EC-COUNCIL Other ECCouncil 312-39 Questions & Answers

• Question 31:

  What does the HTTP status codes 1XX represents?

  A. Informational message

  B. Client error

  C. Success

  D. Redirection

  Correct Answer: A

  Reference: https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#:~:text=1xx%20informational% 20response%20?20the%20request,syntax%20or%20cannot%20be%20fulfilled

• Question 32:

  What does the Security Log Event ID 4624 of Windows 10 indicate?

  A. Service added to the endpoint

  B. A share was assessed

  C. An account was successfully logged on

  D. New process executed

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

• Question 33:

  Which of the following is a set of standard guidelines for ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection?

  A. FISMA

  B. HIPAA

  C. PCI-DSS

  D. DARPA

  Correct Answer: C

  Reference: https://library.educause.edu/topics/policy-and-law/pci-dss

• Question 34:

  Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.

  Where will Harley find the web server logs, if he wants to investigate them for any anomalies?

  A. SystemDrive%\inetpub\logs\LogFiles\W3SVCN

  B. SystemDrive%\LogFiles\inetpub\logs\W3SVCN

  C. %SystemDrive%\LogFiles\logs\W3SVCN

  D. SystemDrive%\ inetpub\LogFiles\logs\W3SVCN

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/ logfile/

• Question 35:

  John, SOC analyst wants to monitor the attempt of process creation activities from any of their Windows endpoints.

  Which of following Splunk query will help him to fetch related logs associated with process creation?

  A. index=windows LogName=Security EventCode=4678 NOT (Account_Name=*$) .. .. ... ..

  B. index=windows LogName=Security EventCode=4688 NOT (Account_Name=*$) .. .. ..

  C. index=windows LogName=Security EventCode=3688 NOT (Account_Name=*$) .. .. ..

  D. index=windows LogName=Security EventCode=5688 NOT (Account_Name=*$) ... ... ...

  Correct Answer: B

  Reference: https://static1.squarespace.com/static/552092d5e4b0661088167e5c/ t/5a3187b4419202f0fb8b2dd1/1513195444728/Windows+Splunk+Logging+Cheat+Sheet+v2.2.pdf

• Question 36:

  Which of the following is a default directory in a Mac OS X that stores security-related logs?

  A. /private/var/log

  B. /Library/Logs/Sync

  C. /var/log/cups/access_log

  D. ~/Library/Logs

  Correct Answer: D

• Question 37:

  John, a threat analyst at GreenTech Solutions, wants to gather information about specific threats against the organization. He started collecting information from various sources, such as humans, social media, chat room, and so on, and created a report that contains malicious activity.

  Which of the following types of threat intelligence did he use?

  A. Strategic Threat Intelligence

  B. Technical Threat Intelligence

  C. Tactical Threat Intelligence

  D. Operational Threat Intelligence

  Correct Answer: D

• Question 38:

  What type of event is recorded when an application driver loads successfully in Windows?

  A. Error

  B. Success Audit

  C. Warning

  D. Information

  Correct Answer: D

  Reference: https://www.manageengine.com/network-monitoring/Eventlog_Tutorial_Part_I.html

• Question 39:

  An attacker exploits the logic validation mechanisms of an e-commerce website. He successfully purchases a product worth $100 for $10 by modifying the URL exchanged between the client and the server.

  Original URL: http://www.buyonline.com/product.aspx?profile=12anddebit=100 Modified URL: http://www.buyonline.com/product.aspx?profile=12anddebit=10

  Identify the attack depicted in the above scenario.

  A. Denial-of-Service Attack

  B. SQL Injection Attack

  C. Parameter Tampering Attack

  D. Session Fixation Attack

  Correct Answer: D

• Question 40:

  Robin, a SOC engineer in a multinational company, is planning to implement a SIEM. He realized that his organization is capable of performing only Correlation, Analytics, Reporting, Retention, Alerting, and Visualization required for the SIEM implementation and has to take collection and aggregation services from a Managed Security Services Provider (MSSP).

  What kind of SIEM is Robin planning to implement?

  A. Self-hosted, Self-Managed

  B. Self-hosted, MSSP Managed

  C. Hybrid Model, Jointly Managed

  D. Cloud, Self-Managed

  Correct Answer: B