Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 29

Question 280

An internet-facing application is receiving exploit requests, and its verbose request logs overwrite every fifteen minutes. The team needs to preserve the attack window. Which actions best protect the evidence? Choose TWO.

  1. Rewrite the original log entries in place to label suspected requests as malicious
  2. Record the source, collection interval, time basis, acquisition method, and evidence integrity hash
  3. Turn off the logging pipeline so no additional attack requests overwrite the current records
  4. Rely on a screenshot of the alert counter instead of collecting event-level detail
  5. Export the relevant live log segment promptly to a protected evidence location

Explanation

Correct Answers

B:

Collection metadata and hashes make it possible to explain exactly what was preserved and detect later modification of the acquired log copy.

E:

Short retention makes delayed collection hazardous. A scoped export preserves the original reported requests before normal application rotation removes them.

Incorrect Answers

A:

Editing the original contaminates evidence. Analyst judgments should be stored separately from the preserved source material.

C:

Disabling collection would remove ongoing evidence and does not, by itself, preserve records already queued for rotation or replacement.

D:

A dashboard count cannot reconstruct source addresses, request contents, response codes, or the ordering needed for a defensible analysis.

Question 281

A security leader wants to measure duration from confirmed incident identification to successful interruption of malicious activity. Which metric is useful?

  1. Number of completed security awareness courses
  2. Time to contain using a consistent incident baseline
  3. Time to detect measured only before an alert appears
  4. Daily network packet volume per router

Explanation

Correct Answer

B:

The metric tracks how quickly responders stop ongoing harm and supports workflow analysis when case definitions are stable.

Incorrect Answers

A:

Training can support readiness but does not quantify containment latency for actual incidents.

C:

Detection delay is earlier in the timeline and does not capture execution of containment controls.

D:

Traffic totals provide background capacity data, not elapsed time until malicious activity is interrupted.

Question 282

A SOC has two simultaneous cases: a blocked probe against a test server and confirmed outbound theft from a customer database. Which response ordering is defensible?

  1. Treat both as resolved because the SOC received sensor notifications
  2. Disable the test server and ignore the customer database transfer
  3. Prioritize active data theft while recording the lower-impact probe
  4. Investigate the blocked probe first because it was reported one minute earlier

Explanation

Correct Answer

C:

Risk-based incident response considers evidence confidence, ongoing impact, and affected asset sensitivity.

Incorrect Answers

A:

A sensor event records an observation, not completion of containment or analysis.

B:

That order would focus on a rejected low-impact attempt while serious ongoing harm remains unchecked.

D:

Queue arrival time does not override the substantially greater impact of ongoing confirmed data loss.

Question 283

A SOAR playbook proposes deleting suspicious files from fifty servers based on one unverified reputation hit. What safeguard should be added?

  1. Disable logging of playbook actions to reduce storage cost
  2. Increase the deletion scope to every server so no host is missed
  3. Remove all manual review because automation is faster
  4. Require validation and authorization for destructive mass actions

Explanation

Correct Answer

D:

Automation must be proportional to confidence and impact; staged containment and rollback planning reduce false-positive damage.

Incorrect Answers

A:

Response changes need an audit trail to establish who approved them and whether the operation succeeded.

B:

Expanding destructive scope magnifies the consequences of one misclassified indicator.

C:

Execution speed cannot justify uncontrolled irreversible actions on business-critical servers.

Question 284

A technical responder wants to distinguish observed evidence from hypotheses in a case record. Which writing practice is best?

  1. Delete notes from analysts who reached a different conclusion
  2. Record only the most dramatic alert title without raw event IDs
  3. Write every hypothesis as a proven breach statement
  4. Separate verified observations from inferences and their confidence

Explanation

Correct Answer

D:

Clear evidence provenance allows a later reviewer to test the narrative and prevents guesses from becoming asserted facts.

Incorrect Answers

A:

Disagreement can reveal ambiguity or missing data and should be resolved through review, not silent erasure.

B:

An alert label is not a reproducible evidence trail and omits the basis for its severity.

C:

Overstating uncertainty can lead to incorrect containment, disclosure, and attribution decisions.

Question 285

A restored application passes functional checks but the old compromise path was an unpatched remote service. What blocks safe return to production?

  1. The team has already confirmed backups are usable
  2. The exploited entry point remains unmitigated
  3. The incident commander has a complete timeline
  4. The security team has retained all original logs

Explanation

Correct Answer

B:

Restoring service without fixing initial access risks immediate recurrence; response completion needs both functionality and security controls.

Incorrect Answers

A:

Successful backup restoration is necessary for availability but does not remove the original vulnerability.

C:

Good documentation improves review but cannot compensate for an exploitable service still exposed to attack.

D:

Evidence preservation is important, yet the unresolved entry path remains an active technical risk.

Question 286

A confirmed compromised supplier VPN account is used to reach internal systems. Which two immediate containment actions are relevant? Choose TWO.

  1. Review and, if necessary, restrict the supplier VPN path while investigating affected sessions
  2. Permanently disable every external contractor account without impact assessment
  3. Assume that a password reset alone removes every active VPN session
  4. Disable or revoke the suspect supplier identity's active access using the agreed incident process
  5. Delete all VPN sign-in logs before the supplier is notified

Explanation

Correct Answers

A:

Network-level scope can limit propagation and protect internal services beyond the single credential when evidence supports the measure.

D:

Identity-level containment stops further authenticated sessions when the access path is credential-based.

Incorrect Answers

B:

A blanket action would disrupt unrelated partners and need not be proportionate to this confirmed account compromise.

C:

Session behavior differs across platforms, so responders should verify termination or explicit revocation.

E:

Audit records establish the use and scope of the account; deletion would remove vital evidence.

Question 287

A compromised workstation is scanning SMB ports across the internal network. Which response most directly limits further lateral connections?

  1. Increase SMB server log verbosity without changing access
  2. Block only inbound connections from the public internet at the perimeter
  3. Change the external company website's DNS record
  4. Quarantine the host or block its lateral traffic after approval

Explanation

Correct Answer

D:

Restricting the source's internal reachability interrupts scanning and potential exploitation while the incident team preserves evidence.

Incorrect Answers

A:

Additional evidence helps analysis but does not contain the active host-originated scanning behavior.

B:

The observed connections remain within internal networks, so internet-edge ingress controls may not intercept them.

C:

Public web resolution does not restrict SMB traffic from the compromised internal workstation.

Question 288

An internet-facing service is overwhelmed by a large distributed traffic flood. What response is most effective without taking the service permanently offline?

  1. Disable all application logging for the duration of the incident
  2. Change service administrator passwords as the sole mitigation
  3. Engage upstream DDoS filtering and traffic scrubbing
  4. Block only one source IP observed in the flood

Explanation

Correct Answer

C:

Large floods often exceed local link capacity, making upstream absorption and validated rate controls more effective than appliance-only changes.

Incorrect Answers

A:

Removing telemetry weakens response visibility and does not reduce traffic hitting upstream network links.

B:

Credential changes are useful for account compromise but do not absorb an availability flood of network requests.

D:

A distributed campaign can use thousands of origins, so a single-address rule seldom addresses the volume problem.

Question 289

A C2 server's IP is confirmed malicious, but the organization has direct and proxied outbound paths. What should containment planning include?

  1. Enforce scoped blocks at every relevant control point
  2. Add a rule only to a test firewall that carries no production traffic
  3. Assume a block is effective immediately after saving a configuration draft
  4. Delete the destination address from existing proxy logs

Explanation

Correct Answer

A:

A single perimeter rule can be bypassed by alternate egress routes; validation should test which affected hosts still connect.

Incorrect Answers

B:

A policy on an unused device cannot interrupt the real outbound sessions of compromised clients.

C:

Policy commitment and propagation must be verified using hit counters, connection records, and controlled tests.

D:

Historical logs are evidence of prior sessions and removing them does not enforce network containment.

Question 290

Several infected endpoints resolve a known malicious domain through corporate DNS. Which control can immediately reduce future successful resolutions?

  1. Apply and verify a protective DNS resolution policy
  2. Change the domain's external registrar without ownership authority
  3. Disable every internal DNS zone without assessing dependencies
  4. Delete endpoint process creation logs while leaving DNS unchanged

Explanation

Correct Answer

A:

A sinkhole or deny response can interrupt normal domain resolution, but alternate resolvers and cached answers must be considered.

Incorrect Answers

B:

The defender cannot usually alter attacker-owned registration; local DNS control is the practical defensive path.

C:

Unscoped DNS disruption would break essential services and is not necessary for one confirmed malicious domain.

D:

Removing local evidence cannot stop clients from resolving or connecting to the malicious infrastructure.

Certified SOC Analyst (312-39) Practice Tests