Free Practice Questions for Eccouncil 312-39 Exam

What does the Security Log Event ID 4624 of Windows 10 indicate?

• Service added to the endpoint
• A share was assessed
• An account was successfully logged on
• New process executed

According to the Risk Matrix table, what will be the risk level when the probability of an attack is very low and the impact of that attack is major?

• High
• Extreme
• Low
• Medium

Identify the attack when an attacker by several trial and error can read the contents of a password file present in the restricted etc folder just by manipulating the URL in the browser as shown:

• Directory Traversal Attack
• SQL Injection Attack
• Denial-of-Service Attack
• Form Tampering Attack

Which of the following are the responsibilities of SIEM Agents?1. Collecting data received from various devices sending data to SIEM before forwarding it to the central engine.2. Normalizing data received from various devices sending data to SIEM before forwarding it to the central engine.3. Co-relating data received from various devices sending data to SIEM before forwarding it to the central engine.4. Visualizing data received from various devices sending data to SIEM before forwarding it to the central engine.

• 1 and 2
• 2 and 3
• 1 and 4
• 3 and 1

Which of the following stage executed after identifying the required event sources?

• Identifying the monitoring Requirements
• Defining Rule for the Use Case
• Implementing and Testing the Use Case
• Validating the event source against monitoring requirement

Emmanuel is working as a SOC analyst in a company named Tobey Tech. The manager of Tobey Tech recently recruited an Incident Response Team (IRT) for his company. In the process of collaboration with the IRT, Emmanuel just escalated an incident to the IRT.What is the first step that the IRT will do to the incident escalated by Emmanuel?

• Incident Analysis and Validation
• Incident Recording
• Incident Classification
• Incident Prioritization

Which of the following contains the performance measures, and proper project and time management details?

• Incident Response Policy
• Incident Response Tactics
• Incident Response Process
• Incident Response Procedures

In which phase of Lockheed Martin's -- Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?

• Reconnaissance
• Delivery
• Weaponization
• Exploitation

Which of the following can help you eliminate the burden of investigating false positives?

• Keeping default rules
• Not trusting the security devices
• Treating every alert as high level
• Ingesting the context data

Which of the following is a Threat Intelligence Platform?

• SolarWinds MS
• TC Complete
• Keepnote
• Apility.io