ECCouncil 312-39 Exam Questions and Answers, Certified SOC Analyst

Question #1

Bonney's system has been compromised by a gruesome malware. What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

A. Complaint to police in a formal way regarding the incident

B. Turn off the infected machine

C. Leave it to the network administrators to handle

D. Call the legal department in the organization and inform about the incident

View answer

Correct Answer: B

Question #2

Which one of the following is the correct flow for Setting Up a Computer Forensics Lab?

A. Planning and budgeting –> Physical location and structural design considerations –> Work area considerations –> Human resource considerations –> Physical security recommendations –> Forensics lab licensing

B. Planning and budgeting –> Physical location and structural design considerations–> Forensics lab licensing –> Human resource considerations –> Work area considerations –> Physical security recommendations

C. Planning and budgeting –> Forensics lab licensing –> Physical location and structural design considerations –> Work area considerations –> Physical security recommendations –> Human resource considerations

D. Planning and budgeting –> Physical location and structural design considerations –> Forensics lab licensing –>Work area considerations –> Human resource considerations –> Physical security recommendations

View answer

Correct Answer: A

Question #3

Ray is a SOC analyst in a company named Queens Tech. One Day, Queens Tech is affected by a DoS/DDoS attack. For the containment of this incident, Ray and his team are trying to provide additional bandwidth to the network devices and increasing the capacity of the servers. What is Ray and his team doing?

A. Blocking the Attacks

B. Diverting the Traffic

C. Degrading the services

D. Absorbing the Attack

View answer

Correct Answer: D

Question #4

Which of the following threat intelligence is used by a SIEM for supplying the analysts with context and "situational awareness" by using threat actor TTPs, malware campaigns, tools used by threat actors. 1.Strategic threat intelligence 2.Tactical threat intelligence 3.Operational threat intelligence 4.Technical threat intelligence

A. 2 and 3

B. 1 and 3

C. 1 and 2

D. 3 and 4

View answer

Correct Answer: A

Question #5

Which of the following process refers to the discarding of the packets at the routing level without informing the source that the data did not reach its intended recipient?

A. Load Balancing

B. Rate Limiting

C. Black Hole Filtering

D. Drop Requests

View answer

Correct Answer: C

Question #6

According to the forensics investigation process, what is the next step carried out right after collecting the evidence?

A. Create a Chain of Custody Document

B. Send it to the nearby police station

C. Set a Forensic lab

D. Call Organizational Disciplinary Team

View answer

Correct Answer: A

Question #7

Which of the following directory will contain logs related to printer access?

A. /var/log/cups/Printer_log file

B. /var/log/cups/access_log file

C. /var/log/cups/accesslog file

D. /var/log/cups/Printeraccess_log file

View answer

Correct Answer: B

Question #8

Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?

A. Containment -> Incident Recording -> Incident Triage -> Preparation -> Recovery -> Eradication -> Post-Incident Activities

B. Preparation -> Incident Recording -> Incident Triage -> Containment -> Eradication -> Recovery -> Post-Incident Activities

C. Incident Triage -> Eradication -> Containment -> Incident Recording -> Preparation -> Recovery -> Post-Incident Activities

D. Incident Recording -> Preparation -> Containment -> Incident Triage -> Recovery -> Eradication -> Post-Incident Activities

View answer

Correct Answer: B

Question #9

Which of the following directory will contain logs related to printer access?

A. /var/log/cups/Printer_log file

B. /var/log/cups/access_log file

C. /var/log/cups/accesslog file

D. /var/log/cups/Printeraccess_log file

View answer

Correct Answer: A

Question #10

Which of the following fields in Windows logs defines the type of event occurred, such as Correlation Hint, Response Time, SQM, WDI Context, and so on?

A. Keywords

B. Task Category

C. Level

D. Source

View answer

Correct Answer: B

Question #11

Which encoding replaces unusual ASCII characters with "%" followed by the character’s two-digit ASCII code expressed in hexadecimal?

A. Unicode Encoding

B. UTF Encoding

C. Base64 Encoding

D. URL Encoding

View answer

Correct Answer: D

Question #12

According to the forensics investigation process, what is the next step carried out right after collecting the evidence?

A. Create a Chain of Custody Document

B. Send it to the nearby police station

C. Set a Forensic lab

D. Call Organizational Disciplinary Team

View answer

Correct Answer: A

Question #13

Identify the attack when an attacker by several trial and error can read the contents of a password file present in the restricted etc folder just by manipulating the URL in the browser as shown: http://www.terabytes.com/process.php./../../../../etc/passwd

A. Directory Traversal Attack

B. SQL Injection Attack

C. Denial-of-Service Attack

D. Form Tampering Attack

View answer

Correct Answer: B

Question #14

Which of the following formula represents the risk?

A. Risk = Likelihood × Severity × Asset Value

B. Risk = Likelihood × Consequence × Severity

C. Risk = Likelihood × Impact × Severity

D. Risk = Likelihood × Impact × Asset Value

View answer

Correct Answer: B

Question #15

Bonney's system has been compromised by a gruesome malware. What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

A. Complaint to police in a formal way regarding the incident

B. Turn off the infected machine

C. Leave it to the network administrators to handle

D. Call the legal department in the organization and inform about the incident

View answer

Correct Answer: B

Question #16

The Syslog message severity levels are labelled from level 0 to level 7. What does level 0 indicate?

A. Alert

B. Notification

C. Emergency

D. Debugging

View answer

Correct Answer: B

Question #17

The threat intelligence, which will help you, understand adversary intent and make informed decision to ensure appropriate security in alignment with risk. What kind of threat intelligence described above?

A. Tactical Threat Intelligence

B. Strategic Threat Intelligence

C. Functional Threat Intelligence

D. Operational Threat Intelligence

View answer

Correct Answer: B

Question #18

Which of the following command is used to enable logging in iptables?

A. $ iptables -B INPUT -j LOG

B. $ iptables -A OUTPUT -j LOG

C. $ iptables -A INPUT -j LOG

D. $ iptables -B OUTPUT -j LOG

View answer

Correct Answer: B

Question #19

Which one of the following is the correct flow for Setting Up a Computer Forensics Lab?

A. Planning and budgeting –> Physical location and structural design considerations –> Work area considerations –> Human resource considerations –> Physical security recommendations –> Forensics lab licensing

B. Planning and budgeting –> Physical location and structural design considerations–> Forensics lab licensing –> Human resource considerations –> Work area considerations –> Physical security recommendations

C. Planning and budgeting –> Forensics lab licensing –> Physical location and structural design considerations –> Work area considerations –> Physical security recommendations –> Human resource considerations

D. Planning and budgeting –> Physical location and structural design considerations –> Forensics lab licensing –>Work area considerations –> Human resource considerations –> Physical security recommendations

View answer

Correct Answer: A

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

ECCouncil 312-39 Exam Questions and Answers, Certified SOC Analyst | SPOTO

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

ECCouncil 312-39 Exam Questions and Answers, Certified SOC Analyst | SPOTO

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now