Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 4

Question 30

A user logged in to a billing application visits an attacker page; the browser then sends an unintended account-change request with session cookies. Which attack is illustrated?

  1. Cross-site request forgery in an authenticated user session
  2. A stored XSS payload on the billing application
  3. A server-driven database backup
  4. Credential replay from stolen password hashes

Explanation

Correct Answer

A:

An attacker can induce a state-changing request that carries ambient credentials when anti-CSRF controls or same-site restrictions are insufficient.

Incorrect Answers

B:

The scenario does not require attacker JavaScript to be stored on the target site; the key issue is cross-site request authorization.

C:

A database backup is an administrative data operation, not an unsolicited account-change request caused by a third-party page.

D:

Hash replay uses authentication artifacts to establish a session and is different from provoking an existing logged-in browser to send a request.

Question 31

HTTP requests to /api/accounts/another-user-id return private records while the requester remains logged in as a basic user. What application failure should be investigated?

  1. A stale browser cache holding the requester's own data
  2. Broken object-level authorization
  3. A purely cosmetic HTML rendering defect
  4. A TLS encryption downgrade on the connection

Explanation

Correct Answer

B:

The server appears to trust a user-supplied object identifier without checking whether that user may access the corresponding record.

Incorrect Answers

A:

A cache issue can cause incorrect display, but repeated authorized API responses exposing another account point to server-side access checks.

C:

Markup changes do not explain why an API returns private records belonging to a separate principal.

D:

A transport downgrade affects confidentiality in transit but does not establish a missing authorization decision for another account's record.

Question 32

A supplier requests an urgent bank-account change through an email that appears to come from its finance director; header review finds a similar-looking domain. What attack is most likely?

  1. A web-server distributed denial-of-service incident
  2. Business email compromise using domain impersonation
  3. A normal internal delegation of mailbox access
  4. A routine SPF policy update

Explanation

Correct Answer

B:

Lookalike domains and urgent payment changes are consistent with social-engineering attempts to redirect legitimate transactions.

Incorrect Answers

A:

A DDoS campaign aims at availability; here the attacker's apparent objective is financial redirection by impersonation.

C:

A legitimate delegation would not explain a misleading external domain designed to resemble the supplier's identity.

D:

Sender-policy maintenance concerns mail-domain authorization and cannot itself justify unverified bank-account changes.

Question 33

Several recipients get a message directing them to sign in to a cloud portal at a newly registered lookalike address. Which primary objective is most plausible?

  1. Credential harvesting through a phishing site
  2. Exfiltrating data solely through DNS TXT records
  3. Remediating an expired OAuth grant
  4. Installing a supported browser patch from the vendor

Explanation

Correct Answer

A:

A convincing login replica at a lookalike domain can collect usernames, passwords, and possibly authentication tokens from deceived users.

Incorrect Answers

B:

The observed lure directs users to a login interface; nothing yet indicates DNS-based transport of data.

C:

Grant cleanup happens through trusted identity administration flows, not mass unsolicited links to recently registered domains.

D:

A fake login host has no authority to install browser updates; the message centers on authentication theft rather than signed patch delivery.

Question 34

An attacker repeatedly sends push-login prompts to a user until the user approves one without initiating a sign-in. What social-engineering pattern is this?

  1. A scheduled password-expiration reminder
  2. MFA fatigue or push-notification bombing
  3. ARP cache flooding on a local subnet
  4. A verified help-desk identity proofing process

Explanation

Correct Answer

B:

Repeated unexpected prompts seek to exploit user annoyance and turn an authentication control into an approval of the attacker's session.

Incorrect Answers

A:

Password reminders do not create real second-factor challenges for sign-ins that the legitimate user never initiated.

C:

ARP activity operates at the local network layer and cannot produce authentication app approval requests.

D:

Legitimate support authentication should validate a user-initiated workflow rather than pressure the user to accept unfamiliar prompts.

Question 35

A contractor downloads an unusual volume of sensitive reports shortly before an access termination, using valid credentials. Which hypothesis deserves priority?

  1. An event that can be dismissed because no login failed
  2. A guaranteed network-layer spoofing attack
  3. Potential insider data theft requiring contextual validation
  4. Proof that the file server has been ransomware-encrypted

Explanation

Correct Answer

C:

Authorized access can still be misused; departure timing, volume, classification, and the contractor's role should inform investigation.

Incorrect Answers

A:

Insider misuse often occurs after legitimate authentication, making successful sessions and anomalous data access relevant evidence.

B:

Valid credentials and bulk document retrieval do not by themselves establish spoofed packets or forged network identities.

D:

Reads and downloads are not equivalent to destructive file encryption or extortion artifacts.

Question 36

A developer with repository access quietly changes a build pipeline to send artifacts to an external storage endpoint. What distinguishes this from ordinary access review?

  1. It is only a perimeter firewall firmware problem
  2. It must be a harmless public code review action
  3. Potential misuse of an authorized privileged development process
  4. It establishes that every developer account is compromised

Explanation

Correct Answer

C:

The risk is an authorized user abusing pipeline configuration rights to introduce an unauthorized outbound destination, not necessarily a stolen password.

Incorrect Answers

A:

The observed change originates in the pipeline definition and cannot be explained solely by a network appliance version.

B:

A pull request or repository permission does not make hidden off-site artifact transfer automatically authorized.

D:

One unexplained configuration change warrants scoped investigation, not an unsupported assumption about all identities.

Question 37

A responder finds a fixed SHA-256 hash linked to known malware. Which classification most precisely describes this observation?

  1. A high-level attacker objective or tactic
  2. A file-based indicator of compromise
  3. A guaranteed identifier for every variant in the malware family
  4. A complete timeline of an intrusion

Explanation

Correct Answer

B:

A cryptographic digest can identify exact matching byte content, although adversaries can evade exact-hash matches by changing the file.

Incorrect Answers

A:

A tactic such as persistence describes why an adversary acts; a digest is a concrete observable from a specific artifact.

C:

Small file changes usually change cryptographic digests, so one hash cannot reliably enumerate all variants.

D:

One file hash does not describe the sequence of compromise, execution, and lateral movement events.

Question 38

A newly malicious IP address rapidly changes as a command-and-control service migrates hosts. Which analytic direction is more resilient than relying solely on that address?

  1. Stop collecting endpoint process telemetry
  2. Treat any encrypted connection as confirmed command and control
  3. Identify periodic beaconing and correlate it to process behavior
  4. Extend the old IP block forever without checking reassignment

Explanation

Correct Answer

C:

Behavioral signals can remain useful when infrastructure indicators expire or rotate, although they require good baselines and validation.

Incorrect Answers

A:

Removing host context weakens the analyst's ability to associate outbound connections with the software generating them.

B:

Most legitimate applications use encryption; TLS alone lacks the discriminating context needed for that conclusion.

D:

Addresses can later belong to benign tenants, so static indicators may become stale and cause collateral blocking.

Question 39

Two feeds list the same domain as malicious, but one report is two years old and the other has a recent analyst verification. Which factor should guide use of the indicator?

  1. The indicator with the longer domain spelling
  2. Freshness, confidence, provenance, and relevance to the organization
  3. Alphabetical order of the threat-intelligence feed names
  4. The source that includes the largest number of raw IP addresses

Explanation

Correct Answer

B:

Time-sensitive network indicators can become reassigned; recent verifiable evidence should drive enrichment and blocking decisions.

Incorrect Answers

A:

Domain length has little inherent relationship to reputation or the recency of the supporting malicious activity.

C:

Feed display order conveys no evidence about current control, accuracy, or operational relevance of the domain.

D:

Feed volume does not establish indicator precision; low-quality bulk data can overwhelm triage and produce false positives.

Question 40

An attacker uses valid remote administrative tools to move between systems, then creates scheduled jobs for persistence. Why are TTPs useful here?

  1. They uniquely identify the attacker's legal name and nationality
  2. They replace the need for endpoint or network telemetry
  3. Behavioral patterns persist despite changes to indicators
  4. They guarantee prevention whenever a framework tag is assigned

Explanation

Correct Answer

C:

Techniques such as remote service use and scheduled execution capture recurring operational patterns across different tooling and infrastructure.

Incorrect Answers

A:

Many adversaries share techniques, so TTP overlap is informative but insufficient for conclusive human attribution.

B:

Technique-based detection still requires observations that reveal process, authentication, and network behavior.

D:

A technique label organizes knowledge but does not itself enforce any control or stop execution.

Certified SOC Analyst (312-39) Practice Tests