Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 30

Question 290

Several infected endpoints resolve a known malicious domain through corporate DNS. Which control can immediately reduce future successful resolutions?

  1. Apply and verify a protective DNS resolution policy
  2. Change the domain's external registrar without ownership authority
  3. Disable every internal DNS zone without assessing dependencies
  4. Delete endpoint process creation logs while leaving DNS unchanged

Explanation

Correct Answer

A:

A sinkhole or deny response can interrupt normal domain resolution, but alternate resolvers and cached answers must be considered.

Incorrect Answers

B:

The defender cannot usually alter attacker-owned registration; local DNS control is the practical defensive path.

C:

Unscoped DNS disruption would break essential services and is not necessary for one confirmed malicious domain.

D:

Removing local evidence cannot stop clients from resolving or connecting to the malicious infrastructure.

Question 291

An organization sinkholes a malware domain to an internal controlled address. What operational benefit follows?

  1. Future resolving clients can be identified through sinkhole connection telemetry
  2. The sinkhole guarantees all malware is removed from client memory
  3. The sinkhole proves no host ever contacted the original domain previously
  4. The sinkhole automatically revokes any compromised user account credentials

Explanation

Correct Answer

A:

A controlled destination can provide visibility into infected hosts that continue to request the domain, while preventing normal contact with the attacker.

Incorrect Answers

B:

DNS redirection blocks a path but does not eradicate a resident process or other persistence mechanisms.

C:

Historical communications require earlier DNS and network records; the new redirect cannot rewrite past sessions.

D:

Name resolution is separate from identity token or password invalidation.

Question 292

A VPN account is used at 03:00 from an unfamiliar country and then accesses privileged shares. Which response sequence is most appropriate?

  1. Review the VPN session and revoke exposed access if confirmed
  2. Delete the VPN logs because their timestamps are outside office hours
  3. Assume a geo-anomaly alone proves which individual controlled the session
  4. Reset an unrelated user's password as the sole action

Explanation

Correct Answer

A:

Suspicious privileged VPN activity demands identity containment plus scope analysis, with business-approved decisions and preserved logs.

Incorrect Answers

B:

Off-hours authentication is precisely the kind of evidence needed to assess unauthorized access and potential lateral movement.

C:

IP location is imperfect; attribution requires identity, device, and authentication evidence.

D:

Changing a different account cannot terminate the suspect VPN session or limit access to sensitive shares.

Question 293

An infected server opened remote admin sessions to five peers. Which two investigations help establish the blast radius? Choose TWO.

  1. Delete the original source server's network logs before contacting owners
  2. Inspect endpoint process trees and remote execution artifacts on those peers
  3. Correlate authentication and remote service logs on the destination systems
  4. Investigate only internet egress because lateral movement cannot occur inside private networks
  5. Assume five connection attempts prove that five hosts were compromised

Explanation

Correct Answers

B:

Host activity reveals whether remote sessions launched commands or created persistence on additional machines.

C:

Destination evidence can show whether the source actually gained sessions and what privileges or accounts were used.

Incorrect Answers

A:

Those records support the timeline and need preservation while response boundaries are established.

D:

East-west sessions are often central to lateral movement, so internal host evidence is required.

E:

Attempted reachability is not equivalent to successful authentication, execution, or unauthorized control.

Question 294

A previously restricted management port becomes publicly reachable just after a firewall policy edit. What immediate response is justified?

  1. Validate the change and restore approved firewall access rules
  2. Turn off all internal management protocols permanently without an impact review
  3. Delete configuration audit history to reduce noise
  4. Assume a policy edit is harmless whenever it came from an administrative account

Explanation

Correct Answer

A:

An unauthorized exposure should be corrected promptly with documented rollback and review for any access that occurred during the window.

Incorrect Answers

B:

Emergency correction should target the unintended public reachability while preserving essential approved administration.

C:

Audit records can identify who introduced the exposure and are necessary for later control assessment.

D:

Privileged credentials can be stolen or misused; authorization and change records must be checked.

Question 295

A network sensor shows packets with a forged internal source address arriving on an external interface. What defensive check is relevant?

  1. Treat source IP in every packet as reliable human attribution
  2. Increase the database password complexity requirement as the sole network action
  3. Disable routing logs to hide the forged address
  4. Ingress anti-spoofing or source-validation policy at the network boundary

Explanation

Correct Answer

D:

Filtering packets whose source prefixes are implausible on that interface limits simple address spoofing and improves telemetry trust.

Incorrect Answers

A:

Spoofed addresses demonstrate why packet headers alone do not establish sender identity.

B:

Password policy cannot validate the source addressing of packets arriving on a router interface.

C:

Logging suppression removes evidence and does not prevent spoofed traffic from entering the segment.

Question 296

A branch LAN shows conflicting gateway MAC mappings and suspicious interception. What containment action fits after validation?

  1. Ignore gateway mapping changes because Ethernet devices cannot spoof ARP replies
  2. Remove the rogue LAN device and enable ARP safeguards
  3. Replace web application authentication tokens without changing the LAN path
  4. Only block the attacker's public IPv6 address at the internet gateway

Explanation

Correct Answer

B:

Stopping forged local address mappings restores expected forwarding; switch controls must be configured with trusted bindings and topology awareness.

Incorrect Answers

A:

ARP lacks built-in authentication, allowing a malicious local device to inject deceptive neighbor mappings.

C:

Credential renewal may be needed after interception, but it does not remove the spoofing device or forged ARP responses.

D:

ARP spoofing is a local IPv4 broadcast-domain problem and may involve no public source address at all.

Question 297

Responders need to assess what data crossed an internal link during a short suspected exfiltration window. Which evidence set is most helpful?

  1. Only an aggregate daily router uptime counter
  2. Combine packet captures with flow data and host context
  3. Only a list of approved firewall rule names without event hits
  4. Only the public IP registration date of the endpoint's ISP

Explanation

Correct Answer

B:

Packet payloads or protocol metadata may reveal transfers, while flows and host telemetry help scope participants and direction.

Incorrect Answers

A:

Uptime does not identify communications, transferred bytes, or the protocol used in the target interval.

C:

Configured permissions show potential paths, not which sessions occurred or what they carried.

D:

Registry information does not reconstruct the organization's actual network conversations.

Question 298

A suspicious outbound connection uses TLS, and a sensor cannot inspect its payload. What should responders do?

  1. Disable TLS for all production applications without approval
  2. Assume the exact stolen files are visible in ordinary NetFlow records
  3. Join flow data to visible certificate, proxy and host evidence
  4. Declare the transfer harmless because it uses encryption

Explanation

Correct Answer

C:

Encrypted payloads limit passive content inspection but still allow a scoped behavioral and host-based investigation.

Incorrect Answers

A:

Broadly weakening encryption would create new security risks and is not justified by one suspicious connection.

B:

Flow summaries contain metadata and volumes, not decrypted application documents.

D:

Encryption protects transport content but cannot establish whether an attacker or approved application initiated the flow.

Question 299

An EDR isolation action stopped an endpoint's command traffic but also blocked routine patch management. What should responders verify?

  1. That all network access has automatically been safe since the alert cleared
  2. That the endpoint can be placed back on the main LAN without eradication
  3. The isolation policy's permitted management channels and the approved recovery workflow
  4. That patch management failure proves the security vendor falsely identified malware

Explanation

Correct Answer

C:

Containment should preserve necessary responder access where feasible while preventing malicious communication and tracking operational side effects.

Incorrect Answers

A:

Quarantine can stop some paths while leaving others or ongoing malware processes; verification is still needed.

B:

Reconnection before cleanup and validation can allow the original malicious activity to resume.

D:

A network restriction can interrupt legitimate maintenance even when the initial compromise assessment was correct.

Question 300

A compromise in a user VLAN is spreading toward an administrative database segment. Which control best limits cross-segment movement?

  1. Limit cross-segment traffic to explicitly required connections
  2. Increase the size of the user VLAN address pool
  3. Add a permissive any-to-any rule between the two VLANs
  4. Disable audit logging on the database to reduce utilization

Explanation

Correct Answer

A:

Segmentation reduces reachable attack surface and can be applied promptly with business dependency checks during containment.

Incorrect Answers

B:

More addresses do not restrict access to the sensitive database segment or block observed lateral connections.

C:

Broad allowance expands the very network path the attack is exploiting.

D:

Removing evidence does not control cross-segment reachability and weakens post-incident analysis.

Certified SOC Analyst (312-39) Practice Tests