Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 28

Question 270

A confirmed incident affects customer personal data, and the notification deadline depends on jurisdiction and breach criteria. Who should determine external notification obligations?

  1. Any SOC analyst based solely on the first raw alert
  2. Legal and privacy teams assess jurisdictional notification duties
  3. The third-party SIEM vendor according to a universal deadline
  4. Only the affected end user without considering the incident organization

Explanation

Correct Answer

B:

Reporting duties vary by law, contract, data type, and event assessment, so notifications need authorized legal review.

Incorrect Answers

A:

Early telemetry may not establish personal-data exposure or statutory conditions and is a poor basis for public statements.

C:

A tool provider does not define every organization's legal obligations, which depend on applicable law and contracts.

D:

External obligations are organizational and may require designated breach-response governance and counsel.

Question 271

A server logs multiple suspicious administrator actions, and the operations team wants to rebuild it. What should happen first if time and safety permit?

  1. Preserve essential forensic evidence before destructive rebuilding
  2. Convert every alert into a low-severity status without reviewing the activity
  3. Erase the disk immediately to make it look clean for investigators
  4. Distribute the administrator's passwords to all investigators by email

Explanation

Correct Answer

A:

Reimaging can erase attacker traces, so incident responders should capture necessary evidence before changing the system.

Incorrect Answers

B:

Changing labels does not preserve evidence or resolve unauthorized administrator operations.

C:

Destructive wiping removes the artifacts needed to determine entry path, scope, and potential obligations.

D:

Sharing secrets broadly increases exposure and does not contribute to evidence preservation.

Question 272

An attacker used a stolen cloud access key that is still active. Which step belongs in eradication after short-term containment?

  1. Close the incident as soon as network traffic becomes quiet
  2. Revoke stolen credentials and remove attacker persistence
  3. Restore affected applications without invalidating the stolen key
  4. Delete all account audit logs so the key is no longer visible

Explanation

Correct Answer

B:

Eliminating the access path and related backdoors prevents continued misuse after the immediate activity is interrupted.

Incorrect Answers

A:

The attacker may retain credentials and re-enter later; silence alone does not prove durable eradication.

C:

A restored workload can be compromised again if the same unauthorized authentication path remains usable.

D:

Log removal does not revoke the credential and destroys evidence about its prior use.

Question 273

After malware cleanup, a service owner wants to reconnect a restored system. What should the incident team verify?

  1. Verify a clean restore, patched entry path and functioning monitoring
  2. Only that the original malware alert has ceased firing
  3. Only that user passwords remain unchanged from before the incident
  4. Only that the host responds to ping

Explanation

Correct Answer

A:

Recovery should restore trusted operation while reducing the chance of reinfection and detecting residual malicious behavior.

Incorrect Answers

B:

A cleared alert may reflect missing telemetry or changed attacker behavior rather than a verified safe system.

C:

Compromised credentials may require revocation; retaining them can reopen the initial access path.

D:

Network reachability cannot establish system integrity, restored application functionality, or removal of attacker access.

Question 274

An incident review finds that the EDR detected malware but an approval bottleneck delayed isolation by four hours. What corrective action best follows?

  1. Increase the volume of identical alerts from the same endpoint
  2. Delete approval records to keep future timelines shorter
  3. Disable the EDR because it did not prevent the delay
  4. Clarify isolation approvals and rehearse the escalation path

Explanation

Correct Answer

D:

The failure occurred between detection and action, so tested governance improvements can shorten response time.

Incorrect Answers

A:

Additional duplicate alerts do not resolve who can approve isolation or how promptly the decision is made.

B:

Approval history is important to identify operational delays and measure whether improvements succeed.

C:

The sensor provided detection; removing it would degrade visibility without fixing the authorization bottleneck.

Question 275

Why should an incident response tabletop exercise include business owners rather than only analysts?

  1. Business owners should independently change security controls during every exercise
  2. Include the business impact and authority decisions in exercises
  3. Analysts do not need any understanding of system criticality
  4. Tabletops are useful only for testing SIEM ingestion throughput

Explanation

Correct Answer

B:

Cross-functional scenarios reveal dependencies the SOC alone may not know and help refine workable containment plans.

Incorrect Answers

A:

Exercises validate roles and decisions, not authorize uncontrolled production changes by participants.

C:

Technical responders rely on business context to choose proportional actions and establish incident priority.

D:

A tabletop focuses on decision-making and coordination rather than acting as a platform load test.

Question 276

A runbook says to block a malicious domain but does not explain how to verify it was actually blocked across web proxies. What is missing?

  1. Removal of the audit trail after implementing the block
  2. Add an updated list of threat domains to the runbook but omit enforcement testing
  3. A post-action verification step and defined owner for checking enforcement
  4. An instruction to block all domains by default

Explanation

Correct Answer

C:

Response playbooks need observable success criteria; entering a rule is not proof that every intended enforcement point applied it.

Incorrect Answers

A:

Change evidence is essential for accountability and review of which controls were deployed.

B:

More indicators improve coverage but do not establish that proxy policy propagation and client traffic enforcement actually succeeded across all managed proxies.

D:

A universal network block would cause broad disruption and ignore the scoped indicator in the incident.

Question 277

A suspected insider case may lead to employment action. Which practice best supports a fair and defensible investigation?

  1. Keep evidence factual, access restricted, and HR or legal involved
  2. Allow the accused user to edit the sole copy of audit records
  3. Base the case solely on the employee's job title
  4. Publicly accuse the user as soon as an unusual download appears

Explanation

Correct Answer

A:

Insider cases require objective attribution and governance because valid credentials can be used both legitimately and improperly.

Incorrect Answers

B:

Uncontrolled modification weakens integrity and could conceal or fabricate the relevant activity.

C:

Role can inform expected activity, but misconduct conclusions need corroborated behavioral and authorization evidence.

D:

A single anomaly may have legitimate explanations; premature disclosure harms fairness and the investigation.

Question 278

A stolen refresh token may let an attacker maintain a cloud session after a password reset. Which response is more complete?

  1. Assume every session instantly ends when the password changes on all platforms
  2. Delete sign-in audit logs to protect the account owner
  3. Change only the public DNS record of the sign-in page
  4. Revoke suspect tokens and sessions and inspect persistent grants

Explanation

Correct Answer

D:

Password replacement alone may not terminate all established sessions; token invalidation and grant review close additional access routes.

Incorrect Answers

A:

Session and token behavior varies, so the response must verify identity-provider and application invalidation mechanisms.

B:

Log deletion obscures attacker activity and does nothing to invalidate issued credentials.

C:

DNS changes do not reliably revoke tokens already accepted by an identity provider or application.

Question 279

During containment, a responder disables a service account and unexpectedly interrupts a payroll integration. What should the playbook require?

  1. Reactivate the original suspect credential for all integrations without review
  2. Ignore payroll availability because every security action is harmless
  3. Assess service impact and implement approved rollback or alternatives
  4. Delete all integration logs to reduce troubleshooting time

Explanation

Correct Answer

C:

Response actions should anticipate dependencies and restore essential service safely without reactivating compromised access blindly.

Incorrect Answers

A:

Uncontrolled reversal may reopen attacker access and fail to address the compromised principal.

B:

Containment can affect business functions; impact must be tracked and handled by the incident authority.

D:

Eliminating audit data hinders identification of which processes failed and whether attacker activity continued.

Question 280

An internet-facing application is receiving exploit requests, and its verbose request logs overwrite every fifteen minutes. The team needs to preserve the attack window. Which actions best protect the evidence? Choose TWO.

  1. Rewrite the original log entries in place to label suspected requests as malicious
  2. Record the source, collection interval, time basis, acquisition method, and evidence integrity hash
  3. Turn off the logging pipeline so no additional attack requests overwrite the current records
  4. Rely on a screenshot of the alert counter instead of collecting event-level detail
  5. Export the relevant live log segment promptly to a protected evidence location

Explanation

Correct Answers

B:

Collection metadata and hashes make it possible to explain exactly what was preserved and detect later modification of the acquired log copy.

E:

Short retention makes delayed collection hazardous. A scoped export preserves the original reported requests before normal application rotation removes them.

Incorrect Answers

A:

Editing the original contaminates evidence. Analyst judgments should be stored separately from the preserved source material.

C:

Disabling collection would remove ongoing evidence and does not, by itself, preserve records already queued for rotation or replacement.

D:

A dashboard count cannot reconstruct source addresses, request contents, response codes, or the ordering needed for a defensible analysis.

Certified SOC Analyst (312-39) Practice Tests