최신EC-COUNCIL Certified SOC Analyst (CSA) - 312-39무료샘플문제
문제1
Mark Reynolds, a SOC analyst at a global financial institution, is working on the eradication phase after detecting phishing attacks targeting employees. To ensure attackers cannot reuse malicious infrastructure, Mark implements a technique that blocks known malicious IP addresses used for sending spam emails at the Domain Name System (DNS) level. Which technique is best suited?
Mark Reynolds, a SOC analyst at a global financial institution, is working on the eradication phase after detecting phishing attacks targeting employees. To ensure attackers cannot reuse malicious infrastructure, Mark implements a technique that blocks known malicious IP addresses used for sending spam emails at the Domain Name System (DNS) level. Which technique is best suited?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제2
The SOC team is investigating a phishing attack that targeted multiple employees. During the Containment Phase, they need to determine how users interacted with the malicious email: whether they opened it, clicked links, downloaded attachments, or entered credentials. This information is critical to assessing impact and preventing further compromise. Which specific activity helps the SOC team understand user interactions with the phishing email?
The SOC team is investigating a phishing attack that targeted multiple employees. During the Containment Phase, they need to determine how users interacted with the malicious email: whether they opened it, clicked links, downloaded attachments, or entered credentials. This information is critical to assessing impact and preventing further compromise. Which specific activity helps the SOC team understand user interactions with the phishing email?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제3
A multinational cybersecurity firm wants to enhance its threat intelligence capabilities by integrating real-time threat feeds into Microsoft Sentinel. These feeds include malicious IPs, domains, file hashes, and attack patterns. The firm requires a standardized protocol that allows automated threat intelligence sharing so Sentinel continuously receives updated indicators from external sources in a structured format. Which Microsoft Sentinel data connector should be implemented to integrate threat intelligence feeds using an industry-standard protocol?
A multinational cybersecurity firm wants to enhance its threat intelligence capabilities by integrating real-time threat feeds into Microsoft Sentinel. These feeds include malicious IPs, domains, file hashes, and attack patterns. The firm requires a standardized protocol that allows automated threat intelligence sharing so Sentinel continuously receives updated indicators from external sources in a structured format. Which Microsoft Sentinel data connector should be implemented to integrate threat intelligence feeds using an industry-standard protocol?
정답: A
설명: (KoreaDumps 회원만 볼 수 있음)
문제4
The team receives an alert about a ransomware incident affecting the organization's email infrastructure.
Forensic analysis identifies the ransomware exploited CVE-2024-0123 in an unpatched mail server. The incident response team is deploying an emergency patch (KB5025941), updating mail filtering rules to block malicious payloads, and implementing additional network segmentation to limit lateral movement. Which phase of the Incident Response process is the SOC currently executing?
The team receives an alert about a ransomware incident affecting the organization's email infrastructure.
Forensic analysis identifies the ransomware exploited CVE-2024-0123 in an unpatched mail server. The incident response team is deploying an emergency patch (KB5025941), updating mail filtering rules to block malicious payloads, and implementing additional network segmentation to limit lateral movement. Which phase of the Incident Response process is the SOC currently executing?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제5
Which of the following tool can be used to filter web requests associated with the SQL Injection attack?
Which of the following tool can be used to filter web requests associated with the SQL Injection attack?
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제6
SecureTech Solutions, a managed security service provider (MSSP), is optimizing its log management architecture to enhance log storage, retrieval, and analysis efficiency. The SOC team needs logs stored in a structured or semi-structured format for easy parsing, querying, and correlation. They choose a format that organizes data in a text file in a tabular structure, where each log entry is stored in rows and columns, and that supports easy export to databases or spreadsheet analysis while maintaining readability. Which log format should they choose?
SecureTech Solutions, a managed security service provider (MSSP), is optimizing its log management architecture to enhance log storage, retrieval, and analysis efficiency. The SOC team needs logs stored in a structured or semi-structured format for easy parsing, querying, and correlation. They choose a format that organizes data in a text file in a tabular structure, where each log entry is stored in rows and columns, and that supports easy export to databases or spreadsheet analysis while maintaining readability. Which log format should they choose?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제7
Identify the event severity level in Windows logs for the events that are not necessarily significant, but may indicate a possible future problem.
Identify the event severity level in Windows logs for the events that are not necessarily significant, but may indicate a possible future problem.
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제8
Which of the following stage executed after identifying the required event sources?
Which of the following stage executed after identifying the required event sources?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제9
Which of the following data source will a SOC Analyst use to monitor connections to the insecure ports?
Which of the following data source will a SOC Analyst use to monitor connections to the insecure ports?
정답: D
설명: (KoreaDumps 회원만 볼 수 있음)
문제10
At GlobalTech, the SOC team detects a suspicious ransomware outbreak affecting multiple endpoints. After successfully isolating the infected systems from the network, the Digital Forensics team begins their investigation. They deploy a forensics workstation to acquire RAM dumps, extract Windows Event Logs, and collect network PCAP files from the compromised hosts. Which phase of the Incident Response lifecycle is currently underway?
At GlobalTech, the SOC team detects a suspicious ransomware outbreak affecting multiple endpoints. After successfully isolating the infected systems from the network, the Digital Forensics team begins their investigation. They deploy a forensics workstation to acquire RAM dumps, extract Windows Event Logs, and collect network PCAP files from the compromised hosts. Which phase of the Incident Response lifecycle is currently underway?
정답: B
설명: (KoreaDumps 회원만 볼 수 있음)
문제11
Which of the following formula represents the risk levels?
Which of the following formula represents the risk levels?
정답: A
설명: (KoreaDumps 회원만 볼 수 있음)
문제12
Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company and wanted to check the logs that are generated by access control list numbered 210.
What filter should Peter add to the 'show logging' command to get the required output?
Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company and wanted to check the logs that are generated by access control list numbered 210.
What filter should Peter add to the 'show logging' command to get the required output?
정답: A
설명: (KoreaDumps 회원만 볼 수 있음)