Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-39 (Certified SOC Analyst) Practice Test 8

Question 70

A Linux SSH service rejects repeated logins from one source. Where should an analyst begin on a distribution that records authentication through the conventional auth log?

  1. The swap file because it retains a complete history of SSH sessions
  2. The system authentication log or the journal for that distribution
  3. Only a web-server access log for HTTP requests
  4. Only /etc/passwd because it contains failed login timestamps

Explanation

Correct Answer

B:

sshd authentication messages usually include user, source, and failure reason, but Linux logging paths differ by distribution and configuration.

Incorrect Answers

A:

Swap may contain incidental memory fragments but is not a dependable or purpose-built authentication event log.

C:

HTTP access records do not normally capture authentication attempts to the SSH daemon on a separate service.

D:

The account database provides user metadata; it is not the chronological audit trail of each rejected SSH attempt.

Question 71

A suspicious Linux account runs an administrative command using sudo. Which evidence best identifies the authorized command and actor?

  1. DNS query cache statistics only
  2. The machine's last boot banner alone
  3. A firewall deny counter without process context
  4. sudo authentication records of the executed command

Explanation

Correct Answer

D:

sudo commonly records user, target account, command, and terminal context, enabling review of elevated actions.

Incorrect Answers

A:

Name resolution metrics cannot show which shell command an operator executed with elevated privileges.

B:

Boot messages describe startup, not user-specific privilege delegation and individual command executions.

C:

A network packet counter cannot establish the username or shell command that invoked sudo.

Question 72

A server team must generate detailed records of system-call access to a sensitive file rather than rely on application text logs. Which Linux facility is appropriate?

  1. auditd rules configured for the target file operations
  2. The shell history file for every process and user
  3. Syslog severity filtering alone
  4. The hosts file used for local name resolution

Explanation

Correct Answer

A:

Kernel audit rules can capture configured access and execution events with identity and syscall context, subject to tuning and storage capacity.

Incorrect Answers

B:

Interactive history is incomplete, modifiable, and does not reliably cover daemon or programmatic file access.

C:

Syslog forwards messages produced by programs; it does not automatically create detailed kernel file-access audit records.

D:

Host-to-address mappings do not provide a security audit trail of filesystem operations.

Question 73

Investigators need to query systemd-managed service messages for a specific boot on a modern Linux host. Which facility is designed for this?

  1. journalctl filtered to the relevant boot and unit
  2. The SSH known_hosts file
  3. Only the sudoers policy configuration file
  4. An ARP cache dump from the host

Explanation

Correct Answer

A:

The journal indexes service and boot metadata, allowing scoped examination when the needed entries remain available.

Incorrect Answers

B:

Known-host keys support server identity checking and do not store the systemd journal for local services.

C:

sudoers describes allowed elevation policies rather than a chronological archive of systemd service messages.

D:

Neighbor cache records local network address mappings, not service launch errors or log messages.

Question 74

A Linux log file grows until it fills its partition. Which operational mechanism is meant to archive and rotate text logs by policy?

  1. A recursive DNS resolver configuration
  2. logrotate for policy-based log rotation
  3. The Linux ping utility
  4. A process priority adjustment through nice

Explanation

Correct Answer

B:

Rotation limits active file growth, supports scheduled retention, and must be coordinated with the service writing the log.

Incorrect Answers

A:

DNS settings influence name queries, not the lifecycle of local application log files.

C:

ICMP echo testing checks connectivity and does not manage file sizes or log archival policies.

D:

Priority can affect CPU scheduling but does not prevent an append-only log from exhausting disk space.

Question 75

A Linux host may have logged kernel errors just before an unexpected device disconnect. Which source is most directly relevant?

  1. An identity provider's user provisioning report
  2. Kernel messages in dmesg or the system journal
  3. Only the application's HTTP request body archive
  4. The browser bookmark database for the primary user

Explanation

Correct Answer

B:

Driver, hardware, and kernel diagnostic messages can explain low-level resets or faults when the records have not been overwritten.

Incorrect Answers

A:

Account lifecycle reports cannot establish the operating system's low-level device and driver events.

C:

Request data may describe web activity but does not directly reveal driver or kernel-level device faults.

D:

Browser bookmarks provide browsing preferences and are unrelated to kernel hardware error messages.

Question 76

A Mac endpoint investigation needs recent process and system subsystem messages using Apple's native structured logging system. What should the analyst query?

  1. Windows Event Viewer Security log as the Mac's native source
  2. A DNS zone file stored on a corporate name server
  3. macOS unified logs through its log tooling
  4. A firewall configuration screenshot with no timestamps

Explanation

Correct Answer

C:

Unified logs can be filtered by time, process, or subsystem, with privacy and retention behavior affecting visibility.

Incorrect Answers

A:

Event Viewer is a Windows logging interface and does not serve as the principal Mac unified-log reader.

B:

DNS zone data is authoritative resolution information and does not contain the Mac's local system event history.

D:

A configuration screenshot can show policy but not the time-ordered endpoint messages needed for process investigation.

Question 77

A firewall denies inbound connection attempts to a database server. Which minimum fields make its log most useful for incident correlation?

  1. Collect source and destination IP addresses and ports but remove all event timestamps
  2. Export monthly packet counts by IP without preserving individual decisions or protocols
  3. Timestamp, source and destination IPs, ports, protocol, and action
  4. Collect firewall appliance and rule IDs but omit source and destination network addresses

Explanation

Correct Answer

C:

These fields establish who attempted which network service at what time and whether the policy allowed or rejected it.

Incorrect Answers

A:

Address and port fields identify a possible flow, but discarding time prevents analysts from relating the denied connection to a login, exploit attempt, or session.

B:

Aggregate traffic summaries can reveal volume trends, but they discard per-attempt timing, rule action, and protocol details needed to build an incident timeline.

D:

Appliance and rule identifiers help locate configuration, but without communicating endpoints the record cannot be reliably matched to a specific attempted database connection.

Question 78

A firewall performs source NAT for many clients, making different internal hosts appear as one public IP. What log detail is essential for tracing a suspicious external session back to the client?

  1. Only the externally visible shared public address
  2. Only the target website's certificate expiration date
  3. The NAT translation mapping with time and source port
  4. Only the firewall's configuration revision number

Explanation

Correct Answer

C:

Public address alone may represent many users, so timestamped pre- and post-translation tuples are necessary for attribution.

Incorrect Answers

A:

The translated address is ambiguous for multiple concurrent internal clients unless a session mapping is available.

B:

Certificate validity cannot reconstruct the NAT session mapping between the external flow and internal requester.

D:

Policy version can matter but does not reveal which internal socket used a translated public connection.

Question 79

A router exports NetFlow or IPFIX records during a suspected data theft. What can the analyst infer reliably from flow metadata?

  1. The exact confidential document text transmitted inside TLS
  2. Flow peers, protocol, duration, and byte counts
  3. The user's complete keyboard sequence during the session
  4. The precise malware binary hash from the remote endpoint

Explanation

Correct Answer

B:

Flow summaries show traffic relationships and volume useful for spotting unusual transfers, but generally not the application payload contents.

Incorrect Answers

A:

Flow records are metadata summaries and do not decrypt encrypted payloads or reveal full document content.

C:

Router flow telemetry does not capture operating-system input events or typed commands.

D:

File hashes require content or endpoint evidence; byte counters in network flows do not uniquely identify executables.

Question 80

An analyst is correlating suspicious domain lookups across endpoints. Which field in DNS resolver logs helps identify the internal requester?

  1. Client IP, DNS question and corresponding timestamp
  2. Only the DNS server's TLS certificate subject
  3. Only the top-level domain's popularity rank
  4. Only the resolver software's installation date

Explanation

Correct Answer

A:

Requester and response details distinguish which asset made the lookup and whether the name resolved or failed.

Incorrect Answers

B:

Certificate identity does not substitute for per-query client information and request timestamps.

C:

Popularity enrichment may affect triage but does not attribute the query to a source host.

D:

Software age gives platform context but cannot identify the endpoint responsible for a specific DNS request.

Certified SOC Analyst (312-39) Practice Tests