312-39v2 Practice Test practice questions, page 4 of 8, with answer review and explanations.
Question 16
A security team is tasked with configuring a newly deployed SIEM system. With limited resources, they must prioritize specific monitoring scenarios that provide the greatest security benefit. The team understands that an effective SIEM relies on well-defined use cases tailored to the organization's environment. Given the evolving threat landscape, they must carefully choose which use cases to implement first to maximize value and threat detection capabilities. Which factor should guide their selection of use cases?
Focus on use cases required to meet industry compliance standards.
Select use cases based on the availability and quality of data from existing data sources.
Prioritize use cases that address zero day attacks.
Implement as many use cases as the SIEM supports to cover all threats.
Question 17
Bob is a SOC analyst in a multinational corporation that relies on a centralized file-sharing system for storing confidential project documents. One morning, he notices that few critical financial records stored on the shared server appear to have been altered without authorization. Upon further analysis, he discovers that the version history confirms unexpected changes made outside of business hours. Now he must investigate by inspecting the logs. Which log should he check to determine who accessed the files and when the modifications occurred?
Authentication logs
Firewall logs
Security logs
Network logs
Question 18
SecureTech Inc., a leading cybersecurity-focused organization, operates its critical infrastructure and applications in AWS. The Security Operations Center (SOC) team is responsible for detecting, investigating, and mitigating security threats within their cloud environment. Recently, the SOC team has observed an increase in suspicious activities, such as unexpected API calls, unusual outbound traffic from instances, and DNS requests to potentially malicious domains. To enhance their threat detection capabilities, they need a fully managed AWS security service that can continuously monitor for malicious activity across their AWS environment, analyze AWS CloudTrail logs, VPC Flow Logs, and DNS query logs, leverage machine learning and threat intelligence to identify advanced threats, and provide actionable security findings to accelerate response efforts. Which AWS service is best suited to help SecureTech Inc. proactively detect and respond to security threats in their AWS environment?
AWS Config
Amazon GuardDuty
AWS Security Hub
Amazon Macie
Question 19
As a SOC Administrator at a mid-sized financial institution, you noticed intermittent network slowdowns and unexplained high memory usage across multiple critical systems. Your initial analysis found no traces of malware, but a forensic investigation revealed unauthorized scheduled tasks that executed during off-peak hours. These tasks ran obfuscated scripts that connected to an external C2 server. Further investigations showed that the adversary had gained access months ago through a compromised VPN account, leveraging stolen credentials from a phishing campaign. Which phase of the Advanced Persistent Threat (APT) lifecycle does this scenario align with?
Persistence
Cleanup
Search and Exfiltration
Initial Intrusion
Question 20
An organization with a complex IT infrastructure is planning to implement a SIEM solution to improve its threat detection and response capabilities. Due to the scale and complexity of its systems, the organization opts for a phased deployment approach to ensure a smooth implementation and reduce potential risks. Which of the following should be the first phase in their SIEM deployment strategy?
Configure security analytics to identify potential threats
Set up the log management component before deploying the SIEM component
Implement User and Entity Behavior Analytics (UEBA)