Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 7

Question 60

A defender wants to review Kerberos service ticket requests for unusual access to privileged services. Which event is relevant on domain controllers when auditing is enabled?

  1. 1102, which records Security log clearing
  2. 4625 alone, which records a generic failed logon
  3. 4688 alone, which records process creation
  4. 4769, a Kerberos service ticket request

Explanation

Correct Answer

D:

Service-ticket request records can show account, service, and ticket characteristics used to detect anomalies such as unusual service access.

Incorrect Answers

A:

Log clearing is a tampering signal, not the issuance or request of a Kerberos service ticket.

B:

Failed logons may supply context, but they are not a dedicated view of Kerberos service-ticket issuance.

C:

Process starts on endpoints do not directly replace domain-controller records for Kerberos service-ticket requests.

Question 61

A domain controller records numerous failed Kerberos preauthentication attempts for one account. Which Security event can expose this class of failure?

  1. 4771, Kerberos pre-authentication failure
  2. 4720, creation of a new domain user
  3. 4634, completion of a logoff
  4. 4769, a requested service ticket

Explanation

Correct Answer

A:

Event data can identify the client and failure details so an analyst can distinguish likely mistyping from repeated attack-driven guesses.

Incorrect Answers

B:

User provisioning does not describe preauthentication outcomes for an existing identity.

C:

Logoff tracking does not reveal why a Kerberos request was rejected before an authenticated session existed.

D:

Service ticket activity occurs later in the Kerberos flow and is not the dedicated preauthentication failure event.

Question 62

An administrator signs in as one account but launches a connection using different supplied credentials. Which Windows audit event helps identify the explicit-credential use?

  1. Windows event 4648 for explicit credentials
  2. 4740, an account lockout
  3. 1102, cleared audit history
  4. 4634, a completed logoff

Explanation

Correct Answer

A:

The event can show an account context in which alternate credentials were supplied, supporting investigation of credential misuse.

Incorrect Answers

B:

Lockouts may result from failures, but the event does not itself denote explicit credentials being used from another session.

C:

An audit-log-clear event cannot identify which credentials a process supplied to an external target.

D:

Session termination does not specifically describe using alternate credentials for access to another service.

Question 63

A Windows Security event shows ID 4672 immediately after a logon. How should an analyst use it?

  1. Assume it is an event that every anonymous user receives
  2. Treat it as definitive evidence of ransomware file encryption
  3. Ignore it because successful logons cannot be security-relevant
  4. Check whether special privileges granted at logon are expected

Explanation

Correct Answer

D:

The event often accompanies administrative sessions; it provides context, not by itself proof of malicious privilege escalation.

Incorrect Answers

A:

The audit is tied to special privileges in a logon, making identity and privilege context important.

B:

Special logon privileges do not establish file modification or ransom impact without other supporting artifacts.

C:

Privileged session establishment is often meaningful when correlated with source, timing, and subsequent administrative actions.

Question 64

An auditor needs evidence that a sensitive file was accessed under a configured Windows object-access audit policy. Which event is relevant?

  1. Security Event ID 1102, cleared audit log
  2. Windows Security event 4663 for audited object access
  3. Security Event ID 4720, account creation
  4. Security Event ID 4625, a failed sign-in

Explanation

Correct Answer

B:

With appropriate object audit settings, the event records access to files or other objects and can support investigation of sensitive activity.

Incorrect Answers

A:

Log clearing has separate significance and cannot identify the specific file access requested by the auditor.

C:

Identity provisioning does not record object-level file operations against a protected directory.

D:

A failed sign-in does not demonstrate that a process reached a protected file and exercised object access.

Question 65

A team wants the content of PowerShell script blocks used in suspicious automation, when supported policy is enabled. Which logging capability is most useful?

  1. PowerShell Script Block Logging (Event 4104)
  2. Only the Security log's account-lockout events
  3. Only the firewall's accepted packet counters
  4. Only Windows DNS Client cache statistics

Explanation

Correct Answer

A:

Script-block records can preserve executed PowerShell content for investigation, subject to configuration and coverage limitations.

Incorrect Answers

B:

Lockout records concern authentication failures and cannot reconstruct PowerShell command content.

C:

Network counters show traffic quantities, not the script expressions that invoked a command interpreter.

D:

DNS cache observations can reveal contacted names but not the actual PowerShell script body responsible for activity.

Question 66

Sysmon is deployed with process creation collection enabled. Which Sysmon event can show process lineage including image path and command line?

  1. Sysmon Event ID 22 for DNS queries
  2. Sysmon Event ID 3 for a network connection
  3. Sysmon Event ID 1 for process creation
  4. Sysmon Event ID 11 for file creation

Explanation

Correct Answer

C:

Sysmon can capture parent process, hashes, and execution metadata that complement native Windows audit events when correctly configured.

Incorrect Answers

A:

DNS query telemetry provides name resolution associated with activity, not the start of a new process.

B:

Network connection events associate processes with flows but are not the primary process-created records.

D:

File creation may link to malware staging but does not itself provide a complete process start and lineage record.

Question 67

An investigator wants to link a Windows process to a suspicious outbound connection using Sysmon. Which event is relevant if network logging is enabled?

  1. Sysmon Event ID 22 for DNS query only
  2. Sysmon Event ID 11 for a created file
  3. Sysmon Event ID 3 for network connection telemetry
  4. Sysmon Event ID 1 for process creation alone

Explanation

Correct Answer

C:

The event can connect process identifiers and images to endpoints and ports, helping attribute traffic to its initiating software.

Incorrect Answers

A:

Name queries may precede traffic, but a successful DNS lookup does not guarantee a socket connection occurred.

B:

File-creation records do not directly describe the local and remote addresses of a connection.

D:

Process-start evidence is useful context but does not by itself identify a particular outbound network connection.

Question 68

A malware investigation needs endpoint evidence of the DNS names requested by processes. Which Sysmon event is relevant when supported and enabled?

  1. Sysmon Event ID 11 for newly created files
  2. Sysmon Event ID 22 for DNS query records
  3. Sysmon Event ID 1 as the complete DNS record
  4. Security Event ID 4728 for group membership changes

Explanation

Correct Answer

B:

Process-associated DNS queries help tie suspicious name resolution to specific execution contexts, although logging configurations matter.

Incorrect Answers

A:

File-creation telemetry can reveal dropped artifacts but not the DNS questions issued by a process.

C:

Process starts establish execution context, not every domain that process subsequently resolved.

D:

Group changes are identity administration evidence and do not represent DNS lookup activity.

Question 69

Endpoints are centrally forwarding Windows events to a collector through a native Microsoft feature. Which capability is most directly involved?

  1. A standalone Windows Task Manager session
  2. A browser's downloaded-files history alone
  3. A DHCP lease reservation list
  4. Windows Event Forwarding subscriptions

Explanation

Correct Answer

D:

WEF transports selected event channels to a central Windows Event Collector, supporting scalable monitoring without scraping each console manually.

Incorrect Answers

A:

Task Manager inspects local resource usage and cannot operate as a centralized event subscription service.

B:

Browser artifacts do not continuously gather system and Security events from multiple managed hosts.

C:

DHCP allocations map devices to addresses; they do not forward security log records to a central analysis point.

Question 70

A Linux SSH service rejects repeated logins from one source. Where should an analyst begin on a distribution that records authentication through the conventional auth log?

  1. The swap file because it retains a complete history of SSH sessions
  2. The system authentication log or the journal for that distribution
  3. Only a web-server access log for HTTP requests
  4. Only /etc/passwd because it contains failed login timestamps

Explanation

Correct Answer

B:

sshd authentication messages usually include user, source, and failure reason, but Linux logging paths differ by distribution and configuration.

Incorrect Answers

A:

Swap may contain incidental memory fragments but is not a dependable or purpose-built authentication event log.

C:

HTTP access records do not normally capture authentication attempts to the SSH daemon on a separate service.

D:

The account database provides user metadata; it is not the chronological audit trail of each rejected SSH attempt.

Certified SOC Analyst (312-39) Practice Tests