Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 23

Question 220

An analyst assesses a report as high confidence but notes it concerns an industry the organization does not serve. Which dimension is distinct from confidence?

  1. Cryptographic length of the report filename
  2. The age of the analyst producing the assessment
  3. The number of paragraphs in the intelligence report
  4. Relevance to the organization's threat model and exposure

Explanation

Correct Answer

D:

A report can be well supported yet operationally low priority when its likely targets or attack surfaces do not match local assets.

Incorrect Answers

A:

Filename properties do not indicate organizational exposure or the reliability of the findings.

B:

Analyst demographics do not directly establish campaign applicability or evidence quality.

C:

Text volume is not a meaningful measure of whether the campaign can affect the company.

Question 221

A domain on yesterday's malicious list now belongs to a legitimate business after a sinkhole transfer. What should a SOC do?

  1. Delete every historical observation of the domain from investigations
  2. Review indicator ownership and expiry before continuing enforcement
  3. Keep blocking indefinitely because past malicious use defines all future ownership
  4. Assume every domain recovered from a sinkhole is instantly safe for all purposes

Explanation

Correct Answer

B:

Domain control can change, so stale blocking rules may create business disruption unless refreshed and validated.

Incorrect Answers

A:

Old events remain evidence of the earlier incident even when current enforcement decisions change.

C:

Historical abuse does not prove that the new operator or current service is malicious.

D:

Ownership and service behavior still need verification before a changed classification is trusted.

Question 222

Which detection target generally imposes a higher adaptation cost on an adversary than blocking one known IP address?

  1. An attacker behavior requiring defensive or workflow adaptation
  2. One exact file hash of a repacked executable
  3. A single IP address copied from a short-lived feed
  4. A temporary domain name that the attacker can re-register elsewhere

Explanation

Correct Answer

A:

The Pyramid of Pain concept emphasizes that forcing changes to recurring behavior can be more disruptive than replacing easily rotated infrastructure.

Incorrect Answers

B:

Changing bytes or recompiling may evade an exact hash match without altering malicious behavior.

C:

Attackers can often rotate hosting addresses faster than they can redesign a complete operating technique.

D:

Infrastructure identifiers can be changed more readily than underlying procedures in many campaigns.

Question 223

Two intelligence providers want to exchange machine-readable descriptions of threat actors, indicators, and their relationships. Which standard is suitable?

  1. An IOC list format that represents observables without actor and campaign relationships
  2. A proprietary CSV of indicator strings without standardized object relationships
  3. STIX objects and relationships for structured threat intelligence
  4. A TAXII transport collection without an underlying common intelligence data model

Explanation

Correct Answer

C:

STIX models entities and relationships in a consistent exchange format, supporting automated analysis and sharing.

Incorrect Answers

A:

A basic indicator list can share suspicious values, but does not model the linked adversary, capability, infrastructure, and other intelligence entities required.

B:

Flat indicator exports can be useful for watchlists but cannot faithfully exchange standardized threat-actor objects and their typed relationships.

D:

TAXII can deliver structured collections, but transport alone does not define how actors, indicators, and relationships are represented in the content.

Question 224

A threat-intelligence platform must retrieve structured intelligence collections from a trusted partner using a standardized API. Which protocol is designed for this?

  1. RDP for interactive graphical sessions to servers
  2. SMTP for mail delivery as the structured intelligence object model
  3. ARP for mapping local IPv4 addresses to MAC addresses
  4. TAXII for automated exchange of cyber threat intelligence

Explanation

Correct Answer

D:

TAXII provides collection and transport mechanisms commonly used to deliver STIX data between systems.

Incorrect Answers

A:

Remote desktop gives user access to a host but is not a threat-intelligence exchange protocol.

B:

Email can carry files, but SMTP alone does not define the threat-intelligence collection API or object relationships.

C:

ARP handles LAN neighbor resolution rather than distributing structured intelligence collections between organizations.

Question 225

An SOC analyst receives overlapping indicators from four vendors, each with different scores and expiration dates. Which platform function helps most?

  1. An antivirus console that displays only local quarantine files
  2. A firewall rule that permanently blocks every historical feed entry
  3. A TIP with indicator lifecycle, scoring and enrichment controls
  4. An unmanaged spreadsheet containing only the newest feed without source fields

Explanation

Correct Answer

C:

A TIP can preserve provenance and push reviewed intelligence into the SIEM while avoiding unnecessary duplicate or stale matches.

Incorrect Answers

A:

Endpoint quarantine views do not consolidate multiple external intelligence feeds or manage indicator dissemination.

B:

Unqualified enforcement can cause false positives and gives no governance for changing ownership or confidence.

D:

Dropping provenance and expiry removes information necessary for safe operational use.

Question 226

A partner shares incident details marked TLP:RED. How should the SOC handle dissemination?

  1. Post the full report to a public blog because it concerns a threat
  2. Forward the report to every customer and supplier without checking authorization
  3. Restrict the information to the explicitly authorized recipients and context of the exchange
  4. Treat the label as meaning the indicator is technically a confirmed malware signature

Explanation

Correct Answer

C:

TLP:RED limits further sharing because of sensitive source or victim details, so access decisions must honor the agreed restriction.

Incorrect Answers

A:

Public dissemination violates the intended sharing restriction and can expose the partner or an ongoing investigation.

B:

Broad redistribution contradicts a restrictive disclosure label and increases privacy and operational risk.

D:

TLP conveys sharing boundaries, not indicator confidence or malware classification.

Question 227

A TLP:CLEAR indicator summary is shared with the SOC. What does this designation principally address?

  1. Proof that all indicators have been tested against the organization's own network
  2. Mandatory restriction to a named incident commander only
  3. Automatic assignment of maximum severity to each included address
  4. Disclosure permissibility rather than a guarantee of technical accuracy

Explanation

Correct Answer

D:

TLP:CLEAR allows broad dissemination subject to applicable rules, but analysts must separately assess validity and relevance.

Incorrect Answers

A:

Publication permissions are independent of local detection validation and asset relevance.

B:

A clear sharing designation is not the highly restrictive handling rule described in this alternative.

C:

Sharing labels do not determine alert priority or override the need for evidence-based triage.

Question 228

An analyst identifies suspicious infrastructure through passive DNS histories, certificate records, and public malware reports. How should this collection be classified?

  1. A privileged endpoint memory acquisition
  2. A local database transaction audit on the suspected host
  3. Open-source intelligence with cross-source corroboration
  4. A confirmed seizure of adversary-owned servers

Explanation

Correct Answer

C:

Publicly available technical traces can reveal infrastructure relationships but require validation before attribution or enforcement.

Incorrect Answers

A:

Passive records are external observations, not a snapshot of a running system's volatile memory.

B:

Open internet data does not supply the host's internal query execution history.

D:

Observing public records does not establish physical control or legally verified ownership of the infrastructure.

Question 229

A suspicious domain now resolves to a new IP, but investigators need its addresses from the week of an intrusion. Which resource helps?

  1. Only the workstation's present default gateway address
  2. Only the domain's current A record
  3. Only a present-day WHOIS registrar creation date
  4. Time-stamped passive DNS history with provenance caveats

Explanation

Correct Answer

D:

Past resolutions can connect infrastructure at the relevant time, although caching, geographic variation, and partial observation affect completeness.

Incorrect Answers

A:

The local gateway does not reconstruct an external domain's past DNS answer history.

B:

A current resolution does not necessarily reveal where the name pointed during the earlier incident.

C:

Registration metadata provides context but cannot substitute for historical answer records for the requested week.

Question 230

Two intrusion campaigns use the same public penetration-testing tool and cloud provider. What can the SOC conclude about attribution?

  1. Both campaigns are definitely run by one named adversary group
  2. The shared tooling is insufficient for high-confidence identity attribution
  3. Cloud hosting proves the attacker is physically in the provider's headquarters country
  4. The tool vendor necessarily authorized the observed attacks

Explanation

Correct Answer

B:

Common tools and hosting services are reused widely; attribution needs multiple independent behavioral and infrastructure relationships.

Incorrect Answers

A:

Tool overlap can arise from imitation or common availability and does not uniquely identify the operator.

C:

Infrastructure location is not the same as human operator location or affiliation.

D:

Distribution of a legitimate tool does not mean the vendor approved malicious deployment.

Certified SOC Analyst (312-39) Practice Tests