Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 3

Question 20

Two regional SOC teams operate in different time zones and pass active cases to the next region each day. What operating model is this?

  1. A single staffed office with no handoff procedure
  2. A red-team purple-team exercise
  3. Follow-the-sun security monitoring
  4. Air-gapped security operations

Explanation

Correct Answer

C:

Geographically offset shifts provide extended or continuous coverage by transferring cases as each region ends its working day.

Incorrect Answers

A:

One office without regional transfer would not realize the continuous multinational monitoring described in the scenario.

B:

Purple teaming joins adversary simulation with defensive validation; it is not a routine daily shift-coverage model.

D:

Air gapping refers to network isolation rather than time-zone-based analyst staffing and case handoffs.

Question 21

A perimeter sensor observes one host attempting TCP connections to hundreds of destination ports on a server in under a minute, with few complete sessions. What behavior does this most strongly indicate?

  1. DNS cache poisoning on the resolver
  2. Vertical port scanning against a single target
  3. A successful data exfiltration transfer
  4. Credential stuffing against a web login

Explanation

Correct Answer

B:

A large range of destination ports on one address suggests enumeration of exposed services; connection failures are common when most ports are closed.

Incorrect Answers

A:

Cache poisoning manipulates DNS response integrity and cannot be established merely by a rapid sequence of connection attempts to distinct ports.

C:

Port probes show attempted reachability, not a sustained authenticated data flow or evidence that information left the server.

D:

Credential stuffing normally produces repeated authentication attempts to an application endpoint rather than probing many transport ports.

Question 22

A switch receives conflicting ARP replies that repeatedly associate the gateway IP with a workstation MAC address. Which technique should the analyst suspect?

  1. An encrypted VPN tunnel negotiating keys
  2. A legitimate TLS certificate renewal
  3. A DNS zone transfer between authoritative servers
  4. ARP spoofing intended to divert local network traffic

Explanation

Correct Answer

D:

Forged address-resolution mappings can cause peers on the same broadcast domain to send gateway-bound frames through an attacker-controlled interface.

Incorrect Answers

A:

VPN establishment may create network flows but does not require unsolicited conflicting ARP replies for the gateway address.

B:

Certificate rotation affects trust in application sessions, not neighbor discovery mappings for the LAN gateway.

C:

Zone transfers copy DNS records and do not alter Ethernet-layer IP-to-MAC associations in the local ARP cache.

Question 23

An application becomes unreachable while upstream telemetry shows a massive volume of SYN packets with few completed TCP handshakes. What attack type best matches this pattern?

  1. A routine increase in established HTTPS user sessions
  2. SQL injection that modifies database rows
  3. Credential theft by a phishing attachment
  4. A SYN flood exhausting half-open connection handling

Explanation

Correct Answer

D:

Repeated handshake initiation can consume connection-tracking resources when acknowledgements do not complete, contributing to availability loss.

Incorrect Answers

A:

Legitimate session growth usually produces completed handshakes and subsequent application traffic rather than many unanswered SYNs.

B:

Database injection affects application queries and does not inherently produce a dominant signature of incomplete TCP handshakes.

C:

A malicious attachment can compromise users but would not explain high-volume incomplete TCP establishment at the service edge.

Question 24

An endpoint records a newly configured Windows scheduled task that launches a script at user logon. Which ATT&CK-style behavior should be considered?

  1. Persistence through scheduled execution
  2. Encrypted off-site backup restoration
  3. Web application cross-site scripting
  4. Network denial of service through packet saturation

Explanation

Correct Answer

A:

A logon-triggered task can re-execute malicious code after restarts or re-logins; validating the author and script origin is central to assessment.

Incorrect Answers

B:

A task may legitimately automate backups, but the observed logon trigger alone is not evidence of any restoration activity.

C:

XSS executes in a browser context after unsafe content handling; an operating-system scheduled task is a different persistence surface.

D:

Scheduled task creation is a host execution mechanism and does not itself demonstrate link-capacity exhaustion.

Question 25

Security telemetry reports an unapproved process attempting to read memory from LSASS on a Windows workstation. Which attacker objective is most plausible?

  1. Overwriting switch firmware remotely
  2. Credential access using authentication secrets in memory
  3. Executing JavaScript in a victim browser via XSS
  4. Replacing DNS records in a registrar account

Explanation

Correct Answer

B:

LSASS manages security and authentication state; suspicious access can indicate attempts to extract secrets or session artifacts.

Incorrect Answers

A:

Network-device firmware tampering uses a different target and privileges than unusual local access to LSASS memory.

C:

Browser script injection is unrelated to the host-level protected process access indicated by this endpoint event.

D:

Registrar changes occur in an external management plane; reading local authentication-process memory does not directly perform that operation.

Question 26

A standard-user process unexpectedly launches an elevated shell immediately after a vulnerable local service is accessed. What phase is the analyst investigating?

  1. Initial phishing message delivery
  2. Normal read-only directory enumeration
  3. Passive packet capture on a mirrored switch port
  4. Privilege escalation on the compromised host

Explanation

Correct Answer

D:

The observed shift from limited permissions to an elevated security context suggests an attempt to gain higher local privileges.

Incorrect Answers

A:

Phishing can provide initial access, but this sequence concerns a change in host execution privileges after code is already present.

B:

Directory listing need not change a process token or spawn an unexpectedly elevated shell.

C:

Traffic collection does not explain a local process gaining elevated rights through a service vulnerability.

Question 27

A workstation creates many file rename and encryption events while a new note appears in user folders. Which threat behavior is most likely?

  1. Harmless operating-system log rotation
  2. Ransomware-style impact through bulk file encryption
  3. Passive browser fingerprinting on a website
  4. Credential stuffing against an external web service

Explanation

Correct Answer

B:

Rapid transformation of user files paired with a ransom message strongly supports malicious encryption activity and demands urgent containment.

Incorrect Answers

A:

Log rotation manages specific log files by policy; it would not usually modify many user documents and produce payment instructions.

C:

Browser fingerprinting collects client characteristics and does not perform widespread local file encryption.

D:

Credential stuffing targets authentication endpoints, not bulk local changes to file contents and names.

Question 28

A web application log shows a parameter containing SQL syntax, and a database audit trail records unexpected access to records outside the user's privileges. What is the likely class of attack?

  1. A DNS rebinding attempt against the application server
  2. SQL injection exploiting unsafe query construction
  3. Cross-site request forgery against a logged-in user
  4. Ordinary database connection pooling

Explanation

Correct Answer

B:

Attacker-controlled input influencing a database query can bypass intended conditions or expose data when the application fails to parameterize queries.

Incorrect Answers

A:

DNS rebinding manipulates origin-to-address resolution and does not directly explain injected SQL expressions and database audit anomalies.

C:

CSRF abuses a user's browser authentication context to trigger state-changing requests; the described evidence centers on altered SQL semantics.

D:

Connection pooling reuses sessions for performance; it does not authorize broader data access or inject unexpected query predicates.

Question 29

A visitor opens a forum post and a script embedded in the post runs under the forum's web origin. Which weakness is being exploited?

  1. Server-side SQL command injection
  2. Stored cross-site scripting caused by unsafe output encoding
  3. Cross-site request forgery as the sole observed mechanism
  4. Valid content security with all hostile markup escaped

Explanation

Correct Answer

B:

Persisted attacker-controlled markup executes in other users' browser sessions when the application renders it without appropriate contextual encoding.

Incorrect Answers

A:

SQL injection changes database execution; script execution in the browser is a separate client-side trust-boundary violation.

C:

CSRF tricks a browser into submitting authenticated requests but does not by itself explain injected script execution in rendered page content.

D:

Correct output encoding would display the characters as data rather than executing them in the page origin.

Question 30

A user logged in to a billing application visits an attacker page; the browser then sends an unintended account-change request with session cookies. Which attack is illustrated?

  1. Cross-site request forgery in an authenticated user session
  2. A stored XSS payload on the billing application
  3. A server-driven database backup
  4. Credential replay from stolen password hashes

Explanation

Correct Answer

A:

An attacker can induce a state-changing request that carries ambient credentials when anti-CSRF controls or same-site restrictions are insufficient.

Incorrect Answers

B:

The scenario does not require attacker JavaScript to be stored on the target site; the key issue is cross-site request authorization.

C:

A database backup is an administrative data operation, not an unsolicited account-change request caused by a third-party page.

D:

Hash replay uses authentication artifacts to establish a session and is different from provoking an existing logged-in browser to send a request.

Certified SOC Analyst (312-39) Practice Tests