Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 35

Question 340

A suspected malicious executable is discovered on a server. Which action best preserves evidence and limits accidental execution?

  1. Run the program on an administrator's production laptop to see what it does
  2. Rename the executable and assume the malware can no longer run
  3. Email the executable as an unprotected attachment to all SOC analysts
  4. Hash and preserve the sample, then quarantine under approved policy

Explanation

Correct Answer

D:

Preserving bytes and provenance enables malware analysis while controlled storage reduces risk of unintended execution.

Incorrect Answers

A:

Executing unknown code on a trusted workstation could create additional compromise and contaminate evidence.

B:

A changed filename does not remove executable functionality or persistence mechanisms.

C:

Uncontrolled distribution increases exposure and lacks proper evidence handling or execution safeguards.

Question 341

An EDR alert shows a suspicious child process spawned by an office document, followed by a new autorun entry. What should be investigated?

  1. Only the document's file size without execution telemetry
  2. Only the number of staff who use the office application
  3. Examine the execution path, persistence and produced artifacts
  4. Only network DNS logs from unrelated servers

Explanation

Correct Answer

C:

The sequence can indicate malicious document execution and a mechanism for re-launching code after logon or reboot.

Incorrect Answers

A:

Size provides little evidence about the child process and persistence action observed by EDR.

B:

Application popularity cannot determine whether the specific process chain was malicious.

D:

Unrelated hosts cannot establish the creation of an autorun entry or local execution on the affected endpoint.

Question 342

An investigator must understand a suspected fileless malicious process that may vanish on reboot. Which acquisition has highest time sensitivity?

  1. Acquire a full forensic disk image only after the endpoint is rebooted
  2. A controlled capture of volatile memory while the host remains powered on
  3. Collect firewall flow logs while postponing acquisition of the running host memory
  4. Export installed software inventories before capturing any volatile memory

Explanation

Correct Answer

B:

RAM can contain injected code, running processes, sessions, and ephemeral artifacts that are lost when power is removed.

Incorrect Answers

A:

A disk image preserves durable files well, but a reboot can erase the volatile injected process state that the investigator specifically needs to study.

C:

Network records help correlate external contacts, but cannot replace injected code or volatile process state on the suspected fileless endpoint.

D:

Software inventory can assist with environment context, yet it does not preserve transient code, decrypted artifacts, or process address space before shutdown.

Question 343

A responder needs to stop a confirmed malicious process on one endpoint and quarantine the affected device. Which technology is directly designed for this workflow?

  1. A vulnerability scanner operating weekly only
  2. EDR process termination and host network isolation
  3. A passive network flow collector with no endpoint control
  4. An email archival system that stores message headers

Explanation

Correct Answer

B:

EDR provides endpoint-level investigation and response capabilities, subject to agent health, platform support, and role permissions.

Incorrect Answers

A:

Periodic scanning identifies weaknesses but is not a responsive process-control mechanism for a live endpoint infection.

C:

Flow telemetry shows conversations and volumes but cannot necessarily terminate a local process or isolate its host.

D:

Mail retention helps phishing investigation but does not control active processes on the compromised workstation.

Question 344

An EDR isolator blocks network access on a compromised laptop. Which response step is still necessary?

  1. Reconnect the laptop immediately to test whether malware resumes
  2. Remove persistence and verify isolation and management exceptions
  3. Delete every EDR alert that occurred before isolation
  4. Declare eradication complete as soon as the isolation status reads active

Explanation

Correct Answer

B:

Network containment limits reachability but does not necessarily kill malicious code or remove mechanisms that reappear after reconnecting.

Incorrect Answers

A:

Uncontrolled reconnection can restore attacker paths before cleanup and safety validation.

C:

Earlier telemetry may reveal infection origin, lateral movement, and scope and should be retained.

D:

Containment status is not proof that files, credentials, or persistence were cleaned from the endpoint.

Question 345

An intrusion spans email delivery, cloud sign-in, and endpoint execution. Which XDR characteristic is especially useful?

  1. Assuming every cloud sign-in is controlled through endpoint network quarantine
  2. Restricting analysis exclusively to local antivirus signatures
  3. Correlating detection and response signals across multiple security domains
  4. Replacing evidence preservation with a single automatically generated severity label

Explanation

Correct Answer

C:

Extended detection and response can connect related signals and orchestrate coordinated actions where integrations support them.

Incorrect Answers

A:

Cloud sessions and tokens may remain valid independently of one isolated device, requiring identity actions.

B:

Signature-only endpoint views miss the email and identity portions of a cross-domain compromise.

D:

Unified scoring is helpful but does not eliminate the need for raw supporting records and provenance.

Question 346

An XDR platform reports that a mailbox compromise led to a payload execution on one employee laptop. Which two containment actions cover the linked stages? Choose TWO.

  1. Assume deleting the original phishing email ends the compromise
  2. Revoke the compromised account's sessions and investigate unauthorized mailbox rules
  3. Disable all audit telemetry for the mailbox during cleanup
  4. Block only the phishing sender's display name in future mail
  5. Isolate the affected laptop and investigate malicious process persistence

Explanation

Correct Answers

B:

Identity-layer response closes persistent email and sign-in access paths that endpoint isolation alone cannot address.

E:

Endpoint containment reduces propagation and allows responders to analyze the executed payload and local artifacts.

Incorrect Answers

A:

Removing delivery content cannot reverse session theft or malware execution that already occurred.

C:

Loss of records can conceal new suspicious sessions and undermines incident scope reconstruction.

D:

Display names are easy to alter and do not remove existing attacker access or endpoint processes.

Question 347

A legitimate security testing tool triggers a high-severity EDR response. How should the response team refine future behavior?

  1. Treat the EDR finding as conclusive real-world criminal activity
  2. Document the approved test and time-limit narrowly scoped tuning
  3. Remove all future security tests to prevent SOC alerts
  4. Permanently exclude the binary on every endpoint

Explanation

Correct Answer

B:

A precise exception avoids repeated disruption without creating a persistent blind spot for misuse of the same tool.

Incorrect Answers

A:

Approved assessments intentionally emulate threats, so authorization and change details are necessary for disposition.

C:

Controlled exercises validate detection and response capability and can be coordinated rather than abolished.

D:

Attackers may reuse legitimate tools; a global exclusion sacrifices meaningful endpoint visibility.

Question 348

An endpoint agent was disabled just before credential theft, leaving a gap in process telemetry. What should responders do?

  1. Assume the absence of EDR process events proves no commands ran
  2. Erase available domain-controller sign-in records because endpoint logs are incomplete
  3. Permanently close all cases involving the affected host
  4. Investigate agent tampering and pivot to retained identity, OS, and network evidence

Explanation

Correct Answer

D:

Alternative logs can help reconstruct the incident while the missing endpoint visibility is documented and restored.

Incorrect Answers

A:

An inactive agent cannot establish a negative fact about execution during its downtime.

B:

Other sources may be essential corroboration and should be preserved to compensate for the gap.

C:

A sensor outage increases uncertainty and should not eliminate the need for investigation.

Question 349

After a malware file is deleted, a scheduled task recreates it at the next logon. What failed in the eradication process?

  1. The organization lacked any packet capture of the original infection
  2. The SIEM dashboard did not have enough charts
  3. The malware hash should never change between infections
  4. The persistence mechanism was not removed or disabled

Explanation

Correct Answer

D:

Deleting the payload alone leaves an execution path that can redownload or regenerate it after a trigger.

Incorrect Answers

A:

Packet evidence helps attribution but the observed recurrence directly indicates incomplete removal of persistence.

B:

Visualization count does not control scheduled execution or the re-creation of the malware file.

C:

File hashes may differ between versions; the central failure here is the still-active launch mechanism.

Question 350

A malware sample must be shared with an external analyst for authorized review. Which handling is most appropriate?

  1. Rename the sample to a harmless-looking document and email it openly
  2. Erase all acquisition notes before sending the sample
  3. Transfer samples securely with validated recipient and custody log
  4. Upload the raw executable to a public forum without checking sensitive data

Explanation

Correct Answer

C:

Malicious files require restricted access and provenance to prevent accidental execution or unauthorized distribution.

Incorrect Answers

A:

Changing extension or name is not a security control and may encourage accidental handling mistakes.

B:

Without provenance the recipient may be unable to verify what file was collected or when.

D:

Public release can expose personal information and provide uncontrolled distribution of potentially harmful code.

Certified SOC Analyst (312-39) Practice Tests