EC-COUNCIL 312-39 問題集 : Certified SOC Analyst (CSA)

During a threat intelligence briefing, a SOC analyst comes across a classified report detailing a sophisticated cybercrime syndicate targeting executives of high-profile financial institutions. These adversaries rarely leave digital footprints and seem to anticipate security measures. Several breaches began with seemingly innocent conversations: a foreign journalist requesting an interview with a CEO and a "security consultant" offering free risk assessments. Further investigation reveals attackers socially engineered employees, manipulated trust, and extracted critical security details long before launching technical attacks. The analyst decides to focus on intelligence involving deception detection and psychological profiling to uncover true intent and methods. Which type of intelligence is the analyst leveraging?

• A. Open-Source Intelligence (OSINT)
• B. Human Intelligence
• C. Technical Threat Intelligence
• D. Threat Intelligence Feeds

As a Threat Hunter at a cybersecurity company, you notice several endpoints experiencing unusual outbound traffic to an unfamiliar IP address. The traffic is encrypted and occurs in small bursts at irregular intervals.
There are no known IoCs associated with the destination, and traditional security tools have not flagged it as malicious. You decide to launch a threat-hunting initiative to determine whether this is an advanced persistent threat (APT) using sophisticated techniques to evade detection. The goal is to identify potential Indicators of Attack (IoAs) and map them against known adversary behaviors. What type of threat hunting approach is best suited for this situation?

• A. Structured hunting
• B. Unstructured hunting
• C. Situational or entity-driven hunting
• D. Reactive hunting

A SOC analyst receives an alert indicating that the system time on a critical Windows server was changed at 3:
00 AM. There are no scheduled maintenance tasks at this time. Unauthorized time changes can be used to evade security controls, such as altering timestamps to obscure malicious activity. The analyst must identify the relevant event codes that log system time modifications and related suspicious behavior. Which of the following Windows Security Event Codes should the analyst review to investigate potential tampering?

• A. 4616 and 4618
• B. 4616 and 4624
• C. 4608 and 4609
• D. 4625 and 4634

Mark Reynolds, a SOC analyst at a healthcare organization, is monitoring the SIEM system when he detects a potential security threat: a series of unusual login attempts targeting critical patient data servers. After investigating the alerts and collaborating with the incident response team, the SOC determines that the threat has a "Likely" chance of occurring and could cause "Significant" damage, including operational disruptions, financial loss due to data breaches, and regulatory penalties under HIPAA. Using a standard Risk Matrix, how would this risk be categorized in terms of overall severity?

• A. Very High
• B. Medium
• C. High
• D. Low

Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.
Where will Harley find the web server logs, ifhe wants to investigate them for any anomalies?

• A. SystemDrive%\LogFiles\inetpub\logs\W3SVCN
• B. SystemDrive%\inetpub\logs\LogFiles\W3SVCN
• C. %SystemDrive%\LogFiles\logs\W3SVCN
• D. SystemDrive%\ inetpub\LogFiles\logs\W3SVCN