EC-COUNCIL EC-COUNCIL Certifications 312-39 Questions & Answers

• Question 41:

  Robin, a SOC engineer in a multinational company, is planning to implement a SIEM. He realized that his organization is capable of performing only Correlation, Analytics, Reporting, Retention, Alerting, and Visualization required for the SIEM implementation and has to take collection and aggregation services from a Managed Security Services Provider (MSSP).

  What kind of SIEM is Robin planning to implement?

  A. Self-hosted, Self-Managed

  B. Self-hosted, MSSP Managed

  C. Hybrid Model, Jointly Managed

  D. Cloud, Self-Managed

  Correct Answer: B

• Question 42:

  The threat intelligence, which will help you, understand adversary intent and make informed decision to ensure appropriate security in alignment with risk. What kind of threat intelligence described above?

  A. Tactical Threat Intelligence

  B. Strategic Threat Intelligence

  C. Functional Threat Intelligence

  D. Operational Threat Intelligence

  Correct Answer: B

  Reference: https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/threat-intelligence/what-is-threat-intelligence/

• Question 43:

  Identify the type of attack, an attacker is attempting on www.example.com website.

  

  A. Cross-site Scripting Attack

  B. Session Attack

  C. Denial-of-Service Attack

  D. SQL Injection Attack

  Correct Answer: A

• Question 44:

  Which of the following fields in Windows logs defines the type of event occurred, such as Correlation Hint, Response Time, SQM, WDI Context, and so on?

  A. Keywords

  B. Task Category

  C. Level

  D. Source

  Correct Answer: A

• Question 45:

  Which of the following Windows Event Id will help you monitors file sharing across the network?

  A. 7045

  B. 4625

  C. 5140

  D. 4624

  Correct Answer: C

  Reference: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5140

• Question 46:

  In which of the following incident handling and response stages, the root cause of the incident must be found from the forensic results?

  A. Evidence Gathering

  B. Evidence Handling

  C. Eradication

  D. Systems Recovery

  Correct Answer: A

  Reference: https://www.eccouncil.org/wp-content/uploads/2019/02/ECIH-V2-Brochure.pdf

• Question 47:

  Jane, a security analyst, while analyzing IDS logs, detected an event matching Regex /((\%3C)|<)((\%69)|i|(\%49))((\%6D)|m|(\%4D))((\%67)|g|(\%47))[^\n]+((\%3E)|>)/|. What does this event log indicate?

  A. Directory Traversal Attack

  B. Parameter Tampering Attack

  C. XSS Attack

  D. SQL Injection Attack

  Correct Answer: C

  Reference: https://books.google.com.pk/books?id=PDR4nOAP8qUCandpg=PA87andlpg=PA87anddq=regex+/((%5C%253C)%7C<)((%5C%2569)%7Ci%7C(%5C%2549))((%5C%256D)%7Cm%7C(%5C%254D))((%5C%2567)%7Cg%7C(%5C% 2547))%5B%5E%5Cn%5D%2B((%5C%253E)%7C>)/% 7Candsource=blandots=kOBHNfJmtqandsig=ACfU3U2CG_hELc1HMb1chdc9OS4ooXPlMgandhl=enandsa=Xandved=2ahUKEwjYwJmlt_buAhUFShUIHTBNAs8Q6AEwBXoECAUQAw#v=onepageandqandf=false

• Question 48:

  Which of the following formula represents the risk levels?

  A. Level of risk = Consequence x Severity

  B. Level of risk = Consequence x Impact

  C. Level of risk = Consequence x Likelihood

  D. Level of risk = Consequence x Asset Value

  Correct Answer: B

• Question 49:

  Jason, a SOC Analyst with Maximus Tech, was investigating Cisco ASA Firewall logs and came across the following log entry:

  May 06 2018 21:27:27 asa 1: %ASA -5

  Correct Answer: A

• Question 50:

  What is the correct sequence of SOC Workflow?

  A. Collect, Ingest, Validate, Document, Report, Respond

  B. Collect, Ingest, Document, Validate, Report, Respond

  C. Collect, Respond, Validate, Ingest, Report, Document

  D. Collect, Ingest, Validate, Report, Respond, Document

  Correct Answer: A