Free EC-COUNCIL 312-39 Exam Dumps Questions & Answers

Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?

• A.  Incident Recording -> Preparation -> Containment -> Incident Triage -> Recovery -> Eradication -> Post-Incident Activities
• B.  Containment -> Incident Recording -> Incident Triage -> Preparation -> Recovery -> Eradication -> Post-Incident Activities
• C.  Preparation -> Incident Recording -> Incident Triage -> Containment -> Eradication -> Recovery -> Post-Incident Activities
• D.  Incident Triage -> Eradication -> Containment -> Incident Recording -> Preparation -> Recovery -> Post-Incident Activities

A SOC analyst detects multiple instances of powershell.exe being launched with the -ExecutionPolicy Bypass and -NoProfile arguments on a domain controller. The parent process is winrm.exe, and the activity occurs during non-business hours. What should be the analyst's primary focus?

• A.  Investigate Event ID 7045 to determine if a malicious service was created
• B.  Look for Event ID 4625 to check for failed authentication attempts before execution
• C.  Review Event ID 5145 to see if unauthorized network shares were accessed
• D.  Search for Event ID 4688 to find similar PowerShell executions within the last 24 hours

Which of the following steps of incident handling and response process focus on limiting the scope and extent of an incident?

• A.  Containment
• B.  Eradication
• C.  Identification
• D.  Data Collection

Daniel Clark is a cybersecurity specialist in the Cloud SOC for a government agency. His team needs a security solution that can enforce access policies to prevent unauthorized access to cloud-based applications, monitor and restrict data sharing within SaaS, PaaS, and IaaS environments, ensure compliance with government regulations for data security and privacy, and apply security controls to prevent sensitive data exposure in the cloud. Which Cloud SOC technology is his team using?

• A.  Cloud Security Posture Management (CSPM)
• B.  Cloud Access Security Broker (CASB)
• C.  Cloud-native anomaly detection
• D.  Cloud Workload Protection Platform (CWPP)

A SOC team at a major financial institution detects unauthorized access attempts on its web application. Logs indicate the web application is compromised. To determine the exact attack technique and implement mitigation, forensic investigators assess cookie attributes (such as HttpOnly, Secure, and SameSite) for security weaknesses and track anomalous request patterns that deviate from normal user behavior. Which attack vector is the forensic team investigating?

• A.  SQL injection
• B.  Man-in-the-middle (MITM) attack
• C.  Session poisoning
• D.  Cross-site scripting (XSS)