Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 34

Question 330

A departing administrator suddenly adds a personal account to a privileged group. Which action best reduces continued unauthorized access?

  1. Treat every group change as normal if it was made with an admin login
  2. Confirm business authorization and revoke unauthorized privileges
  3. Wait until the administrator returns from leave before collecting evidence
  4. Remove all group membership logs after restoring the directory

Explanation

Correct Answer

B:

A privileged grant near departure can create persistence; timely removal and scope review protect the organization.

Incorrect Answers

A:

Authorized credentials may be misused, so change approval and business justification remain necessary.

C:

Administrative privilege can be misused immediately; approved security and HR procedures should guide timely containment.

D:

Evidence of who added access and when is essential for attribution and determining scope.

Question 331

An employee denies deleting audit records, but the logs show their account performed the action. What is the soundest next step?

  1. State publicly that the employee is guilty based only on the username
  2. Rewrite the audit logs to match the employee's account of events
  3. Discard the case because a denial disproves the log
  4. Verify whether device and session details fit the authorized user

Explanation

Correct Answer

D:

An audit actor field identifies the credential context, not necessarily the human at the keyboard or their intent.

Incorrect Answers

A:

Stolen or shared credentials can produce activity under another person's name; attribution requires careful evidence.

B:

Changing original evidence would compromise integrity and prevent independent review.

C:

A subject's statement is one information source and does not invalidate recorded administrative activity.

Question 332

An employee under investigation is still needed to run a critical business process. How should access restrictions be determined?

  1. Assume no restrictions are possible while the employee has a business duty
  2. Let the subject decide which investigative logs may be retained
  3. Automatically terminate all company services used by that employee
  4. Coordinate proportional controls with HR, legal and service owners

Explanation

Correct Answer

D:

Response should protect evidence and reduce risk while accounting for employee rights and operational dependencies.

Incorrect Answers

A:

Compensating controls and limited permissions may be feasible even when complete removal is not immediately practical.

B:

Evidence preservation and access decisions require independent authorized governance to avoid conflict of interest.

C:

A broad service shutdown can harm unrelated users and exceeds the needed access-control scope.

Question 333

An insider-risk incident involves unauthorized file copying through redirected USB storage inside virtual desktop sessions. Physical workstation USB policies are enabled but the transfers continue. Which response closes the specific path?

  1. Restrict USB storage redirection in the VDI broker and verify enforcement
  2. Change the SIEM dashboard classification from insider risk to malware
  3. Deploy endpoint USB restrictions only to unmanaged physical laptops
  4. Leave USB redirection active but reduce the archive retention of VDI access logs

Explanation

Correct Answer

A:

Redirection settings can expose removable volumes inside virtual desktops even when local restrictions differ; scope the change with business approval and validate enforcement.

Incorrect Answers

B:

Changing the category of an alert does not enforce virtual desktop storage policies or interrupt ongoing file copying through redirected devices.

C:

The active copying path is controlled by virtual desktop redirection. Changing unrelated physical endpoints cannot stop USB storage exposed within the sessions.

D:

Shorter log retention removes investigative visibility, while the file-transfer pathway stays available until its access and redirection controls are corrected.

Question 334

A shared administrator account was used for suspicious changes. What is the major investigative problem?

  1. All actions under the account are automatically approved by policy
  2. A shared account cannot identify one person without other records
  3. The suspicious actions must have originated outside the organization
  4. The account cannot technically make any configuration changes

Explanation

Correct Answer

B:

Shared credentials obscure individual responsibility, so investigators need supporting logs and should improve privileged access accountability.

Incorrect Answers

A:

A credential used by multiple people does not prove every operation was authorized.

C:

Shared credentials can be misused by insiders or external attackers and do not determine source location.

D:

Shared administrative credentials may be powerful; the problem is attribution and control, not necessarily lack of privilege.

Question 335

A user makes a private cloud-storage folder publicly accessible and its files contain sensitive reports. Which response is appropriate?

  1. Delete all audit history to prevent additional disclosure
  2. Assume the share link was never used because the user did not send it by email
  3. Rename the folder but keep its broad public permission
  4. Restore restricted sharing and review historical external access

Explanation

Correct Answer

D:

Immediate exposure containment should be paired with evidence of who changed sharing and whether the data was retrieved.

Incorrect Answers

A:

Audit records support scope assessment and do not cause the public sharing configuration itself.

B:

Public links can be discovered or propagated in multiple ways; access evidence is needed to assess exposure.

C:

Changing a label does not correct an access-control setting that allows unauthorized users to retrieve files.

Question 336

After an insider-risk case, which control improvement most directly addresses repeated unauthorized data exports by privileged users?

  1. Improve access approval, DLP and monitored transfer controls
  2. Replace incident evidence with aggregate bandwidth reports only
  3. Disable every security alert for administrators to avoid noise
  4. Keep unrestricted personal-cloud uploads because administrators are trusted

Explanation

Correct Answer

A:

A durable improvement reduces unnecessary sensitive access and increases visibility into risky exports without relying solely on user intent.

Incorrect Answers

B:

Traffic totals cannot identify what was copied, the responsible identity, or whether the action was authorized.

C:

Privileged users can cause high-impact harm; suppressing their activity creates a significant monitoring blind spot.

D:

Trust in role holders is not a substitute for data handling policy and defense-in-depth controls.

Question 337

A worm is spreading between Windows endpoints using an internal management share. Which immediate combination best addresses propagation?

  1. Isolate infected hosts and restrict the exploited lateral protocol
  2. Only update the email spam filter
  3. Delete all endpoint event logs before restarting systems
  4. Wait for automated weekly patch cycles without temporary containment

Explanation

Correct Answer

A:

Host quarantine and network segmentation can stop new infections as responders investigate the entry path and affected assets.

Incorrect Answers

B:

Mail filtering may help with initial infection but does not interrupt the observed internal share-based movement.

C:

Erasing evidence undermines understanding of propagation and does not remove the worm from affected machines.

D:

Active spread requires immediate response; maintenance schedules are not a substitute for limiting the current attack path.

Question 338

An endpoint shows mass encryption of documents and attempts to stop backup services. What should responders prioritize?

  1. Disable backup immutability to make old copies easier to edit
  2. Isolate the affected host, protect recovery infrastructure, and preserve essential evidence
  3. Disable only the file-sharing service on the host while leaving its management and backup paths active
  4. Pay a ransom immediately based solely on the first endpoint alert

Explanation

Correct Answer

B:

Ransomware impact can expand rapidly, so limiting reach to shares and backups is urgent while incident command coordinates response.

Incorrect Answers

A:

Removing backup safeguards can expose recovery data to the attacker during an active encryption campaign.

C:

Reducing share exposure may limit one spread path, but ransomware can retain alternate access and threaten backup infrastructure without broader approved isolation and evidence protection.

D:

An unverified payment decision is outside routine triage authority and does not guarantee recovery or safety.

Question 339

A ransomware-affected file server has clean offline backups, but its compromised administrative account is still active. What is the main risk of immediate restoration?

  1. The restored server will no longer need security monitoring
  2. Clean backups are inherently malicious because they are stored offline
  3. Successful storage restoration automatically revokes stolen identities
  4. Stolen credentials may enable new access after restoring the host

Explanation

Correct Answer

D:

Recovering data without removing access paths and persistence can repeat the incident, so identity and host eradication must accompany restoration.

Incorrect Answers

A:

Post-recovery observation is important to detect residual behavior and validate the remediation of the initial access path.

B:

Offline copies can provide strong recovery protection when integrity and restore functionality have been tested.

C:

File recovery does not change authentication state or invalidate compromised privileged sessions.

Question 340

A suspected malicious executable is discovered on a server. Which action best preserves evidence and limits accidental execution?

  1. Run the program on an administrator's production laptop to see what it does
  2. Rename the executable and assume the malware can no longer run
  3. Email the executable as an unprotected attachment to all SOC analysts
  4. Hash and preserve the sample, then quarantine under approved policy

Explanation

Correct Answer

D:

Preserving bytes and provenance enables malware analysis while controlled storage reduces risk of unintended execution.

Incorrect Answers

A:

Executing unknown code on a trusted workstation could create additional compromise and contaminate evidence.

B:

A changed filename does not remove executable functionality or persistence mechanisms.

C:

Uncontrolled distribution increases exposure and lacks proper evidence handling or execution safeguards.

Certified SOC Analyst (312-39) Practice Tests