Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 32

Question 310

An IDS claims a server received an exploit packet, but there is no evidence of execution or state change. What is the defensible incident statement?

  1. An exploit attempt was observed; successful compromise remains unconfirmed
  2. Successful root compromise has been proven by the packet alert alone
  3. Every exploit signature should be disabled until full compromise is visible
  4. The attempt was benign because no host artifact is currently available

Explanation

Correct Answer

A:

A network signature can detect attempted delivery, while host, application, and follow-up evidence establish impact or execution.

Incorrect Answers

B:

Delivery of a suspicious request is not equivalent to execution of arbitrary code or privilege gain.

C:

Attempt detections provide useful preventive and investigative signals when interpreted with appropriate confidence.

D:

Missing evidence may reflect visibility limits and does not establish benign intent.

Question 311

A compromised VPN gateway has been rebuilt. Which validation best supports restoring production access?

  1. Disable VPN audit logging permanently to maximize throughput
  2. Verify restored configuration, patched access and monitored service
  3. Check only that the gateway replies to ping
  4. Reuse the suspected admin secrets to minimize user disruption

Explanation

Correct Answer

B:

Recovery requires both working service and confidence the previous compromise route is closed, with telemetry restored.

Incorrect Answers

A:

Removing authentication records undermines the very visibility needed to detect recurring misuse.

C:

ICMP reachability does not prove secure identity configuration, removal of persistence, or correct VPN authorization.

D:

Reusing compromised secrets may allow the attacker back into the freshly rebuilt gateway.

Question 312

A cloud VM is compromised and attempts to scan peer instances in the same virtual network. Which containment lever most directly narrows its traffic?

  1. Change only the VM's display name in the portal
  2. Apply and verify narrowly scoped cloud network controls
  3. Delete all cloud flow logs before enforcing a block
  4. Increase the instance CPU allocation

Explanation

Correct Answer

B:

Cloud network controls can restrict east-west reachability without necessarily deleting the affected VM and its evidence.

Incorrect Answers

A:

Renaming an asset does not alter network filtering or the source process's ability to connect.

C:

Flow records are useful for scoping movement and should be preserved during network containment.

D:

More compute capacity cannot prevent malicious lateral scanning and may increase the resources available to the attacker.

Question 313

A production web application is confirmed vulnerable to SQL injection and logs show active unauthorized queries. What containment best limits further abuse while a fix is prepared?

  1. Increase the database query timeout without changing application input handling
  2. Use a focused WAF block or disable the endpoint through change control
  3. Delete all database audit logs to prevent attackers from learning table names
  4. Assume all malicious queries were stopped because the application uses HTTPS

Explanation

Correct Answer

B:

Temporary request blocking can reduce active exploitation, but the vulnerable query construction still requires permanent remediation.

Incorrect Answers

A:

Longer timeouts do not prevent unauthorized SQL execution and may worsen resource impact.

C:

Evidence removal will not stop injection and makes assessment of affected records much harder.

D:

Transport encryption protects data in transit but does not prevent unsafe SQL query construction.

Question 314

Investigators confirm a stored XSS payload in a forum post that has been viewed by customers. Which two response actions are appropriate? Choose TWO.

  1. Assess affected sessions and invalidate exposed tokens where evidence supports theft
  2. Remove or neutralize the stored malicious content and fix the output-encoding weakness
  3. Assume browser script execution is harmless whenever the server has valid TLS
  4. Delete all customer audit logs to protect their privacy
  5. Rely only on a network firewall block for the attacker's IP

Explanation

Correct Answers

A:

A browser script may access accessible tokens or act in the user context, so session scope and revocation must be assessed.

B:

Stopping further browser execution requires addressing both the immediate payload and the rendering flaw that allowed it.

Incorrect Answers

C:

TLS authenticates transport endpoints and does not sanitize attacker-controlled content delivered through the application.

D:

Preserved access and session records help determine who saw the payload; privacy should be handled through controlled access.

E:

The payload is already stored by the application and may execute for new viewers without further requests from the original uploader.

Question 315

An API returns private customer records when callers change object IDs despite valid basic-user authentication. What permanent remediation is essential?

  1. Assume encryption of the response fixes unauthorized disclosure
  2. Change the API host's public DNS name
  3. Enforce server-side object authorization for each requested record
  4. Hide the object identifier field from the browser UI only

Explanation

Correct Answer

C:

The application must verify the caller is permitted to access the specific object regardless of the identifier supplied by the client.

Incorrect Answers

A:

TLS protects transit but does not control which authenticated principal is allowed to receive a record.

B:

A hostname change does not prevent an authenticated caller from requesting objects belonging to others.

D:

Attackers can send HTTP requests directly; concealing an ID in the interface does not enforce backend access checks.

Question 316

A credential-stuffing campaign succeeds against some customer accounts. Which response addresses both current sessions and future reuse?

  1. Block only the single IP that generated the first failed login
  2. Assume MFA requests alone prove every impacted session is legitimate
  3. Revoke exposed sessions and credentials; add abuse controls
  4. Increase the web application cache size as the sole mitigation

Explanation

Correct Answer

C:

Account recovery must limit existing attacker access and reduce further automated attempts, with user communication and monitoring.

Incorrect Answers

A:

Distributed automation may use many origins and existing sessions can persist even after one address is denied.

B:

Session theft or phishing can occur even with MFA, so responders need sign-in and token context.

D:

Caching improves performance but does not invalidate stolen credentials or prevent unauthorized authentication.

Question 317

An application log accidentally exposed a production API secret that is now being used from an unknown host. What should responders do?

  1. Remove the log line from the current dashboard and keep the original secret active
  2. Rotate the secret and examine use of the compromised value
  3. Change only the application's CSS styling
  4. Disable the alert rule so the secret-use events stop appearing

Explanation

Correct Answer

B:

Rotating a compromised secret removes the known credential path while audit records reveal what operations the attacker performed.

Incorrect Answers

A:

Hiding the displayed value does not revoke copies already obtained by unauthorized parties.

C:

Presentation code does not influence validity of the API credential being used remotely.

D:

Silencing detection masks ongoing misuse and does nothing to restore credential confidentiality.

Question 318

A web server was exploited through a suspicious upload, and the file is still present. What should responders preserve before removing it when safe?

  1. Only the last successful website availability check
  2. File hash and copy, upload-request context, process activity, and related access logs
  3. Rely on the web application firewall alert without retaining the uploaded file or request
  4. Only the total number of web requests in the month

Explanation

Correct Answer

B:

Correlated artifacts can show how the file arrived, what it executed, and which systems it contacted; removal alone loses provenance.

Incorrect Answers

A:

Uptime monitoring cannot reconstruct file origin, process lineage, or suspicious commands.

C:

An alert supplies a detection clue but can omit file bytes, uploader context, server execution, and the request sequence needed to reconstruct exploitation.

D:

Aggregate volume loses request and file details needed for an exploit timeline.

Question 319

A web application keeps the same anonymous session identifier after a user signs in. An attacker can preselect that identifier in a victim browser and later reuse it. What remediation targets this session-fixation weakness?

  1. Regenerate the session ID after login and invalidate the old one
  2. Keep the anonymous identifier but set a longer cookie expiration time
  3. Require the user to clear browser history while preserving the server session key
  4. Remove the session cookie HttpOnly flag so scripts can rotate the value

Explanation

Correct Answer

A:

A new authenticated session breaks continuity with an identifier an attacker may already know; server-side invalidation blocks reuse of the prelogin session.

Incorrect Answers

B:

A longer-lived predictable preauthentication identifier preserves the attacker’s opportunity rather than separating anonymous and authenticated sessions.

C:

History clearing does not replace a known session identifier or prevent the server from accepting an attacker-controlled authenticated session.

D:

Disabling HttpOnly exposes the token to page scripts and does not reliably enforce server-side session rotation at the login boundary.

Question 320

A vulnerable web application is patched and restored after compromise. Which evidence most strongly supports safe reopening?

  1. The application certificate has a future expiration date
  2. The homepage loads successfully once in the administrator's browser
  3. Run exploit regression tests and verify trusted deployment
  4. The WAF alert count is zero while its logging connector is offline

Explanation

Correct Answer

C:

A complete recovery verifies both functionality and security improvement while checking for residual persistence or unauthorized changes.

Incorrect Answers

A:

Valid TLS metadata does not prove backend authorization, code integrity, or removal of compromise artifacts.

B:

A functional response does not establish that the exploited flaw or any attacker-created access has been removed.

D:

Missing telemetry prevents useful assessment; absence of alerts from a silent source is not reassurance.

Certified SOC Analyst (312-39) Practice Tests