Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 40

Question 390

A security analyst must detect and prioritize publicly accessible storage and noncompliant AWS configuration controls. Which complementary AWS capability is most directly aligned?

  1. Amazon GuardDuty threat findings without configuration posture control assessments
  2. An AWS Config recorder enabled with no suitable rule evaluations or findings workflow
  3. CloudTrail Lake queries limited to cloud API history instead of posture-control evaluations
  4. AWS Security Hub CSPM security standards and posture-control findings

Explanation

Correct Answer

D:

The cloud security posture management capability evaluates configured security controls and exposes misconfiguration or compliance-oriented findings.

Incorrect Answers

A:

GuardDuty detects signs of malicious activity and compromised resources. Misconfiguration and standards-based posture checks require a complementary control-evaluation mechanism.

B:

Recording configuration state creates useful evidence, but it does not automatically deliver prioritized standards-oriented posture findings unless the evaluations and workflow are configured.

C:

CloudTrail Lake helps analyze recorded AWS activity, but API history alone does not compute every configuration-control compliance finding across in-scope resources.

Question 391

During an AWS cloud intrusion, an analyst needs to identify which instance initiated repeated connections to an unusual external IP. What is the key capability and limitation of VPC Flow Logs?

  1. Flow metadata for monitored interfaces, not packet contents
  2. VPC Flow Logs provide the guest process command line responsible for each connection
  3. VPC Flow Logs identify the assumed-role principal for every AWS management API call
  4. VPC Flow Logs contain decrypted HTTP bodies when HTTPS traffic traverses a gateway

Explanation

Correct Answer

A:

Flow records help correlate endpoints, ports, bytes, and accept or reject decisions, while other logs are needed to inspect transmitted files.

Incorrect Answers

B:

A network interface flow record lacks the local process lineage and shell arguments needed for host attribution; pair the flows with workload or EDR telemetry.

C:

IP communication does not establish AWS API caller identity. CloudTrail userIdentity and session context are necessary to attribute actions performed using assumed roles.

D:

The flow-log schema records connection metadata, not recovered encrypted application content. Decrypted payload analysis requires other properly authorized instrumentation.

Question 392

The SOC suspects a stolen IAM role accessed specific confidential S3 objects. Which three pieces of evidence or configuration are most useful? Choose THREE.

  1. An assumption that every bucket automatically retains all object-level CloudTrail events
  2. A declaration that server-side encryption proves the object was never read
  3. The role session and principal context associated with the API calls
  4. CloudTrail management events for role creation without S3 object-level data records
  5. CloudTrail S3 object-level data events enabled for the relevant resources and time range
  6. Object names, event timestamps, source addresses, and related transfer context

Explanation

Correct Answers

C:

Temporary assumed-role credentials require attribution to the role session and originating principal wherever evidence permits.

E:

Object-level API events can identify operations such as GetObject when the appropriate data-event logging was configured.

F:

These fields can help assess which objects were accessed, when, and from where, while avoiding unsupported exfiltration claims.

Incorrect Answers

A:

S3 data-event coverage depends on explicit configuration and retention; it must be verified before drawing conclusions.

B:

Encryption at rest does not rule out authorized-looking reads made using compromised credentials.

D:

Management events can show role changes, but they are not a substitute for enabled S3 object data events when reconstructing specific reads and writes.

Question 393

A SOC wants GuardDuty findings automatically routed to an existing response workflow with approvals for disruptive actions. Which architecture is appropriate?

  1. Export a daily CSV of findings and require analysts to manually execute containment
  2. Route findings through EventBridge into an approved workflow
  3. Give every GuardDuty finding permission to delete its associated account automatically
  4. Enable additional GuardDuty detectors but omit event routing and incident workflow integration

Explanation

Correct Answer

B:

Event-driven routing can connect GuardDuty detections to triage and response while separate approval controls govern host isolation or credential revocation.

Incorrect Answers

A:

A manual daily export loses timely event-driven triage and can omit approval traceability. Controlled routing and authorization checks are preferable for operational response.

C:

Unconditional destructive actions create unacceptable false-positive and business-continuity risks.

D:

Detector coverage is useful, yet it does not deliver findings to the established ticket and approval processes without a routing or workflow connection.

Question 394

Several AWS accounts and Regions host production workloads. Which two practices most improve central SOC coverage? Choose TWO.

  1. Disable logging in low-traffic Regions because they can never host attacker activity
  2. Configure organization-aware security monitoring and aggregate supported findings across accounts and Regions
  3. Share the organization root credentials among all SOC analysts
  4. Validate that audit, detector, and retention settings are actually enabled in every in-scope Region and account
  5. Assume the management account automatically captures every guest operating-system command

Explanation

Correct Answers

B:

Coverage in one account or Region may not reveal activity in another; aggregation and delegated administration improve organization-wide triage.

D:

Central dashboards can mislead when source logging or detection is absent, so coverage checks must examine the underlying telemetry.

Incorrect Answers

A:

Unmonitored Regions can be abused to create resources and evade an organization with partial visibility.

C:

Shared root privileges eliminate individual accountability and violate least-privilege security practices.

E:

Cloud account administration does not provide guest execution logs without appropriate agents and logging configuration.

Question 395

An administrator grants a highly privileged Google Cloud IAM role to an unfamiliar principal. Which telemetry should be examined first?

  1. Cloud DNS query logs for the project during the privilege assignment period
  2. Cloud Audit Logs Admin Activity for IAM changes and actor
  3. VPC Flow Logs from Compute Engine instances in the affected project
  4. Cloud Audit Logs Data Access entries for reads of application data objects

Explanation

Correct Answer

B:

Administrative audit records can show role-grant operations, caller identity, affected resource, and timing for investigation.

Incorrect Answers

A:

DNS requests can support an intrusion timeline but do not directly record IAM permission changes or the actor who submitted the policy update.

C:

Network flows may show connections to Google APIs, but they do not reliably identify the principal and exact IAM policy write that added a privileged role.

D:

Data Access records help investigate who read or wrote protected data. IAM policy modifications are administrative configuration events, making Admin Activity the more direct source.

Question 396

Google Cloud Security Command Center reports an Event Threat Detection finding for an anomalous IAM privilege grant. What is the best interpretation?

  1. Validate the finding against underlying cloud audit records
  2. Treat the finding as conclusive proof that confidential files were downloaded
  3. Disable the relevant detector until an exfiltration event is independently confirmed
  4. Close the finding because no matching endpoint malware alert is present

Explanation

Correct Answer

A:

Security Command Center findings guide triage; evidence such as IAM change details, identity, and surrounding activity establishes scope and response.

Incorrect Answers

B:

A privilege-grant detection indicates suspicious authorization change, not necessarily object access or data theft.

C:

Privilege-escalation or persistence detections may precede data theft. Suspending the detector removes an early warning and obscures additional related IAM actions.

D:

A suspicious cloud IAM grant may represent identity-only persistence. Endpoint agents cannot provide complete coverage for cloud API misuse, so the finding needs audit corroboration.

Question 397

A SOC is ingesting endpoint, DNS, identity, and Google Cloud audit events into Google Security Operations. What enables searches across the different original field formats?

  1. Index the original JSON for every source without mapping the identity or event fields
  2. Rename source parsers to a common convention while retaining incompatible field meanings
  3. Normalized representations such as Google SecOps Unified Data Model (UDM) events
  4. Convert every source timestamp to a display-only string and omit the original time basis

Explanation

Correct Answer

C:

Normalization maps heterogeneous source fields into common entities and attributes, supporting consistent detections and cross-source investigation.

Incorrect Answers

A:

Raw ingestion preserves evidence, but source-specific fields make cross-product searches inconsistent; UDM normalization supplies shared semantics for common investigations.

B:

Consistent parser names improve administration but do not map distinct actor, target, process, or network attributes into an interoperable event model.

D:

A time string alone does not normalize disparate event types, and losing timezone precision can break ordered correlations across cloud, endpoint, and DNS records.

Question 398

Google Cloud VPC Flow Logs sampling is enabled for a VM subnet. A host-based sensor reports a brief suspicious UDP exchange, but the analyst finds no matching flow record. What should the analyst conclude?

  1. VPC Flow Logs expose decrypted application payloads for every TLS flow
  2. Missing sampled flow logs do not disprove a brief exchange
  3. VPC Flow Logs attribute every management API update to a Google Cloud IAM principal
  4. VPC Flow Logs record guest process command lines for every outgoing socket

Explanation

Correct Answer

B:

Google Cloud sampling and aggregation settings affect completeness. A negative result in flow logs should be interpreted against the configured coverage and other sources.

Incorrect Answers

A:

Even when the connection is logged, metadata does not reveal TLS-protected document contents. Packet capture with authorized decryption or endpoint evidence would be required.

C:

Flow records can describe traffic, but Cloud Audit Logs supply principal and method details for a resource or IAM configuration change.

D:

Flow records are generated from network-traffic observation rather than guest process auditing; a workload security agent may be needed to associate traffic with command execution.

Question 399

A team moves an application to a managed cloud service and assumes that the provider will automatically detect compromise in the application credentials. What should the SOC clarify?

  1. Customer-side logging, identity and alerting under shared responsibility
  2. Depend on default cloud log retention without identifying which data-access events are enabled
  3. Limit the cloud incident plan to hypervisor and physical infrastructure failures
  4. Delegate all application identity and permission reviews to the cloud provider

Explanation

Correct Answer

A:

Cloud providers secure underlying infrastructure, but customer responsibilities commonly include permissions, data use, app controls, and enabling or configuring appropriate monitoring.

Incorrect Answers

B:

Some data-access streams require explicit configuration, and retention periods differ. Unverified defaults can leave the SOC unable to reconstruct a cloud credential incident.

C:

The provider handles much of the physical layer, while customer-impacting attacks often exploit cloud identities, application configuration, secrets, and exposed workloads.

D:

Providers secure the underlying platform but typically do not decide which customer principals should hold application roles or whether those roles were compromised.

Question 400

A suspicious public IP appears in AWS CloudTrail, Azure sign-in logs, and Google Cloud Audit Logs. Which investigation approach avoids false cross-cloud attribution?

  1. Correlate identity, session, resource, action and timestamp across clouds
  2. Correlate only exact original JSON field names across the three provider schemas
  3. Attribute the three event clusters to a single attacker based only on matching source IP
  4. Discard events that share the source IP and timestamp before comparing account context

Explanation

Correct Answer

A:

An IP can be shared or reused; reliable cross-cloud attribution requires aligned identity and action evidence rather than an address match alone.

Incorrect Answers

B:

AWS, Azure, and Google Cloud express identity and operations with different structures. Semantic field mapping is required to compare comparable behaviors.

C:

Cloud services can see the same NAT, proxy, VPN, or shared internet egress. Identity, session, target, and action evidence are needed before linking the activity.

D:

The apparent duplicates may be independent provider-side actions or separate API calls. Preserve source identifiers and evidence until true duplicates are established.

Certified SOC Analyst (312-39) Practice Tests