Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 25

Question 240

A hunter maps a hypothesis to ATT&CK and wants the required observables. What is the correct next step?

  1. Map the ATT&CK technique to required local telemetry
  2. Begin active scanning of production systems without authorization
  3. Assume an ATT&CK mapping automatically produces a valid SIEM rule
  4. Use only the adversary group name as a detection criterion

Explanation

Correct Answer

A:

Mapping helps translate adversary procedures into testable host, identity, or network artifacts when that telemetry is available.

Incorrect Answers

B:

A hunt generally examines evidence; intrusive tests have separate safety and change-control requirements.

C:

Framework mapping describes behavior; it does not supply environment-specific detection logic or field normalization.

D:

Many actors share techniques and group labels cannot replace observable behavior in local telemetry.

Question 241

An investigator needs to scan a collection of suspicious files for characteristic byte sequences and conditions. Which technology is suited to this?

  1. An identity-provider access review report
  2. YARA rules matching file or memory content patterns
  3. A TLS certificate-renewal scheduler
  4. A Sigma rule executed as a packet sniffer without conversion

Explanation

Correct Answer

B:

YARA can define strings and Boolean conditions over artifacts, aiding classification and triage while requiring careful rule testing.

Incorrect Answers

A:

Access reviews evaluate entitlements and do not inspect byte sequences inside suspicious executables.

C:

Certificate operations do not classify files by embedded content or malware-related strings.

D:

Sigma describes log-event detection patterns and is not itself a binary file-content scanning engine.

Question 242

A YARA rule uses two common strings and matches thousands of clean business documents. Which adjustment is best?

  1. Delete every matching file before sampling false positives
  2. Refine the YARA rule using distinctive behavior and negative tests
  3. Treat all matches as confirmed malware because the rule compiled
  4. Rename the YARA rule to critical without changing its condition

Explanation

Correct Answer

B:

Broad strings produce false positives; malware triage rules should be validated against benign corpora before broad deployment.

Incorrect Answers

A:

Unverified mass deletion can destroy legitimate business data and evidence of what caused the matches.

C:

A valid YARA expression does not guarantee a unique malicious signature or accurate family classification.

D:

Rule metadata does not improve selectivity of overly generic byte patterns.

Question 243

A hunter wants to share a detection for suspicious Windows process creation across different SIEM platforms. Which format best expresses the log analytic?

  1. Sigma with a defined logsource and detection condition
  2. An access-control list for an internal file share
  3. YARA alone when only log-field conditions are required
  4. A checksum of the original dashboard screenshot

Explanation

Correct Answer

A:

Sigma specifies portable event matching logic that can be translated and adjusted for target backends and schemas.

Incorrect Answers

B:

ACLs govern object permissions and do not encode the requested cross-platform detection pattern.

C:

YARA specializes in content matching and is not the natural interchange format for SIEM event-log analytics.

D:

A hash verifies image bytes but cannot express field conditions for another SIEM to execute.

Question 244

A hunter suspects malicious PowerShell execution on Windows clients. Which telemetry combination is most appropriate?

  1. Only the list of registered DNS zones
  2. Only the number of Windows updates installed this month
  3. Only monthly firewall throughput totals
  4. Link PowerShell process records to outbound connections

Explanation

Correct Answer

D:

Together these sources help reconstruct script behavior and distinguish approved automation from suspicious execution.

Incorrect Answers

A:

DNS configuration records cannot identify a local PowerShell invocation or its parent process.

B:

Patch counts cannot show PowerShell script content or the command arguments launched by a process.

C:

Aggregate byte volume lacks the process-specific behavior and script context required for a focused hunt.

Question 245

A rule flags PowerShell launched by an office application, but a benign add-in does this daily. What makes a stronger hunt query?

  1. Exclude every PowerShell command from all endpoints
  2. Classify all office applications as malware on the affected host
  3. Use only the computer's operating-system build number
  4. Differentiate trusted add-ins by their child commands and egress

Explanation

Correct Answer

D:

A focused condition preserves suspicious deviations without treating every instance of the legitimate add-in as malicious.

Incorrect Answers

A:

Malicious scripts can originate through many parents, so a blanket exclusion removes valuable detection coverage.

B:

Legitimate software can spawn automation; process-level context is required before remediation.

C:

OS version may influence execution mechanics but does not establish whether a particular script invocation was authorized.

Question 246

A hunter needs to search for command-and-control beaconing without an IP indicator. Which signal is most useful?

  1. Any single HTTPS connection from a workstation
  2. A rare process contacting a rare host at regular intervals
  3. Only the total count of installed applications on the endpoint
  4. Any website that has existed for more than a year

Explanation

Correct Answer

B:

Cadence can expose automated check-ins, especially when entity and destination context filters out normal monitoring agents.

Incorrect Answers

A:

Encrypted web connections are routine and a one-off flow has little evidence of a beaconing pattern.

C:

Inventory size does not reveal network timing or the process responsible for outbound sessions.

D:

Domain age alone does not establish automated check-ins or malicious command behavior.

Question 247

During a hunt, a workstation queries a domain that no other managed endpoint has contacted in 60 days. How should the hunter interpret this?

  1. Rarity is an investigative lead that needs process and destination validation
  2. All domains contacted by many users are guaranteed benign
  3. Rarity alone proves malicious command-and-control activity
  4. The observation must be discarded because rarity cannot inform security

Explanation

Correct Answer

A:

Rare-domain hunting prioritizes outliers, but legitimate niche services and new business workflows can be equally rare.

Incorrect Answers

B:

Popular legitimate sites can be abused or compromised, so prevalence is a clue rather than a safety guarantee.

C:

A unique name is not sufficient evidence of attacker control or harmful endpoint behavior.

D:

Low-prevalence infrastructure can be useful when combined with timing, content, and ownership context.

Question 248

A hunter examines processes where a document reader launches a script interpreter that writes an executable. Which evidence adds the most?

  1. Only a list of document titles recently opened on other unrelated hosts
  2. Process lineage, script arguments, created-file metadata, and subsequent execution
  3. Use the document file hash without connecting it to the process execution sequence
  4. Only the number of internet sites the user visited last month

Explanation

Correct Answer

B:

Linking the unusual parent with follow-on file activity tests an initial-execution hypothesis more directly than isolated reputation checks.

Incorrect Answers

A:

Organization-wide filenames do not establish the causal process chain on the suspicious endpoint.

C:

A file fingerprint can help identify the document, but it does not demonstrate which interpreter it launched, what it wrote, or whether the new executable ran.

D:

Broad browsing count does not resolve the particular parent-child execution behavior in the hunt.

Question 249

A hunt focuses on one identity authenticating to many systems it has never accessed before. Which correlation should be prioritized?

  1. A report of new VPN source countries without mapping the identity to target hosts
  2. A summary of failed authentications without successful cross-system session joins
  3. Analyze new logon relationships, privilege and remote actions
  4. Software installation inventory on the user device without cross-host authentication records

Explanation

Correct Answer

C:

Anomalous fan-out can suggest lateral movement, especially if access expands rapidly beyond the identity's known administrative scope.

Incorrect Answers

A:

Geographic variance may help triage, but does not reveal which previously unseen internal systems the identity accessed or the ensuing execution behavior.

B:

Failure counts can describe authentication attacks but cannot establish the suspicious new relationships among this identity and many accessed systems.

D:

Endpoint inventory may explain available tools but does not measure the spread of an account across unfamiliar host logon destinations.

Question 250

A hunt hypothesis concerns credential dumping, but no known malicious binary hash is present. What data should the hunter prioritize?

  1. Look for credential-process access and unusual memory dumps
  2. Only web application HTTP status codes
  3. Only wireless signal strength at office access points
  4. Only exact hash matches for a single published sample

Explanation

Correct Answer

A:

Behavioral host telemetry can reveal attempts to obtain secrets even when attackers use legitimate utilities or modified binaries.

Incorrect Answers

B:

HTTP response classes do not directly observe local access to authentication process memory.

C:

RF metrics cannot identify credential process access or local dump-file creation.

D:

Hash-only detection misses renamed, altered, or novel tools that exhibit the same credential-access behavior.

Certified SOC Analyst (312-39) Practice Tests