312-39 Sample Questions & Answers

True. According to the Lockheed Martin Cyber Kill Chain model, the 'Installation' phase, where malware establishes persistence on the victim's system, precedes the 'Command and Control' (C2) phase. During the C2 phase, the installed malware 'calls home' to the attacker's infrastructure to receive instructions. Persistence must be established first to ensure the C2 channel can be maintained.

The Eradication phase of the incident response lifecycle focuses on completely removing the threat from the environment. This includes deleting the malware, removing persistence mechanisms (like registry keys or scheduled tasks), and eliminating any other tools or backdoors left by the attacker. Isolation is part of Containment, restoring data is part of Recovery, and lessons learned is the final post-incident phase.

This query correctly filters for the specific Windows event for a successful logon (EventCode=4624), then uses the iplocation command to enrich the events with geographic data based on the source IP address (src_ip). Finally, it uses a search command to filter those enriched events to show only those where the Country field is not equal to 'US'. The other options are incorrect or less efficient.

A data tiering strategy is the industry-standard solution for balancing performance and cost in long-term log retention. Logs are kept in expensive, high-performance 'hot' storage for a short period (e.g., 30-90 days) for immediate analysis. After that, they are moved to cheaper, slower 'warm' or 'cold' storage (like AWS S3 Glacier or an on-premise NAS). This meets the compliance requirement for retention without the exorbitant cost of keeping all data in hot storage. Data can still be re-ingested or queried from cold storage if needed for a forensic investigation, albeit more slowly.

This scenario describes a specific Tactic, Technique, and Procedure (TTP). The tactic is 'Persistence' or 'Defense Evasion', the technique is 'Valid Accounts', and the specific procedure is the use of a dormant account to access resources. An IoC is the evidence itself (e.g., the log entry), not the methodology. Zero-day and DoS are types of attacks, but the concept of using a dormant account is a classic TTP employed by attackers to blend in and avoid detection.

The primary advantage of a 'follow-the-sun' model is its ability to provide continuous, 24/7 security monitoring by handing off operations between geographically distributed teams. As one team's business day ends, another team's day begins, ensuring that alerts are always handled by an active, alert team working regular business hours. This avoids the analyst burnout and potential for error associated with overnight shifts.

This is a classic example of a Command Injection attack. The attacker is using a semicolon (;) to terminate the expected parameter (id=123) and inject a new, arbitrary operating system command (cat /etc/passwd). If the backend application is vulnerable, it will execute this command on the server, potentially revealing the contents of the password file. SQL injection involves database commands, while XSS involves injecting scripts into a web page to be executed by a user's browser.

The SOC is in the Detection and Analysis phase. The UEBA system has detected a potential incident based on anomalous behavior, and the SOC's role is now to analyze this alert to determine if it is a true positive (e.g., a compromised account) or a false positive (e.g., the doctor was legitimately working late). This analysis must happen before moving to Containment. Preparation involves getting tools and processes ready, which has already been done.

True. Log normalization is the process of parsing logs from different sources and converting them into a common format (like the Splunk Common Information Model - CIM). For example, a Cisco firewall might log a source IP as src_ip, while a Palo Alto firewall logs it as source_address. Normalization maps both fields to a common field, like src. This allows a single correlation rule, such as search src=1.2.3.4, to work on data from both vendors, dramatically simplifying rule creation and management.

This is a classic example of DNS Tunneling. Attackers abuse the DNS protocol to establish a command-and-control (C2) channel or exfiltrate data. Since DNS traffic (port 53) is almost always allowed through firewalls, it provides a covert channel. Large data transfers over DNS are highly anomalous and a strong indicator of this technique. A DNS amplification attack is a type of DDoS, and Fast-Flux is a technique to hide C2 servers behind a rapidly changing set of IPs.