[2022] Pass 312-39 Exam - Real Questions and Answers
312-39 Exam Questions Get Updated [2022] with Correct Answers
NEW QUESTION 54
Which of the following service provides phishing protection and content filtering to manage the Internet experience on and off your network with the acceptable use or compliance policies?
- A. Malstrom
- B. Apility.io
- C. OpenDNS
- D. I-Blocklist
Answer: C
NEW QUESTION 55
An organization wants to implement a SIEM deployment architecture. However, they have the capability to do only log collection and the rest of the SIEM functions must be managed by an MSSP.
Which SIEM deployment architecture will the organization adopt?
- A. Cloud, MSSP Managed
- B. Self-hosted, Self-Managed
- C. Self-hosted, Jointly Managed
- D. Self-hosted, MSSP Managed
Answer: D
NEW QUESTION 56
What is the correct sequence of SOC Workflow?
- A. Collect, Ingest, Validate, Document, Report, Respond
- B. Collect, Ingest, Validate, Report, Respond, Document
- C. Collect, Ingest, Document, Validate, Report, Respond
- D. Collect, Respond, Validate, Ingest, Report, Document
Answer: A
NEW QUESTION 57
Which of the following Windows Event Id will help you monitors file sharing across the network?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION 58
Bonney's system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?
- A. Leave it to the network administrators to handle
- B. Turn off the infected machine
- C. Complaint to police in a formal way regarding the incident
- D. Call the legal department in the organization and inform about the incident
Answer: B
NEW QUESTION 59
An organization is implementing and deploying the SIEM with following capabilities.
What kind of SIEM deployment architecture the organization is planning to implement?
- A. Self-hosted, MSSP Managed
- B. Self-hosted, Self-Managed
- C. Self-hosted, Jointly Managed
- D. Cloud, MSSP Managed
Answer: D
NEW QUESTION 60
Which of the following Windows event is logged every time when a user tries to access the "Registry" key?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION 61
Which of the following are the responsibilities of SIEM Agents?
1.Collecting data received from various devices sending data to SIEM before forwarding it to the central engine.
2.Normalizing data received from various devices sending data to SIEM before forwarding it to the central engine.
3.Co-relating data received from various devices sending data to SIEM before forwarding it to the central engine.
4.Visualizing data received from various devices sending data to SIEM before forwarding it to the central engine.
- A. 2 and 3
- B. 3 and 1
- C. 1 and 4
- D. 1 and 2
Answer: C
NEW QUESTION 62
Which of the following formula represents the risk?
- A. Risk = Likelihood * Severity * Asset Value
- B. Risk = Likelihood * Impact * Severity
- C. Risk = Likelihood * Consequence * Severity
- D. Risk = Likelihood * Impact * Asset Value
Answer: C
NEW QUESTION 63
The Syslog message severity levels are labelled from level 0 to level 7.
What does level 0 indicate?
- A. Alert
- B. Notification
- C. Debugging
- D. Emergency
Answer: B
NEW QUESTION 64
Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.
- A. Syllable Attack
- B. Dictionary Attack
- C. Rainbow Table Attack
- D. Bruteforce Attack
Answer: B
NEW QUESTION 65
Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?
- A. $ tailf /var/log/sys/kern.log
- B. # tailf /var/log/messages
- C. $ tailf /var/log/kern.log
- D. # tailf /var/log/sys/messages
Answer: C
NEW QUESTION 66
Which attack works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?
- A. Birthday Attack
- B. Bruteforce Attack
- C. Rainbow Table Attack
- D. Hybrid Attack
Answer: B
NEW QUESTION 67
Which of the following steps of incident handling and response process focus on limiting the scope and extent of an incident?
- A. Data Collection
- B. Identification
- C. Eradication
- D. Containment
Answer: D
NEW QUESTION 68
Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company and wanted to check the logs that are generated by access control list numbered 210.
What filter should Peter add to the 'show logging' command to get the required output?
- A. show logging | access 210
- B. show logging | include 210
- C. show logging | route 210
- D. show logging | forward 210
Answer: B
NEW QUESTION 69
Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.
What does this event log indicate?
- A. XSS Attack
- B. Parameter Tampering Attack
- C. Directory Traversal Attack
- D. SQL Injection Attack
Answer: B
NEW QUESTION 70
Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he has performed incident analysis and validation to check whether the incident is a true incident or a false positive.
Identify the stage in which he is currently in.
- A. Incident Disclosure
- B. Incident Triage
- C. Incident Recording and Assignment
- D. Post-Incident Activities
Answer: C
NEW QUESTION 71
Which of the log storage method arranges event logs in the form of a circular buffer?
- A. FIFO
- B. LIFO
- C. wrapping
- D. non-wrapping
Answer: A
NEW QUESTION 72
What does [-n] in the following checkpoint firewall log syntax represents?
fw log [-f [-t]] [-n] [-l] [-o] [-c action] [-h host] [-s starttime] [-e endtime] [-b starttime endtime] [-u unification_scheme_file] [-m unification_mode(initial|semi|raw)] [-a] [-k (alert name|all)] [-g] [logfile]
- A. Display account log records only
- B. Display detailed log chains (all the log segments a log record consists of)
- C. Display both the date and the time for each log record
- D. Speed up the process by not performing IP addresses DNS resolution in the Log files
Answer: D
NEW QUESTION 73
Which of the following attack inundates DHCP servers with fake DHCP requests to exhaust all available IP addresses?
- A. DHCP Starvation Attacks
- B. DHCP Cache Poisoning
- C. DHCP Port Stealing
- D. DHCP Spoofing Attack
Answer: A
NEW QUESTION 74
What is the process of monitoring and capturing all data packets passing through a given network using different tools?
- A. Port Scanning
- B. DNS Footprinting
- C. Network Sniffing
- D. Network Scanning
Answer: C
NEW QUESTION 75
......
Practice 312-39 Questions With Certification guide Q&A from Training Expert TestPassed: https://www.testpassed.com/312-39-still-valid-exam.html
Free EC-COUNCIL 312-39 Test Practice Test Questions Exam Dumps: https://drive.google.com/open?id=1Np935kc927o-e3vT7WhNiJXYwPKhTB_w