot establish actor identity, motive, or a complete intrusion narrative.

Question 166

A confirmed compromised domain-admin account is actively issuing directory changes. Which factor most strongly supports critical incident severity?

  1. The incident ticket is the oldest one in the queue
  2. Prioritize confirmed high-privilege malicious activity
  3. The finding contains only four distinct tags
  4. The log source is popular among SOC analysts

Explanation

Correct Answer

B:

Severity should reflect confidence and consequences, not merely alert count; domain-wide administration increases blast radius.

Incorrect Answers

A:

Age matters to service management, but a confirmed privileged intrusion is urgent because of active impact and access.

C:

Tag count is not a credible proxy for confirmed malicious actions or affected assets.

D:

Familiarity with a product does not measure adversary capability or exposure of identity infrastructure.

Question 167

A rule warns when a signed software deployment service starts a shell. Repeated alerts match a documented rollout on approved hosts. What is the safest tuning action?

  1. Disable audit process creation for the organization
  2. Scope an exclusion to verified deployment identity, host group, parentage, and change window
  3. Mark all past and future alerts from the deployment service as benign without testing
  4. Suppress every command-shell event on every host

Explanation

Correct Answer

B:

A narrow documented condition reduces routine noise while keeping anomalous shells from that service visible outside approved contexts.

Incorrect Answers

A:

Removing telemetry impairs many unrelated detections and prevents validation of future suspicious execution.

C:

A known benign pattern can be impersonated; changes in command, target, or execution context still matter.

D:

Attackers frequently use shells, so a global exclusion would create a large blind spot.

Question 168

Two detection variants fire on the same test dataset: rule A catches 18 of 20 attacks with 40 false alerts; rule B catches 17 with 2 false alerts. What should reviewers consider?

  1. Declare both rules equivalent because their true-positive counts are close
  2. Both detection recall and false-positive workload against business risk
  3. Choose solely the rule that emits the most alerts
  4. Choose solely the lowest compute-cost rule without examining missed attacks

Explanation

Correct Answer

B:

Rule B greatly reduces triage noise but misses one extra test case; choosing requires understanding which attack was missed and its impact.

Incorrect Answers

A:

The false-positive difference is substantial and affects analyst capacity and trust in the detection.

C:

A high count can reflect noise rather than effective identification of malicious behavior.

D:

Cheap execution is not valuable if it fails critical detection objectives or creates unacceptable exposure.

Question 169

An analyst sees a suspicious process hash in an alert. What evidence should be checked before assigning a malware family?

  1. Only whether the process name uses capital letters
  2. Only the alert title written by a third-party feed
  3. Only the local username length
  4. Corroborate file provenance with observed execution behavior

Explanation

Correct Answer

D:

A digest or suspicious filename is not enough for confident family attribution, especially when samples may be modified or misclassified.

Incorrect Answers

A:

File-name typography has little evidentiary value for malware classification and can easily be mimicked.

B:

Vendor labels can be mistaken and do not replace evidence of what the executable did on the affected system.

C:

Account string length does not identify a binary's capabilities or origin.

Question 170

An escalated incident case needs to remain actionable when ownership changes. What content should its analyst note preserve?

  1. Only an unstructured sentence saying the alert looks suspicious
  2. Only the final status without rationale or artifacts
  3. Record the investigation timeline, evidence, and open decisions
  4. Only the analyst's personal opinion of the detection vendor

Explanation

Correct Answer

C:

Structured case notes permit reproducible reasoning and show the next responder what was actually observed versus inferred.

Incorrect Answers

A:

A vague assessment omits supporting events, impacted systems, and the exact next decision.

B:

A status field cannot explain why a case was escalated or how another analyst should validate it.

D:

A vendor impression does not provide evidence or a defensible incident timeline.

Certified SOC Analyst (312-39) Practice Tests