Eccouncil Certified SOC Analyst v2 312-39 Exam Questions

Answer : C

To filter the output of the 'show logging' command to include entries related to a specific access control list, Peter should use the 'include' keyword followed by the access list number. The correct command would be 'show logging | include 210'. This command will display all log entries that contain the string '210', which is the number of the access control list he wants to monitor.

References:The use of the 'include' keyword in Cisco router commands is a standard method for filtering show command outputs to display only lines that contain a specified string or pattern.This is covered in Cisco's documentation and training materials related to router commands and access control list management12.

Answer : C

The described pattern is highly consistent with DNS tunneling used for command-and-control or data exfiltration. Long, encoded subdomains are commonly used to embed data into DNS queries because DNS labels can carry arbitrary text that can be base32/base64/hex encoded. TXT records are frequently abused in tunneling because they can return larger payloads and are flexible for exchanging data between malware and an external resolver or authoritative DNS infrastructure controlled by an attacker. The fact that this occurs off-hours and targets a newly registered domain with no business relationship increases suspicion and reduces the likelihood of legitimate use. DNS cache poisoning attempts would typically show anomalies in resolver behavior, unexpected DNS responses, or mismatched records, not a high volume of encoded outbound queries from a single internal host. Rogue DNS servers would present as internal hosts acting as resolvers or responding to many DNS queries, not sending encoded TXT queries outward. Legitimate record validation might involve standard query types (A/AAAA/CNAME) and normal domain names, not long encoded subdomains. For SOC triage, the next steps would include identifying the originating process/host, blocking the domain, capturing related network flows, and scoping for other hosts with similar DNS patterns.

Answer : D

The core problem described is that the SOC is treating raw indicators (IoCs) as if they are actionable intelligence (CTI), without enough context to prioritize. IoCs are often low-context, high-volume, and time-sensitive; many are noisy, shared infrastructure, or already outdated. CTI (cyber threat intelligence) adds context---adversary, campaign, intent, targeting, confidence, and recommended actions---so analysts can decide what matters for their environment. The scenario explicitly states the alerts ''lack critical context'' and the team ''lacks tools and intelligence to correlate IoCs with real-world threats,'' which is fundamentally a failure to distinguish IoC data from intelligence. Information overload is a symptom, but the underlying challenge is that the organization is ingesting IoCs without intelligence enrichment and prioritization logic. Budget/skill can contribute, but the question asks for the greatest challenge given the described conditions. From a SOC perspective, solving this requires enrichment (TI platforms, reputation + context), correlation with internal telemetry, scoring based on relevance, and focusing on behaviors and impact rather than indicator volume alone. Therefore, distinguishing IoC from CTI is the best answer.

Answer : B

Planning and budgeting:This is the initial phase where you determine the scope, objectives, and financial resources available for the lab.

Physical location and structural design considerations:Selecting a suitable location and designing the lab to meet operational needs and security requirements.

Work area considerations:Organizing the space efficiently for different tasks such as evidence analysis, storage, and administrative work.

Human resource considerations:Identifying the roles, responsibilities, and qualifications required for lab personnel.

Physical security recommendations:Implementing measures to protect sensitive data and physical assets within the lab.

Forensics lab licensing:Ensuring that the lab and its personnel are compliant with relevant laws, regulations, and industry standards.

References:While I can't refer to specific EC-Council SOC Analyst courses or study guides, these steps are generally accepted as part of the process for setting up a computer forensics lab. For detailed guidance, it's best to consult the official EC-Council resources and materials provided for the SOC Analyst certification.

Answer : B

In the context of a threat intelligence strategy plan, 'threat trending' is a critical component that should be included to make the plan effective. Threat trending involves analyzing data over time to identify patterns and trends in cyber threats. This allows an organization to anticipate potential future attacks and prepare accordingly. It is an essential part of a proactive threat intelligence program, enabling the organization to stay ahead of threats rather than just reacting to them.

The other options, while they may be relevant in certain contexts, are not as central to the development of a threat intelligence strategy plan as 'threat trending' is. 'Threat pivoting' refers to the process of using one piece of data to uncover more data (e.g., using an IP address to find related domains). 'Threat buy-in' is not a standard term in threat intelligence, but it could refer to gaining organizational support for threat intelligence efforts. 'Threat boosting' is not a recognized term in the field of cybersecurity.

References:The answer is derived from the components of a threat intelligence strategy as outlined in the EC-Council's Certified SOC Analyst (CSA) training and certification program, which emphasizes the importance of understanding and implementing a threat intelligence-driven SOC12.The CSA program also covers the use of threat intelligence for enhanced incident detection1.The EC-Council materials highlight the need for SOC analysts to understand various types of cyber threats and the importance of threat intelligence in detecting and responding to these threats2.

Answer : C

To meet the stated needs---collecting, analyzing, correlating, and alerting---log management and security analytics is the core SIEM capability set. Log management covers ingestion, parsing, normalization, storage, retention, and search. Security analytics covers detection rules, correlations, behavioral analytics, alerting, and dashboards that turn raw events into actionable incidents. These functions are essential for identifying potential HIPAA violations (unauthorized access, anomalous data access, improper privilege use) and producing timely alerts and audit evidence. ''Centralized SIEM implementation'' is an architectural statement rather than a capability; centralization helps but doesn't describe the functions needed. ''Log collection through agents'' is one ingestion method and is important for coverage, but by itself it doesn't provide analysis and correlation. Threat hunting and intelligence are valuable enhancements, but the requirement described is the baseline SIEM function: manage logs and apply analytics to detect and alert. From a SOC standpoint, this also supports compliance because strong log management with tuned analytics enables both real-time incident response and retrospective investigations with reliable retention and audit trails.

Answer : B

This is the ''Post-Incident Activities'' phase, commonly known as lessons learned or post-incident review. The defining elements are present: the incident is already over (one week later), stakeholders are reviewing the timeline, calculating business impact, and identifying improvements to processes and controls. In SOC practice, this phase focuses on improving readiness and reducing recurrence by documenting what happened, what worked, what failed, and what should change. Typical outputs include updated playbooks/runbooks, improved detection logic, better alert triage workflows, logging and telemetry enhancements, refined escalation paths, improved backup/restore procedures, and training actions. Recovery is about restoring services and operations (rebuild systems, restore data, validate return-to-service), which is not the primary activity described. Eradication is removing the threat from the environment (remove malware, close persistence, patch exploited vulnerabilities). Containment is stopping spread and limiting damage during the incident. Since the group is assessing impact and creating improvement actions after operations have resumed, the correct classification is Post-Incident Activities.