support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-39v2

EC-Council 312-39v2 Exam Actual Questions
Certified SOC Analyst (CSA) v2 (Page 13 )

Updated On: 17-Jul-2026
Page 5 of 26
PDF with 196 Questions

A SIEM alert is triggered due to unusual network traffic involving NetBIOS. The system log shows:
"The TCP/IP NetBIOS Helper service entered the running state." Concurrently, Windows Security Event ID 4624 ("An account was successfully logged on") appears for multiple machines within a short time frame. The logon type is 3 (Network logon).
Which of the following security incidents is the SIEM detecting?

  1. An attacker performing lateral movement within the network
  2. A user connecting to shared files from multiple workstations
  3. A network administrator conducting routine maintenance
  4. A malware infection spreading via SMB protocol

Answer(s): A

Explanation:

The pattern described most strongly indicates lateral movement: multiple network logons (Event ID 4624, Logon Type 3) across multiple machines in a short period, combined with NetBIOS/SMB- related service activity, suggests a host-to-host authentication pattern consistent with an attacker moving through the environment. In SOC terms, Logon Type 3 reflects network-based authentication (commonly SMB, remote service access, admin shares, or remote management).
When the same source account or host triggers many network logons quickly across endpoints--especially outside normal administrative patterns--it often indicates credential abuse (pass-the-hash, stolen credentials, or remote execution frameworks).
While SMB-worm propagation is possible, the scenario emphasizes authentication events across multiple machines rather than explicit malware indicators or file-write propagation patterns. Routine maintenance is plausible only with strong supporting context (approved admin accounts, change windows, known tooling), which is not provided. A single user connecting to shared files typically wouldn't generate a burst of network logons "for multiple machines" in the same way, nor would it usually coincide with suspicious NetBIOS helper state changes as an anomaly. Therefore, the best classification is attacker lateral movement within the network.



A mid-sized hospital's SOC team has recently detected multiple malware incidents that disrupted access to patient records and caused operational inefficiencies. The SOC analysts have been tasked with eradicating current infections and preventing future attacks by addressing the underlying vulnerabilities that allowed the malware to breach defenses. As a SOC analyst, you need to recommend a step that directly targets weaknesses in the hospital's network infrastructure or system configurations exploited by the malware.
Which eradication step would best address these root causes?

  1. Fixing devices
  2. Using antivirus tools for quarantine
  3. Updating the malware database with vendor signatures
  4. Implementing blacklist techniques for file execution

Answer(s): A

Explanation:

Eradication is about removing the threat and eliminating the conditions that allowed it to persist or recur. "Fixing devices" best aligns with addressing root causes because it implies remediating exploited weaknesses: patching vulnerable software, correcting misconfigurations, removing persistence mechanisms, hardening endpoints/servers, and restoring secure baselines. In healthcare environments, malware frequently exploits unpatched systems, exposed services, weak segmentation, permissive scripting policies, or inadequate least privilege. Quarantining with antivirus is helpful for immediate removal but may not eliminate the exploited vulnerability or persistence path; attackers can reinfect if the underlying gap remains. Updating signatures improves detection for known malware but does not address a misconfiguration or missing patch and will not reliably stop novel variants. Blacklisting file execution can reduce risk but is typically a partial, reactive control and can be bypassed by renaming, living-off-the-land tools, or script-based payloads. From a SOC analyst perspective, the most durable eradication action is to "fix the device" by restoring trusted configuration and closing the exploit vector, combined with validation scans and monitoring to confirm the environment is clean and hardened.



The SOC team at CyberSecure Corp is conducting a security review to identify anomalous log entries from firewall logs. The team needs to extract patterns such as email addresses, IP addresses, and URLs to detect unauthorized access attempts, phishing activities, and suspicious external communications. The SOC analyst applies various regular expressions (regex) patterns to filter and analyze logs efficiently. For example, they use \b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b to match IPv4 addresses.
Which regex pattern should the SOC analyst use to extract all hexadecimal color codes found in the logs?

  1. (0[1-9]|1[0-2])/(0[1-9]|(1[0-2])/[0-9]|3[01])\d{4}
  2. ([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})
  3. [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}
  4. \b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b

Answer(s): B

Explanation:

Hex color codes in common usage are represented as either 3 hex characters (shorthand) or 6 hex characters (full), typically composed of digits 0­9 and letters A­F (case-insensitive). Option B, ([A-Fa- f0-9]{6}|[A-Fa-f0-9]{3}), directly matches either a 6-character hex sequence or a 3-character hex sequence and is the only option that targets hexadecimal character sets and lengths relevant to color codes. In SOC log parsing, regex is frequently used to extract structured tokens from semi-structured text logs so that fields can be normalized and queried. Option C is an email pattern, and option D is an IPv4 pattern. Option A appears to be a date-like pattern and is unrelated to hex.
While many hex color codes are prefixed with "#", this question's option set focuses on the hex portion itself. In practice, analysts often refine such patterns to include boundaries or the "#" prefix depending on log content, but among the provided choices, B is the correct regex for extracting hexadecimal color codes.



As a Threat Hunter at a cybersecurity company, you notice several endpoints experiencing unusual outbound traffic to an unfamiliar IP address. The traffic is encrypted and occurs in small bursts at irregular intervals. There are no known IoCs associated with the destination, and traditional security tools have not flagged it as malicious. You decide to launch a threat-hunting initiative to determine whether this is an advanced persistent threat (APT) using sophisticated techniques to evade detection. The goal is to identify potential Indicators of Attack (IoAs) and map them against known adversary behaviors.
What type of threat hunting approach is best suited for this situation?

  1. Unstructured hunting
  2. Situational or entity-driven hunting
  3. Reactive hunting
  4. Structured hunting

Answer(s): A

Explanation:

Unstructured hunting is best suited when you have a weak but concerning signal (like unusual encrypted bursts to an unfamiliar IP) without a clear hypothesis tied to a known technique or indicator. In this scenario, there are no known IoCs and no alert from traditional tools, so the hunt starts from an intuition-driven anomaly and develops into hypotheses through exploration:
examining which hosts are involved, what processes initiate connections, whether destinations vary, whether the behavior aligns with legitimate business tooling, and whether there are associated persistence or credential access signals. This is characteristic of unstructured hunts--analyst-driven exploration based on suspicious observations. Structured hunting typically starts with a defined hypothesis or known adversary behavior mapped to a framework and uses planned queries to confirm or refute it. Situational/entity-driven hunting focuses on a specific entity (a VIP user, crown- jewel server) or a known incident context. Reactive hunting is driven by alerts or confirmed incidents. Here, the hunt is prompted by an anomaly without predefined IoCs or alerts, making unstructured hunting the most appropriate approach to uncover IoAs and then map findings to adversary behaviors.



The Security Operations Center (SOC) team is investigating a suspected malware incident during the Analysis Phase of their incident response process. Their primary goal is to validate the initial detection, ensure the threat is real, and gather critical intelligence to understand the scope of the attack.
Which action should the SOC team take to confirm initial findings and eliminate false alarms?

  1. Verify generated logs
  2. Verify false positives
  3. Scan the enterprise environment and update the scope
  4. Root-cause analysis

Answer(s): B

Explanation:

During the Analysis phase, one of the first SOC objectives is to validate that the alert reflects malicious activity rather than benign behavior. "Verify false positives" most directly captures this:
analysts review alert evidence, confirm telemetry correctness, validate the triggering conditions, and look for corroborating artifacts (process lineage, file hashes, network connections, user actions) to decide whether the alert is a true positive. This prevents wasted effort and reduces disruption from unnecessary containment actions. "Verify generated logs" is too vague; log verification is a supporting activity, but the decision point is determining whether the detection is a false positive or a real incident. Scanning the enterprise and updating scope is typically done after initial validation confirms the threat, because scoping consumes resources and should be targeted. Root-cause analysis usually comes later, once you have confirmed the incident and stabilized containment, since RCA requires deeper investigation and often broader evidence collection. In SOC practice, validating false positives early improves response quality and ensures subsequent scoping and containment are justified and proportionate.



TechSolutions, a software development firm, discovered a potential data leak after an external security researcher reported finding sensitive customer data on a public code repository. Level 1 SOC analysts confirmed the presence of the data and escalated the issue. Level 2 analysts traced the source of the leak to an internal network account. The incident response team has been alerted, and the CISO demands a comprehensive analysis of the incident, including the extent of the data breach and the timeline of events. The SOC manager must decide whom to assign to the in-depth investigation. To accurately determine the timeline, extent, and root cause of the data leak, which SOC role is critical in gathering and analyzing digital evidence?

  1. SOC Manager
  2. Subject Matter Expert
  3. Threat Intelligence Analyst
  4. Forensic Analyst

Answer(s): D

Explanation:

A forensic analyst is the role best suited to perform in-depth evidence gathering and analysis required to reconstruct timelines, determine scope, and establish root cause for a data leak. This work includes preserving evidence (ensuring integrity), collecting endpoint and server artifacts, reviewing authentication and repository access logs, correlating commit history with identity and device telemetry, and building a defensible chain of events for leadership and potential legal/regulatory review. The SOC manager coordinates resources and priorities but typically does not perform hands-on forensic reconstruction. A subject matter expert may provide domain expertise (e.g., on Git workflows, cloud platforms, or database systems), but forensic rigor and evidence handling are the core requirement here. A threat intelligence analyst focuses on external adversary information, campaigns, and indicators; they can assist with context but are not the primary role for internal evidence reconstruction. Because the CISO needs timeline, extent, and root cause-- deliverables that depend on digital evidence handling and forensic methodology--the forensic analyst is the critical assignment.



The SOC team is investigating a phishing attack that targeted multiple employees. During the Containment Phase, they need to determine how users interacted with the malicious email: whether they opened it, clicked links, downloaded attachments, or entered credentials. This information is critical to assessing impact and preventing further compromise.
Which specific activity helps the SOC team understand user interactions with the phishing email?

  1. Monitoring and containment validation
  2. Malware infection check
  3. User action verification
  4. Blocking command-and-control (C2) and email traffic

Answer(s): C

Explanation:

User action verification is the activity that directly answers "what did users do with the phishing message?" In SOC containment, you need to rapidly determine exposure: who opened the email, who clicked the URL, who opened an attachment, and who submitted credentials. This drives priority actions such as password resets, session revocation, MFA re-registration, endpoint isolation, URL/domain blocking, mailbox searches for similar messages, and targeted user notifications. Monitoring/containment validation confirms whether containment actions are effective (e.g., blocks are working, incidents aren't spreading), but it does not specifically measure user interaction steps. Malware infection checks assess whether an endpoint is infected--useful if an attachment executed--but it comes after confirming interaction and is not the primary method to understand email engagement. Blocking C2 and email traffic is an active containment control, but it doesn't provide the "who clicked/opened" understanding needed to scope impacted users. SOC analysts typically use email gateway telemetry, message trace, safe links/safe attachments logs, and identity sign-in logs to verify user actions. Because the question is explicitly about understanding user interactions, "User action verification" is the best match.



You are working at Tech Solutions, a global technology firm. Your team detects an adversary attempting to bypass authentication controls and escalate privileges within the enterprise network. To counter the threat, you implement credential encryption, behavioral analytics, and process isolation. Your approach follows a structured framework that systematically maps defensive techniques to known adversarial tactics, allowing you to anticipate and mitigate evolving cyber threats.
Which framework did you choose to apply in this scenario?

  1. Systems Security Engineering CMM
  2. MITRE D3FEND Framework
  3. Cybersecurity Capability Maturity Model
  4. NIST Cybersecurity Framework 2.0

Answer(s): B

Explanation:

MITRE D3FEND is specifically designed to map defensive techniques to offensive adversary behaviors and tactics. In SOC and detection engineering, it provides a structured defensive ontology: you can identify an adversary technique (credential access, privilege escalation, defense evasion) and then select defensive countermeasures such as credential hardening, process isolation, monitoring/behavior analytics, and access control enforcement. The scenario describes a framework that "systematically maps defensive techniques to known adversarial tactics," which aligns directly with D3FEND's purpose. The other options are broader governance or maturity models rather than a defensive technique-mapping framework. Systems Security Engineering CMM and Cybersecurity Capability Maturity Models focus on process maturity and organizational capability development, not on mapping defensive controls to adversary behavior at a technique level. NIST CSF 2.0 is a high- level cybersecurity risk management framework organized around functions (govern, identify, protect, detect, respond, recover); it guides program structure but does not provide the same granular defensive technique taxonomy. Therefore, MITRE D3FEND is the correct choice for a structured, technique-to-defense mapping approach.



  PDF
Viewing page 13 of 26
Viewing questions 97 - 104 out of 196 questions


Post your Comments and Discuss EC-Council 312-39v2 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!