Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 19

Question 180

An analyst can investigate only one of two alerts first: confirmed credential theft on an administrator account or a low-confidence scanner finding on an unused lab server. What is the defensible priority?

  1. The verified compromise of a highly privileged identity
  2. Assign priority solely by the number of rule names attached to each alert
  3. The lab finding because vulnerability scanner reports arrive first in the queue
  4. Investigate neither until both triggers fire again

Explanation

Correct Answer

A:

Active credential theft against an administrative identity can enable rapid expansion and needs urgent containment coordination.

Incorrect Answers

B:

Detection-label count does not establish criticality or the business consequences of the underlying behavior.

C:

Arrival order is not a substitute for severity, evidence confidence, and the impact of affected privileges.

D:

Confirmed compromise is actionable now; waiting for additional repetition can extend attacker access.

Question 181

A suspicious process connects to an address classified as hostile, but it is also the company's approved web-security proxy. Which triage action is appropriate?

  1. Block the corporate proxy for every endpoint without incident authorization
  2. Resolve the proxy mediation path and determine the actual upstream destination
  3. Discard all threat intelligence for proxied traffic
  4. Assume any connection to the proxy means the endpoint is compromised

Explanation

Correct Answer

B:

Enterprise proxies can obscure original destinations, so routing and request logs must distinguish proxy connectivity from direct contact with a hostile endpoint.

Incorrect Answers

A:

A global block would interrupt valid web access and is not justified by ambiguous destination attribution.

C:

Intel can remain valuable when applied to the destination behind the proxy rather than the proxy egress itself.

D:

Approved proxies are routinely used by benign applications, making direct inference from their address unreliable.

Question 182

An alert contains evidence that volatile memory may hold malware encryption keys and the host is still running. Who should receive the request for acquisition?

  1. The automated log-cleanup job normally run on the server
  2. An authorized responder trained in forensic evidence handling
  3. Every end user of the affected application for manual memory copying
  4. Only the organization's public-relations team

Explanation

Correct Answer

B:

Volatile capture is time-sensitive and can alter state, so it should be performed by trained personnel with documented scope.

Incorrect Answers

A:

Cleanup can destroy relevant artifacts and is the opposite of preserving volatile evidence for investigation.

C:

Untrained users could overwrite evidence or expose sensitive data without preserving a reliable chain of custody.

D:

Communications may be involved later, but memory acquisition is a technical evidence task with access and preservation requirements.

Question 183

A SIEM dashboard lists twenty suspected phishing cases, but several involve contractors. Which context should drive assignment?

  1. Treat contractor accounts as exempt from response because they are external
  2. Assign every case only by the first letter of the account name
  3. Close contractor alerts whenever they originate outside the office network
  4. Clarify the contractor owner, affected data, and response obligations

Explanation

Correct Answer

D:

Correct ownership ensures the right business and security parties authorize account actions while the SOC continues evidence collection.

Incorrect Answers

A:

External collaborators can access important systems and require controlled incident handling within contractual boundaries.

B:

Alphabetic routing ignores organizational responsibility and may send sensitive cases to unrelated teams.

C:

Remote access is expected for many contractors and does not establish either legitimacy or maliciousness alone.

Question 184

An analyst determines a detection is a false positive caused by a deployment job. Which feedback best helps the detection engineer?

  1. Provide actual false-positive events and a proposed rule refinement
  2. Raise the detection severity as punishment for the false positive
  3. Delete the detection source logs so it cannot fire again
  4. Send only the message that the rule is bad

Explanation

Correct Answer

A:

Specific reproducible evidence allows tuning and regression tests without suppressing real attacks that share partial features.

Incorrect Answers

B:

Severity does not address false-positive logic and may worsen the workload caused by the rule.

C:

Removing telemetry hides future attacks and eliminates the examples needed to repair the analytic.

D:

A vague complaint gives no fields or expected behavior to test and makes a safe correction difficult.

Question 185

A SOC wants to measure how frequently alerts prove actionable after analyst validation. What metric most directly answers this?

  1. Total log storage in terabytes
  2. The fraction of investigated alerts confirmed actionable
  3. Average time from case opening to final notification
  4. The number of security vendors installed

Explanation

Correct Answer

B:

A labeled denominator links detection output to confirmed useful findings and guides prioritization and tuning.

Incorrect Answers

A:

Storage volume captures telemetry scale, not the quality of alerts after an investigation.

C:

Closure and communication latency measure workflow speed rather than whether a detection was actionable.

D:

Tool inventory does not show which alerts were confirmed or required response.

Question 186

An identity log and EDR log have different time zones and may refer to the same attack. What must a case timeline preserve?

  1. Only the order in which alerts appeared on the screen
  2. Document normalized offsets but preserve original event times
  3. Only dates with no hours or seconds
  4. Only the analyst's current local time for all events

Explanation

Correct Answer

B:

Transparent normalization supports consistent sequencing while allowing later reviewers to audit whether clock skew changed interpretation.

Incorrect Answers

A:

Ingestion and display order can differ from the order in which attacker actions actually occurred.

C:

A multi-stage intrusion may unfold in minutes, so removing precision undermines correlation.

D:

Overwriting event time with analysis time destroys causal relationships across collected sources.

Question 187

A SIEM alert is high confidence but the proposed response would disable a critical industrial controller. What should the analyst do?

  1. Follow the OT response plan and obtain safety authorization
  2. Run an unapproved vulnerability scan against the controller before escalation
  3. Ignore the possible intrusion because controllers should never be investigated
  4. Automatically isolate the controller based solely on its alert score

Explanation

Correct Answer

A:

Containment of safety-critical assets requires coordination with the owner and response authority, even under urgent security pressure.

Incorrect Answers

B:

Active scanning can disrupt fragile systems and should not be improvised during an incident without specialist approval.

C:

Safety considerations change the method and authority for response, not whether malicious activity is assessed.

D:

An uncontrolled action can jeopardize process safety or availability and bypass established critical-system procedures.

Question 188

A shift supervisor needs a display that shows critical unassigned alerts and case age, not raw event counts alone. Which dashboard elements fit best?

  1. Display the feed of newly published threat indicators without joining it to open cases
  2. Queue ownership, priority, ageing, and SLA breach indicators linked to live cases
  3. Only a cumulative line chart of all ingested bytes
  4. Only a list of the newest indexed log filenames

Explanation

Correct Answer

B:

Operational dashboards help a supervisor balance workloads and avoid unowned incidents, complementing technical detection views.

Incorrect Answers

A:

Threat feeds support investigation but do not identify which critical incidents are unassigned or how long live response tickets have remained pending.

C:

Volume may reveal platform health but cannot show which cases are stalled or waiting for assignment.

D:

Filename ordering does not identify which open alerts need an on-call analyst or escalation.

Question 189

A SOC dashboard reports no attacks from a sensitive subnet for a week. What additional visualization avoids a false sense of safety?

  1. Sensor telemetry heartbeats and coverage checks
  2. A chart that removes all devices with zero alerts
  3. A map showing only countries associated with confirmed malware
  4. An alert severity chart that excludes missing sources by design

Explanation

Correct Answer

A:

An absence of findings is only meaningful when sources are reporting; data-health panels help distinguish quiet networks from blind spots.

Incorrect Answers

B:

Filtering silent devices hides potential sensor failures and reinforces a misleading absence-of-threat claim.

C:

Geographic summaries do not establish that the local subnet's logging is functioning.

D:

Severity visualization cannot repair or reveal data gaps unless source-health is represented.

Question 190

A chief information security officer requests a monthly SOC review. What mix of information is most actionable?

  1. Every raw authentication event from every workstation
  2. Only the number of analysts who visited the SOC console
  3. Only the total number of alerts with no false-positive qualification
  4. Report confirmed impact, response times, and detection gaps

Explanation

Correct Answer

D:

Executive reporting should connect operational outcomes with business risk and improvement commitments, not merely display tool activity.

Incorrect Answers

A:

An unfiltered log dump overwhelms the intended audience and lacks synthesized risk or operational interpretation.

B:

Console visits are not a reliable indicator of incident impact, containment success, or coverage improvement.

C:

Raw alert volume can rise because of rule noise or ingestion changes and may misrepresent actual threats.

Certified SOC Analyst (312-39) Practice Tests