Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 36

Question 350

A malware sample must be shared with an external analyst for authorized review. Which handling is most appropriate?

  1. Rename the sample to a harmless-looking document and email it openly
  2. Erase all acquisition notes before sending the sample
  3. Transfer samples securely with validated recipient and custody log
  4. Upload the raw executable to a public forum without checking sensitive data

Explanation

Correct Answer

C:

Malicious files require restricted access and provenance to prevent accidental execution or unauthorized distribution.

Incorrect Answers

A:

Changing extension or name is not a security control and may encourage accidental handling mistakes.

B:

Without provenance the recipient may be unable to verify what file was collected or when.

D:

Public release can expose personal information and provide uncontrolled distribution of potentially harmful code.

Question 351

A worm stole several service account passwords before its process was terminated. What follow-up remains essential?

  1. Delete identity sign-in logs to hide the stolen passwords from attackers
  2. Keep credentials unchanged because the original process is no longer running
  3. Reimage the infected endpoint without changing potentially stolen service-account passwords
  4. Rotate or revoke exposed credentials and check for attacker reuse

Explanation

Correct Answer

D:

Stopping the executable does not invalidate secrets already copied, so access containment must address compromised identities.

Incorrect Answers

A:

Security logs rarely contain plaintext secrets and are needed to trace misuse; deletion is not credential containment.

B:

Copied secrets can be used from other hosts even after the infected endpoint is cleaned.

C:

Rebuilding removes local artifacts but does not invalidate copied credentials, which could still authenticate from an attacker-controlled host after remediation.

Question 352

A security analyst finds a suspected trojan process using a valid code-signing certificate. What conclusion is warranted?

  1. A signed process cannot connect to command infrastructure
  2. A valid digital signature does not prove harmless behavior
  3. The certificate uniquely reveals the attacker's physical location
  4. Any signed executable is categorically safe from investigation

Explanation

Correct Answer

B:

Certificates can be misused, stolen, or attached to compromised software, so observed actions and trust context matter.

Incorrect Answers

A:

Process behavior is independent of whether its binary has a cryptographically verifiable signer.

C:

Signing identity is not reliable human geolocation and does not establish the operator of the incident.

D:

A valid signature does not prevent authorized software from being abused or a signer from being compromised.

Question 353

A ransomware group attempts to delete cloud backup snapshots using stolen administrative rights. Which response priority protects recovery options?

  1. Assume snapshots are safe because they reside outside the infected workstation
  2. Revoke backup privileges and preserve protected recovery copies
  3. Give the compromised account more snapshot permissions for troubleshooting
  4. Disable backup logging so deletion attempts are less noisy

Explanation

Correct Answer

B:

Attackers often target recovery copies, so isolating backup administration and verifying immutable or offline versions is urgent.

Incorrect Answers

A:

Cloud backup management may be reachable through stolen credentials, so location alone does not ensure protection.

C:

Expanding privileges can make it easier for the attacker to destroy remaining recovery copies.

D:

Reducing audit visibility hides destructive control-plane actions and makes recovery assessment harder.

Question 354

A payment demand appears after ransomware encryption, but responders have not verified whether data was stolen. What should the incident team do?

  1. Assume data theft is impossible whenever files were encrypted locally
  2. Declare data theft proven solely because the attacker wrote it in a note
  3. Report confirmed encryption separately from suspected data theft
  4. Delete all egress logs to avoid amplifying the attacker's claims

Explanation

Correct Answer

C:

Extortion statements may be false or accurate; network and host evidence should establish what happened before legal and business decisions.

Incorrect Answers

A:

Ransomware operators may exfiltrate before encryption, so the absence of proof is not proof of impossibility.

B:

Adversary messaging is not independent evidence and can overstate scope to pressure victims.

D:

Network evidence can confirm or refute the extortion claim and should be preserved for scope assessment.

Question 355

An attacker exploited an unpatched edge appliance, gained credentials, and created a persistence account. Which remediation set is most complete?

  1. Close the entry path, rotate secrets and remove persistence
  2. Only install the vendor patch and leave stolen credentials active
  3. Only change the incident ticket state to resolved
  4. Only disable the persistence account without fixing the appliance

Explanation

Correct Answer

A:

Durable eradication closes both the original entry point and secondary access mechanisms established after compromise.

Incorrect Answers

B:

Patching blocks one exploit path but does not revoke secrets already exposed to the intruder.

C:

An administrative status has no preventive effect on exposed services, credentials, or malicious accounts.

D:

An attacker can exploit the original weakness again if the initial access vulnerability remains available.

Question 356

A restored endpoint passes malware scanning, but a suspicious startup service remains in its configuration. What should block closure?

  1. Startup services can never be abused by attackers
  2. Malware scanning is always perfect across all threats
  3. Investigate unresolved persistence before reconnecting the host
  4. System recovery is complete once it can connect to the internet

Explanation

Correct Answer

C:

A clean signature scan does not guarantee the absence of attacker control, especially when an autorun service is still present.

Incorrect Answers

A:

Autostart mechanisms are a common method of maintaining execution after reboot or logon.

B:

Detection signatures and behavior analytics can miss variants or dormant persistence, so residual indicators matter.

D:

Network connectivity alone is not an assurance of system integrity or successful eradication.

Question 357

After recovering a corrupted file server, what should be tested to validate future resilience?

  1. A controlled restoration exercise with known recovery point and time objectives
  2. Only the number of completed backup jobs reported last night
  3. Check storage throughput and server CPU during normal file access without testing restore
  4. Only the count of antivirus scans completed during the incident

Explanation

Correct Answer

A:

Testing backup usability and recovery duration shows whether the organization can meet business continuity requirements.

Incorrect Answers

B:

Successful scheduling does not confirm that the copies can be restored into a functioning service.

C:

Performance metrics describe the running service, not whether a backup can be used to recover data reliably within the defined outage window.

D:

Malware scanning can aid eradication but does not validate the recovery capability of stored backup copies.

Question 358

A playbook can revoke a cloud user session, isolate an endpoint, and block a domain after confirmed compromise. Which three safeguards should accompany the automation? Choose THREE.

  1. Audit logging that records decisions, actors, and action outcomes
  2. Permanent suppression of all alerts once the first automation completes
  3. Explicit conditions defining when each action is authorized
  4. Unrestricted access to every privileged production secret
  5. Verification and rollback or exception handling for failed actions
  6. Deletion of all source events after executing the playbook

Explanation

Correct Answers

A:

A complete response trace enables review, troubleshooting, and evidence preservation across integrated tools.

C:

High-impact actions should trigger from validated incident criteria rather than an unrestricted single indicator.

E:

Automated steps can fail or disrupt legitimate services, so success checks and recovery paths reduce operational risk.

Incorrect Answers

B:

The attacker may continue through other paths, so future evidence must remain observable.

D:

Automation should use narrowly scoped credentials and should not expose unnecessary administrative powers.

F:

Source records support the investigation and are required to explain why the automation acted.

Question 359

A malware incident has been contained and hosts restored, but the team has not confirmed whether attacker-created identities still exist. Should it be closed?

  1. No; every incident must remain open forever regardless of verification
  2. Yes; closure is determined solely by the lack of active EDR alerts
  3. No; confirm attacker access and persistence are eliminated first
  4. Yes; restoring application response time proves all attacker access is gone

Explanation

Correct Answer

C:

A functioning restored service can still be compromised if hidden accounts or credentials provide a route back in.

Incorrect Answers

A:

Closure is possible after defined containment, recovery, and validation criteria have been met and documented.

B:

Monitoring may miss dormant access or be incomplete, so negative alerts are not sufficient evidence of eradication.

D:

Operational performance does not establish that identities, sessions, or persistence mechanisms were removed.

Question 360

A confirmed identity breach affects on-premises and cloud services. Which response model reduces the chance that cloud sessions remain active after on-prem password resets?

  1. Disable all cloud audit logging during identity recovery
  2. Treat cloud applications as unrelated because the original alert came from a domain controller
  3. Have the on-prem team declare success after changing a single password
  4. Coordinate account actions across identity providers, applications, and incident responders

Explanation

Correct Answer

D:

Federated and application sessions may have distinct revocation paths, so cross-team tracking is necessary for complete access containment.

Incorrect Answers

A:

Telemetry is needed to verify whether suspect sessions continue and to discover additional persistence.

B:

One compromised principal may access both environments, making cross-boundary scope investigation essential.

C:

One credential reset may not terminate all issued tokens or attacker-controlled application grants in integrated services.

Certified SOC Analyst (312-39) Practice Tests