Certified SOC Analyst CSA 312-39 Exam Questions

dumps2021-12-07T03:32:39+08:00

Certified SOC Analyst CSA 312-39 exam can help you validate comprehensive understanding of the job tasks required as a SOC analyst. All the best EC-Council 312-39 exam questions are the best material for you to test the skills. In real CSA 312-39 exam, there are 100 questions, and you have 3 hours to finish the test. The required passing score of EC-Council 312-39 exam is 70%. The test format is Multiple choice. Free Certified SOC Analyst 312-39 exam questions are available below.

Page 1 of 4

1. Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?

Containment C> Incident Recording C> Incident Triage C> Preparation C> Recovery C> Eradication C> Post-Incident Activities

Preparation C> Incident Recording C> Incident Triage C> Containment C> Eradication C> Recovery C> Post-Incident Activities

Incident Triage C> Eradication C> Containment C> Incident Recording C> Preparation C> Recovery C> Post-Incident Activities

Incident Recording C> Preparation C> Containment C> Incident Triage C> Recovery C> Eradication C> Post-Incident Activities

2. Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?

$ tailf /var/log/sys/kern.log

$ tailf /var/log/kern.log

# tailf /var/log/messages

# tailf /var/log/sys/messages

3. An organization wants to implement a SIEM deployment architecture. However, they have the capability to do only log collection and the rest of the SIEM functions must be managed by an MSSP.

Which SIEM deployment architecture will the organization adopt?

Cloud, MSSP Managed

Self-hosted, Jointly Managed

Self-hosted, MSSP Managed

Self-hosted, Self-Managed

4. Jony, a security analyst, while monitoring IIS logs, identified events shown in the figure below.

What does this event log indicate?

Parameter Tampering Attack

XSS Attack

Directory Traversal Attack

SQL Injection Attack

5. Which of the following technique protects from flooding attacks originated from the valid prefixes (IP addresses) so that they can be traced to its true source?

Rate Limiting

Egress Filtering

Ingress Filtering

Throttling

6. Which of the following threat intelligence helps cyber security professionals such as security operations managers, network operations center and incident responders to understand how the adversaries are expected to perform the attack on the organization, and the technical capabilities and goals of the attackers along with the attack vectors?

Analytical Threat Intelligence

Operational Threat Intelligence

Strategic Threat Intelligence

Tactical Threat Intelligence

7. Juliea a SOC analyst, while monitoring logs, noticed large TXT, NULL payloads.

What does this indicate?

Concurrent VPN Connections Attempt

DNS Exfiltration Attempt

Covering Tracks Attempt

DHCP Starvation Attempt

8. Which encoding replaces unusual ASCII characters with "%" followed by the character’s two-digit ASCII code expressed in hexadecimal?

Unicode Encoding

UTF Encoding

Base64 Encoding

URL Encoding

9. Chloe, a SOC analyst with Jake Tech, is checking Linux systems logs. She is investigating files at /var/log/wtmp.

What Chloe is looking at?

Error log

System boot log

General message and system-related stuff

10. Properly applied cyber threat intelligence to the SOC team help them in discovering TTPs.

What does these TTPs refer to?

Tactics, Techniques, and Procedures

Tactics, Threats, and Procedures

Targets, Threats, and Process

Tactics, Targets, and Process

Page 2 of 4

11. Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company and wanted to check the logs that are generated by access control list numbered 210.

What filter should Peter add to the 'show logging' command to get the required output?

show logging | access 210

show logging | forward 210

show logging | include 210

show logging | route 210

12. Which of the following Windows Event Id will help you monitors file sharing across the network?

7045

4625

5140

4624

13. Which of the following factors determine the choice of SIEM architecture?

SMTP Configuration

DHCP Configuration

DNS Configuration

Network Topology

14. Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.

Dictionary Attack

Rainbow Table Attack

Bruteforce Attack

Syllable Attack

15. InfoSystem LLC, a US-based company, is establishing an in-house SOC. John has been given the responsibility to finalize strategy, policies, and procedures for the SOC.

Identify the job role of John.

Security Analyst C L1

Chief Information Security Officer (CISO)

Security Engineer

Security Analyst C L2

16. Which of the following data source will a SOC Analyst use to monitor connections to the insecure ports?

Netstat Data

DNS Data

IIS Data

DHCP Data

17. Which of the following event detection techniques uses User and Entity Behavior Analytics (UEBA)?

Rule-based detection

Heuristic-based detection

Anomaly-based detection

Signature-based detection

18. Identify the HTTP status codes that represents the server error.

2XX

4XX

1XX

5XX

19. An organization is implementing and deploying the SIEM with following capabilities.

What kind of SIEM deployment architecture the organization is planning to implement?

Cloud, MSSP Managed

Self-hosted, Jointly Managed

Self-hosted, Self-Managed

Self-hosted, MSSP Managed

20. 1.Jane, a security analyst, while analyzing IDS logs, detected an event matching Regex /((%3C)|<)((%69)|i|(% 49))((%6D)|m|(%4D))((%67)|g|(%47))[^n]+((%3E)|>)/|.

What does this event log indicate?

Directory Traversal Attack

Parameter Tampering Attack

XSS Attack

SQL Injection Attack

Page 3 of 4

21. Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.

Where will Harley find the web server logs, if he wants to investigate them for any anomalies?

SystemDrive%inetpublogsLogFilesW3SVCN

SystemDrive%LogFilesinetpublogsW3SVCN

%SystemDrive%LogFileslogsW3SVCN

SystemDrive% inetpubLogFileslogsW3SVCN

22. Which of the following tool can be used to filter web requests associated with the SQL Injection attack?

Nmap

UrlScan

ZAP proxy

Hydra

23. Identify the type of attack, an attacker is attempting on www.example.com website.

Cross-site Scripting Attack

Session Attack

Denial-of-Service Attack

SQL Injection Attack

24. What type of event is recorded when an application driver loads successfully in Windows?

Error

Success Audit

Warning

Information

25. Which of the following formula is used to calculate the EPS of the organization?

EPS = average number of correlated events /time in seconds

EPS = number of normalized events /time in seconds

EPS = number of security events /time in seconds

EPS = number of correlated events /time in seconds

26. John, a SOC analyst, while monitoring and analyzing Apache web server logs, identified an event log matching Regex /(.|(%|%25)2E)(.|(%|%25)2E)(/|(%|%25)2F|\|(%|%25)5C)/i.

What does this event log indicate?

XSS Attack

SQL injection Attack

Directory Traversal Attack

Parameter Tampering Attack

27. In which of the following incident handling and response stages, the root cause of the incident must be found from the forensic results?

Evidence Gathering

Evidence Handling

Eradication

Systems Recovery

28. What does the HTTP status codes 1XX represents?

Informational message

Client error

Success

Redirection

29. Sam, a security analyst with INFOSOL INC., while monitoring and analyzing IIS logs, detected an event matching regex /\w*((%27)|(’))((%6F)|o|(%4F))((%72)|r|(%52))/ix.

What does this event log indicate?

SQL Injection Attack

Parameter Tampering Attack

XSS Attack

Directory Traversal Attack

30. Which of the following attack can be eradicated by converting all non-alphanumeric characters to HTML character entities before displaying the user input in search engines and forums?

Broken Access Control Attacks

Web Services Attacks

XSS Attacks

Session Management Attacks

Page 4 of 4

31. What does the Security Log Event ID 4624 of Windows 10 indicate?

Service added to the endpoint

A share was assessed

An account was successfully logged on

New process executed

Certified SOC Analyst CSA 312-39 Exam Questions