Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 21

Question 200

An AI alert summarizer asserts that a cloud identity is compromised, but the cited sign-in events are routine. What should the analyst do?

  1. Verify AI summaries against raw evidence and correct unsupported claims
  2. Automatically accept the summary if it includes an ATT&CK label
  3. Disable the identity solely because the summary uses confident wording
  4. Delete the raw identity logs to avoid conflicting conclusions

Explanation

Correct Answer

A:

Generated interpretations can be mistaken; security decisions should rest on reproducible log observations and documented context.

Incorrect Answers

B:

Framework labels can also be misapplied and do not prove that the underlying event occurred or was malicious.

C:

Confidence of phrasing is not evidence of malicious activity and can cause disruptive false positives.

D:

Preserving source records allows validation and later review; deleting them would destroy the basis for assessment.

Question 201

A SOC wants to send full incident logs containing passwords and personal data to a third-party AI service for summarization. What is the best first control?

  1. Apply approved data handling and redaction before external processing
  2. Disable evidence access logging so the AI job runs faster
  3. Send all fields because summary accuracy overrides data security
  4. Assume any AI endpoint is within the organization's security boundary

Explanation

Correct Answer

A:

Incident logs can include secrets and regulated data, so authorization and privacy safeguards must precede external processing.

Incorrect Answers

B:

Eliminating access records weakens accountability for sensitive case data and does not solve privacy obligations.

C:

Unrestricted transfer may breach policy and expose credentials, even if the generated narrative is more detailed.

D:

Service location and contractual protections cannot be inferred from the presence of an AI interface.

Question 202

Anomaly detection ranks an employee as high risk because login times shifted after a documented night-shift assignment. What should improve the model?

  1. Treat model output as conclusive proof of malicious insider activity
  2. Revalidate changed user context before recalibrating anomalies
  3. Delete the historical identity data used to understand prior behavior
  4. Permanently suppress every future alert about that employee

Explanation

Correct Answer

B:

Behavior models need changing business baselines so legitimate shifts do not overwhelm analysts while meaningful deviations remain detectable.

Incorrect Answers

A:

Anomaly scores indicate deviation, not malicious intent; schedule context can fully explain the change.

C:

Removing all history discards baseline information and cannot explain the policy-driven schedule change.

D:

One benign change does not eliminate future compromise risk or justify complete monitoring exclusion.

Question 203

An investigator using Splunk needs to narrow a search to a specific index and last 30 minutes before computing a count by source. Which approach helps performance?

  1. Disable parsed fields such as src_ip before using a by-source aggregation
  2. Convert the search to a dashboard screenshot and stop collecting logs
  3. Search every accessible index over all historical time and filter only after aggregation
  4. Apply index and time constraints early, then aggregate the resulting relevant events

Explanation

Correct Answer

D:

Selective base searches minimize scanned data before expensive grouping, producing faster targeted incident analysis.

Incorrect Answers

A:

The grouping depends on a stable source attribute, so removing it prevents meaningful aggregation.

B:

A static image cannot run field-based searches or investigate new events as they arrive.

C:

Global scanning is costly and introduces unrelated records into results before the useful restrictions are applied.

Question 204

An Elastic-based SOC detects that one data stream's documents stopped arriving after an integration update. What should engineers investigate?

  1. Assume the monitored threats have stopped because the index is empty
  2. Ingest pipeline, agent status, field-mapping errors, and data-stream health
  3. Only the age of the analyst's browser installation
  4. Only whether the Kibana dashboard title contains the correct company name

Explanation

Correct Answer

B:

Connector or pipeline changes can interrupt normalization or indexing; end-to-end checks locate the gap in collected documents.

Incorrect Answers

A:

A silent data source cannot establish that malicious activity ended; ingestion health needs verification.

C:

A local browser does not explain missing documents in backend ingest pipelines.

D:

A display title does not control agent collection or index insertion into a data stream.

Question 205

A SIEM detects an identity using a new device, new application, and unusual download volume. Which UEBA principle makes the combination useful?

  1. Assume all changes from baseline are malicious regardless of authorized business shifts
  2. Replace all access controls with a behavior score
  3. Rely only on the enterprise-wide average number of employees
  4. Evaluate deviations from the identity and peer-group baseline together

Explanation

Correct Answer

D:

User and entity behavior analytics can find meaningful combined anomalies that isolated thresholds might treat as minor.

Incorrect Answers

A:

New roles, devices, and travel can be legitimate, so context and validation remain essential.

B:

Risk scoring supports detection and prioritization; it is not a complete substitute for authentication and authorization.

C:

An organization-level count provides little information about the specific user's behavior.

Question 206

A SOC wants a dashboard showing affected business services rather than only hostnames. What must feed the visualization?

  1. Only the total number of successful user sign-ins per day
  2. Current service dependencies, asset owners and criticality
  3. Only general internet threat-news headlines
  4. Only a raw list of IP addresses without application context

Explanation

Correct Answer

B:

Mapping infrastructure events to business services turns low-level detections into a view of possible operational impact.

Incorrect Answers

A:

Login totals do not reveal which applications depend on the potentially compromised hosts.

C:

External trends may inform awareness but do not connect this organization's assets to specific supported services.

D:

IP inventories cannot identify which customer-facing service is at risk without dependency mapping.

Question 207

The SOC publishes a company-wide dashboard containing full usernames, private email addresses, and incident notes. What should change?

  1. Assume dashboard read-only permissions remove confidentiality risk
  2. Add more screenshots to the public dashboard without reviewing access
  3. Remove all access logs for dashboard viewers
  4. Apply role-based report access and publish masked summaries

Explanation

Correct Answer

D:

Operational investigations need detailed identity records, but general viewers rarely need personal case data.

Incorrect Answers

A:

A read-only user can still view or copy exposed personal and incident information.

B:

Additional presentation does not address overexposure of sensitive identities and incident details.

C:

Access auditability is important for sensitive data; deleting it weakens accountability and compliance.

Question 208

An auditor asks whether security events for privileged account changes were retained for the required period. Which report is most relevant?

  1. Document coverage and retention of required log sources
  2. A list of firewall brands used in branch offices
  3. A chart of total SOC employee attendance at training sessions
  4. A report of how many dashboards have been created

Explanation

Correct Answer

A:

Compliance evidence must demonstrate that required event types were captured and preserved, not merely that a SIEM license exists.

Incorrect Answers

B:

Network inventory alone does not establish which identity events were captured and retained for the audited duration.

C:

Staff training records may support other controls but cannot verify the retention of privileged-account audit events.

D:

Dashboard count is not proof that mandated security records remain searchable or preserved.

Question 209

A manager wants to determine whether incident containment is improving quarter over quarter. What is the strongest comparison?

  1. A count of all alerts regardless of confirmed status
  2. Total SIEM license costs without incident timestamps
  3. Number of raw network connections observed each quarter
  4. Percentiles of time to contain for equivalent incidents

Explanation

Correct Answer

D:

Comparable incident classes and timestamps reduce distortion from outliers or changes in classification and case volume.

Incorrect Answers

A:

Unfiltered detections reflect sensor and rule changes as well as threats and do not directly measure containment time.

B:

Spending does not quantify elapsed time between confirmation and effective containment.

C:

Traffic volume varies with workload and cannot establish how quickly responders contained incidents.

Question 210

A SIEM integrates with a SOAR platform that can quarantine emails after analyst approval. What is the primary architectural separation?

  1. The SIEM must automatically carry out every containment action without authorization
  2. The SOAR replaces all event sources so the SIEM no longer needs logs
  3. The email gateway alone determines incident severity for the enterprise
  4. Use SIEM for detection and SOAR for approved action orchestration

Explanation

Correct Answer

D:

A response orchestration engine applies workflows and integrations, while the SIEM remains a central analytics and evidence platform.

Incorrect Answers

A:

Detection and response can be separate, and approval gates are important for actions with business impact.

B:

Orchestration requires evidence or alerts to act upon and does not magically reproduce collected security telemetry.

C:

A downstream enforcement tool lacks the whole incident and business context needed for cross-system prioritization.

Certified SOC Analyst (312-39) Practice Tests