Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 31

Question 300

A compromise in a user VLAN is spreading toward an administrative database segment. Which control best limits cross-segment movement?

  1. Limit cross-segment traffic to explicitly required connections
  2. Increase the size of the user VLAN address pool
  3. Add a permissive any-to-any rule between the two VLANs
  4. Disable audit logging on the database to reduce utilization

Explanation

Correct Answer

A:

Segmentation reduces reachable attack surface and can be applied promptly with business dependency checks during containment.

Incorrect Answers

B:

More addresses do not restrict access to the sensitive database segment or block observed lateral connections.

C:

Broad allowance expands the very network path the attack is exploiting.

D:

Removing evidence does not control cross-segment reachability and weakens post-incident analysis.

Question 301

A compromised proxy administrator changes routing rules to send users through an unknown external gateway. What response should be prioritized?

  1. Only raise the alert severity without restoring routing
  2. Restore proxy policy and revoke the suspected administrator access
  3. Assume the routing rule is legitimate because it was entered through the management GUI
  4. Delete all past proxy logs before switching back to the original route

Explanation

Correct Answer

B:

Control-plane integrity and credential containment both matter because the attacker may be redirecting sessions or collecting sensitive data.

Incorrect Answers

A:

An incident ticket cannot stop users from traversing the unauthorized external path.

C:

An authenticated administrative session may be attacker-controlled, so approval and actor context are necessary.

D:

Historical events can reveal the period and destinations of redirected traffic and should be preserved.

Question 302

A traffic flood threatens a remote office's only WAN link. Which two response measures are useful? Choose TWO.

  1. Only reboot client laptops because WAN saturation is a local browser issue
  2. Disable the organization's log collectors to free packet capacity
  3. Assume a single deny rule on the office router can recover already saturated inbound capacity
  4. Work with the provider to filter or absorb malicious traffic upstream of the constrained link
  5. Activate a tested alternate path or failover connectivity where available

Explanation

Correct Answers

D:

When the access circuit saturates, on-site filtering alone may not relieve bandwidth exhaustion before traffic reaches the office.

E:

Resilient routing can preserve critical services while upstream mitigation is engaged and monitoring continues.

Incorrect Answers

A:

Endpoint restarts do not remove excess traffic traversing the access link.

B:

Visibility loss will hinder investigation and may not materially address upstream circuit saturation.

C:

Local drops still consume the incoming circuit and may not restore usable bandwidth.

Question 303

A rogue DHCP server starts handing out an attacker-controlled DNS resolver to endpoints. Which defense should incident responders apply?

  1. Assume DHCP offers are authenticated by default on every Ethernet segment
  2. Delete DNS logs to hide the attacker resolver address
  3. Remove the rogue DHCP source and apply switch-level snooping
  4. Only force every user to clear browser cookies

Explanation

Correct Answer

C:

Switch enforcement can limit unauthorized offers and protect clients from network configuration redirection.

Incorrect Answers

A:

Standard DHCP offers do not inherently prove a server is authorized for that network.

B:

Evidence removal cannot prevent clients from accepting unauthorized DNS settings.

D:

Cookie deletion does not stop a rogue DHCP offer from assigning malicious DNS configuration to new clients.

Question 304

Resolver responses unexpectedly direct an internal update domain to an unapproved host. Which two actions are appropriate? Choose TWO.

  1. Permanently stop all corporate DNS services without business coordination
  2. Treat the changed address as harmless because the queried name looks familiar
  3. Assess which clients received the wrong response and investigate resulting connections
  4. Validate and correct resolver records or forwarding configuration against an authoritative trusted source
  5. Assume DNSSEC can never be misconfigured or bypassed

Explanation

Correct Answers

C:

Cache and query records help scope possible exposure and whether any endpoint contacted the attacker-controlled host.

D:

Restoring trusted resolution protects clients from being directed to the wrong update destination.

Incorrect Answers

A:

A blanket outage may cause broader disruption than a controlled correction and investigation.

B:

A trusted name resolving to an attacker address can redirect downloads or credentials and warrants verification.

E:

Integrity protections depend on deployment and validation, so responders must verify the actual resolution path.

Question 305

A newly compromised web server contacted an IP later assigned to a legitimate unrelated organization. What should the response record emphasize?

  1. A permanent claim that the current owner is responsible for the prior intrusion
  2. Time-qualified connection evidence and its original intelligence context
  3. Deletion of all prior connection logs because the indicator changed
  4. Only the public country of the address today

Explanation

Correct Answer

B:

Current ownership may differ from the attacker's earlier use; retrospective analysis must preserve when and why the address was linked.

Incorrect Answers

A:

Address reassignment does not identify who controlled infrastructure during the earlier connection.

C:

Historical traffic remains relevant even when current reputation no longer supports blocking.

D:

Modern infrastructure can change control and geography, so current geolocation cannot reconstruct the historic attack path.

Question 306

During a ransomware outbreak, file servers receive abnormal SMB write bursts from one compromised endpoint. What response best limits propagation?

  1. Disable only outbound DNS requests from the file servers
  2. Isolate the source host and restrict SMB spread while preserving data
  3. Change the public website TLS certificate without addressing SMB reachability
  4. Wait until all encrypted files have been processed before acting

Explanation

Correct Answer

B:

Source containment and targeted network segmentation interrupt file modification paths and support investigation of affected shares.

Incorrect Answers

A:

The harmful SMB writes are internal file-sharing operations and may continue even if external DNS is blocked.

C:

A certificate change does not interrupt malicious internal file operations.

D:

Delayed containment increases damage and reduces the value of early response to destructive behavior.

Question 307

An IDS sees suspicious traffic and then stops reporting for the affected subnet. What should responders do?

  1. Declare the incident ended when the IDS stops generating events
  2. Delete the last IDS alert because no newer alert followed
  3. Check the sensor and use alternative telemetry for threat assessment
  4. Assume every endpoint in the subnet is automatically infected

Explanation

Correct Answer

C:

A telemetry outage can be unrelated failure or attacker interference; response must not treat missing alerts as safety.

Incorrect Answers

A:

A silent sensor no longer measures the network, so cessation of alerts is not proof of containment.

B:

The earlier evidence may still identify the entry point and should not be erased due to a monitoring gap.

D:

The outage raises visibility concerns but does not prove universal host compromise.

Question 308

After creating an emergency egress block, analysts still observe new outbound sessions to the banned endpoint. What is the best follow-up?

  1. Delete the traffic records that contradict the expected result
  2. Assume all remaining connections are generated by dashboard refreshes
  3. Check rule precedence, direction, scope and existing sessions
  4. Announce the block successful because the change ticket was approved

Explanation

Correct Answer

C:

A saved configuration may not cover the actual traffic path; connection evidence and policy ordering show why containment failed.

Incorrect Answers

A:

Removing counterevidence conceals failure and allows the attacker channel to remain active.

B:

Without source and path validation, that explanation is speculation rather than a confirmed benign cause.

D:

Administrative approval does not prove technical enforcement across all devices and paths.

Question 309

A router management account is used from an unknown source to add a route diverting sensitive traffic. Which response is most appropriate?

  1. Only block suspicious email senders in the mail gateway
  2. Assume the router is safe because packet forwarding continues
  3. Restore known-good routes and audit the suspect change
  4. Factory-reset the router without preserving evidence or coordinating failover

Explanation

Correct Answer

C:

Routing integrity and privileged account control both need containment, plus a review of traffic affected while the route was active.

Incorrect Answers

A:

Mail filtering does not repair the unauthorized route or terminate control of the router.

B:

Compromised routing may maintain connectivity while redirecting traffic for interception or denial.

D:

An uncontrolled reset can erase configuration history and cause an avoidable availability incident.

Question 310

An IDS claims a server received an exploit packet, but there is no evidence of execution or state change. What is the defensible incident statement?

  1. An exploit attempt was observed; successful compromise remains unconfirmed
  2. Successful root compromise has been proven by the packet alert alone
  3. Every exploit signature should be disabled until full compromise is visible
  4. The attempt was benign because no host artifact is currently available

Explanation

Correct Answer

A:

A network signature can detect attempted delivery, while host, application, and follow-up evidence establish impact or execution.

Incorrect Answers

B:

Delivery of a suspicious request is not equivalent to execution of arbitrary code or privilege gain.

C:

Attempt detections provide useful preventive and investigative signals when interpreted with appropriate confidence.

D:

Missing evidence may reflect visibility limits and does not establish benign intent.

Certified SOC Analyst (312-39) Practice Tests