EC-COUNCIL Other ECCouncil 312-39 Questions & Answers

• Question 11:

  Charline is working as an L2 SOC Analyst. One day, an L1 SOC Analyst escalated an incident to her for further investigation and confirmation. Charline, after a thorough investigation, confirmed the incident and assigned it with an initial priority.

  What would be her next action according to the SOC workflow?

  A. She should immediately escalate this issue to the management

  B. She should immediately contact the network administrator to solve the problem

  C. She should communicate this incident to the media immediately

  D. She should formally raise a ticket and forward it to the IRT

  Correct Answer: B

• Question 12:

  Which of the following tool can be used to filter web requests associated with the SQL Injection attack?

  A. Nmap

  B. UrlScan

  C. ZAP proxy

  D. Hydra

  Correct Answer: B

  Reference: https://aip.scitation.org/doi/pdf/10.1063/1.4982570

• Question 13:

  Which of the following process refers to the discarding of the packets at the routing level without informing the source that the data did not reach its intended recipient?

  A. Load Balancing

  B. Rate Limiting

  C. Black Hole Filtering

  D. Drop Requests

  Correct Answer: C

  Reference: https://en.wikipedia.org/wiki/Black_hole_(networking)#:~:text=In%20networking%2C%20black %20holes%20refer,not%20reach%20its%20intended%20recipient.

• Question 14:

  John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming.

  Which of the following data source will he use to prepare the dashboard?

  A. DHCP/Logs capable of maintaining IP addresses or hostnames with IPtoName resolution.

  B. IIS/Web Server logs with IP addresses and user agent IPtouseragent resolution.

  C. DNS/ Web Server logs with IP addresses.

  D. Apache/ Web Server logs with IP addresses and Host Name.

  Correct Answer: D

• Question 15:

  Which of the following contains the performance measures, and proper project and time management details?

  A. Incident Response Policy

  B. Incident Response Tactics

  C. Incident Response Process

  D. Incident Response Procedures

  Correct Answer: D

• Question 16:

  Which of the following technique protects from flooding attacks originated from the valid prefixes (IP addresses) so that they can be traced to its true source?

  A. Rate Limiting

  B. Egress Filtering

  C. Ingress Filtering

  D. Throttling

  Correct Answer: C

  Reference: http://www.mecs-press.org/ijcnis/ijcnis-v5-n5/IJCNIS-V5-N5-6.pdf (3)

• Question 17:

  Which of the following data source will a SOC Analyst use to monitor connections to the insecure ports?

  A. Netstat Data

  B. DNS Data

  C. IIS Data

  D. DHCP Data

  Correct Answer: A

• Question 18:

  Which of the following steps of incident handling and response process focus on limiting the scope and extent of an incident?

  A. Containment

  B. Data Collection

  C. Eradication

  D. Identification

  Correct Answer: A

• Question 19:

  Which of the following stage executed after identifying the required event sources?

  A. Identifying the monitoring Requirements

  B. Defining Rule for the Use Case

  C. Implementing and Testing the Use Case

  D. Validating the event source against monitoring requirement

  Correct Answer: D

• Question 20:

  In which log collection mechanism, the system or application sends log records either on the local disk or over the network.

  A. rule-based

  B. pull-based

  C. push-based

  D. signature-based

  Correct Answer: A