312-39v2 Practice Test practice questions, page 8 of 8, with answer review and explanations.
Question 36
A large financial institution, SOC has recently identified a sophisticated phishing campaign targeting its employees, resulting in unauthorized access to sensitive customer data. The SOC team is under pressure to enhance their detection and response capabilities to manage this evolving threat. The organization already uses a SIEM system for log aggregation and alerting, alongside an EDR solution for endpoint visibility. Additionally, they have access to XDR for broader threat detection and XSOAR for security orchestration and automation. As a SOC analyst, you’ve been asked to recommend an integration strategy to improve real-time threat correlation, streamline incident response workflows, and maximize the use of existing tools. Which of the following integrations would meet these goals?
Integrate XDR with SIEM
Integrate XDR with XSOAR
Integrate EDR with XSOAR
Integrate EDR with SIEM
Question 37
Global Bank, a large financial institution, relies heavily on Microsoft Azure to host its critical banking applications and services, including customer transactions, financial data processing, and risk assessment systems. Given the highly regulated nature of the banking industry, the security operation center team must ensure continuous monitoring, compliance with financial regulations, and real-time threat detection across all Azure resources. To achieve this, the team requires a comprehensive solution that can collect, analyze, and visualize telemetry data from various cloud resources, virtual machines, storage accounts, and applications. The solution must also integrate seamlessly with their security tools, allowing them to detect anomalies, monitor performance, and respond proactively to potential security threats. Which Azure service is best suited to in the given situation?
Azure Monitor
Azure Policy
Azure Firewall
Azure Active Directory
Question 38
DNS logs in the SIEM show an internal host sending many DNS queries with long, encoded subdomains to an external domain. The queries predominantly use TXT records and occur during off-business hours. The external domain is newly registered and has no known business association. Which of the following best explains this behaviour?
Monitoring DNS cache poisoning attempts
Detecting rogue DNS servers within the internal network
Validating DNS records for legitimate business operations
Identifying DNS tunneling for data exfiltration
Question 39
Jennifer, a SOC analyst, initiates an investigation after receiving an alert about potential unauthorized activity on Marcus's workstation. She starts by retrieving EDR logs from the endpoint, analyzing network traffic patterns in the Security Information and Event Management (SIEM) system, and inspecting email gateway logs for signs of malicious attachments. Her objective is to determine whether this alert represents a legitimate security incident. In which phase of the Incident Response process is Jennifer currently operating?