312-39v2 Practice Test practice questions, page 7 of 8, with answer review and explanations.
Question 31
A large financial institution receives thousands of security logs daily from firewalls, IDS systems, and user authentication platforms. The SOC team uses an AI-driven SIEM system with NLP capabilities to streamline threat detection. This approach enables faster response times, reduces manual rule creation, and helps detect advanced threats that traditional systems might overlook. Which of the following BEST illustrates the advantage of NLP in SIEM?
Enables analysis of text-based data from logs and communications to detect threats
Eliminates the need for data normalization and correlation in SIEM systems
Allows security analysts to write SIEM rules using complex programming languages
Simplifies infrastructure management by reducing hardware dependencies
Question 32
A large financial organization has recently experienced an increase in sophisticated cyber threats, including zero-day attacks and advanced persistent threats (APTs). The security team is struggling with traditional detection methods, which rely heavily on signature-based detection and manual intervention, causing delays in identifying and mitigating threats. To enhance their security posture, the Chief Information Security Officer (CISO) is exploring AI-driven solutions that can automatically analyze vast datasets, detect anomalies, and adapt to evolving threats in real time. The goal is to implement a system that can identify suspicious activity without predefined signatures, allowing for faster response times and minimal human oversight. Which key AI technology should the organization focus on to achieve this?
Natural Language Processing (NLP)
Heuristic-based Signature Detection
Machine Learning (ML)
Static IP Blocking
Question 33
CyberBank, a leading financial institution, has recently experienced a series of cyberattacks, including phishing campaigns, insider threats, and attempted data breaches targeting customer financial records. The bank operates across multiple regions, making it vulnerable to regional compliance violations, fraud attempts, and advanced persistent threats (APTs). During a board meeting, the CISO proposes a security solution that offers continuous security monitoring, rapid threat detection, and centralized visibility across all branches. Which of the following solution will provide automated alerting, digital forensics capabilities, and active threat hunting?
Implementing Security Operation Center (SOC)
Deploying a standalone SIEM (Security Information and Event Management) system
Implementing SOAR (Security Orchestration, Automation, and Response)
Implementing periodic security audit
Question 34
A SOC analyst receives an alert indicating that the system time on a critical Windows server was changed at 3:00 AM. There are no scheduled maintenance tasks at this time. Unauthorized time changes can be used to evade security controls, such as altering timestamps to obscure malicious activity. The analyst must identify the relevant event codes that log system time modifications and related suspicious behavior. Which of the following Windows Security Event Codes should the analyst review to investigate potential tampering?
4625 and 4634
4616 and 4618
4616 and 4624
4608 and 4609
Question 35
A security analyst working in a multinational corporation's Threat Intelligence team is tasked with enhancing the organization's ability to detect stealthy malware infections. During an investigation, the analyst observes an unusually high volume of DNS requests directed toward domains that follow patterns commonly associated with Domain Generation Algorithms (DGAs). Recognizing that these automated domain queries could indicate a malware strain attempting to establish communication with its Command & Control (C2) infrastructure, the analyst realizes that existing detection capabilities may not be sufficient. To effectively counter such threats, the security team needs to define intelligence requirements – including identifying critical data sources, refining detection criteria, and improving threat monitoring strategies. Which stage of the Cyber Threat Intelligence (CTI) process does this scenario align with?