Latest 2021 Realistic Verified 312-39 Dumps - 100% Free 312-39 Exam Dumps
Get 2021 Updated Free EC-COUNCIL 312-39 Exam Questions & Answer
What Does It Cover?
The EC-Council 312-39 exam is built around the topic areas listed below:
- Security Operations & Management;
- Incidents, Events, and Logging;
- Enhanced Incident Detection with Threat Intelligence;
- Incident Response.
- Incident Detection with Security Information and Event Management (SIEM);
Can You Study with Online Courses?
Yes! This is one of the best learning approaches you can adopt to crack 312-39 exam easily. And the next section covers one such study material:
- Certified SOC Analyst (CSA)
The Certified SOC Analyst (CSA) course is an intense learning program that runs for 3 days. It is a credentialing study option that equips candidates with in-demand technical skills and knowledge relating to the management of a Security Operations Center (SOC). This learning path, in particular, focuses on helping candidates master what they should know to successfully perform the fundamental SOC operations under the recognized concepts of SIEM deployment, incident response, log management along with correlation, and advanced incident detection among other skills. All in all, this course will help you understand how to perform different SOC processes and work together with CSIRT if necessary to ensure your company achieves its goals. You may want to check out the official learning page to find out more information about this course and other learning options.
NEW QUESTION 55
In which log collection mechanism, the system or application sends log records either on the local disk or over the network.
- A. rule-based
- B. push-based
- C. pull-based
- D. signature-based
Answer: A
NEW QUESTION 56
Which of the following technique protects from flooding attacks originated from the valid prefixes (IP addresses) so that they can be traced to its true source?
- A. Ingress Filtering
- B. Rate Limiting
- C. Throttling
- D. Egress Filtering
Answer: A
NEW QUESTION 57
Where will you find the reputation IP database, if you want to monitor traffic from known bad IP reputation using OSSIM SIEM?
- A. /etc/ossim/reputation
- B. /etc/ossim/server/reputation.data
- C. /etc/siem/ossim/server/reputation.data
- D. /etc/ossim/siem/server/reputation/data
Answer: A
NEW QUESTION 58
In which phase of Lockheed Martin's - Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?
- A. Exploitation
- B. Delivery
- C. Reconnaissance
- D. Weaponization
Answer: B
NEW QUESTION 59
Which of the following is a report writing tool that will help incident handlers to generate efficient reports on detected incidents during incident response process?
- A. Malstrom
- B. threat_note
- C. MagicTree
- D. IntelMQ
Answer: D
NEW QUESTION 60
An attacker, in an attempt to exploit the vulnerability in the dynamically generated welcome page, inserted code at the end of the company's URL as follows:
http://technosoft.com.com/<script>alert("WARNING: The application has encountered an error");</script>.
Identify the attack demonstrated in the above scenario.
- A. Session Attack
- B. Denial-of-Service Attack
- C. Cross-site Scripting Attack
- D. SQL Injection Attack
Answer: A
NEW QUESTION 61
Which of the following attack can be eradicated by disabling of "allow_url_fopen and allow_url_include" in the php.ini file?
- A. LDAP Injection Attacks
- B. Command Injection Attacks
- C. URL Injection Attacks
- D. File Injection Attacks
Answer: C
NEW QUESTION 62
Which of the following security technology is used to attract and trap people who attempt unauthorized or illicit utilization of the host system?
- A. Honeypot
- B. Intrusion Detection System
- C. De-Militarized Zone (DMZ)
- D. Firewall
Answer: A
NEW QUESTION 63
Which of the following data source will a SOC Analyst use to monitor connections to the insecure ports?
- A. DNS Data
- B. IIS Data
- C. DHCP Data
- D. Netstat Data
Answer: D
NEW QUESTION 64
Which of the following is a default directory in a Mac OS X that stores security-related logs?
- A. ~/Library/Logs
- B. /private/var/log
- C. /Library/Logs/Sync
- D. /var/log/cups/access_log
Answer: A
NEW QUESTION 65
Jason, a SOC Analyst with Maximus Tech, was investigating Cisco ASA Firewall logs and came across the following log entry:
May 06 2018 21:27:27 asa 1: %ASA -5 - 11008: User 'enable_15' executed the 'configure term' command What does the security level in the above log indicates?
- A. Critical condition message
- B. Warning condition message
- C. Normal but significant message
- D. Informational message
Answer: B
NEW QUESTION 66
Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he has performed incident analysis and validation to check whether the incident is a true incident or a false positive.
Identify the stage in which he is currently in.
- A. Incident Recording and Assignment
- B. Incident Disclosure
- C. Post-Incident Activities
- D. Incident Triage
Answer: A
NEW QUESTION 67
According to the Risk Matrix table, what will be the risk level when the probability of an attack is very high, and the impact of that attack is major?
NOTE: It is mandatory to answer the question before proceeding to the next one.
- A. High
- B. Extreme
- C. Low
- D. Medium
Answer: A
NEW QUESTION 68
Identify the attack, where an attacker tries to discover all the possible information about a target network before launching a further attack.
- A. Reconnaissance Attack
- B. Man-In-Middle Attack
- C. DoS Attack
- D. Ransomware Attack
Answer: A
NEW QUESTION 69
Identify the HTTP status codes that represents the server error.
- A. 1XX
- B. 4XX
- C. 2XX
- D. 5XX
Answer: D
NEW QUESTION 70
Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?
- A. Incident Triage -> Eradication -> Containment -> Incident Recording -> Preparation -> Recovery -> Post-Incident Activities
- B. Incident Recording -> Preparation -> Containment -> Incident Triage -> Recovery -> Eradication -> Post-Incident Activities
- C. Preparation -> Incident Recording -> Incident Triage -> Containment -> Eradication -> Recovery -> Post-Incident Activities
- D. Containment -> Incident Recording -> Incident Triage -> Preparation -> Recovery -> Eradication -> Post-Incident Activities
Answer: C
NEW QUESTION 71
Which of the log storage method arranges event logs in the form of a circular buffer?
- A. LIFO
- B. FIFO
- C. wrapping
- D. non-wrapping
Answer: B
NEW QUESTION 72
What does HTTPS Status code 403 represents?
- A. Forbidden Error
- B. Unauthorized Error
- C. Internal Server Error
- D. Not Found Error
Answer: A
NEW QUESTION 73
Which of the following tool is used to recover from web application incident?
- A. Smoothwall SWG
- B. Symantec Secure Web Gateway
- C. CrowdStrike FalconTM Orchestrator
- D. Proxy Workbench
Answer: B
NEW QUESTION 74
Which of the following Windows event is logged every time when a user tries to access the "Registry" key?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
NEW QUESTION 75
John, a threat analyst at GreenTech Solutions, wants to gather information about specific threats against the organization. He started collecting information from various sources, such as humans, social media, chat room, and so on, and created a report that contains malicious activity.
Which of the following types of threat intelligence did he use?
- A. Technical Threat Intelligence
- B. Operational Threat Intelligence
- C. Strategic Threat Intelligence
- D. Tactical Threat Intelligence
Answer: B
NEW QUESTION 76
Daniel is a member of an IRT, which was started recently in a company named Mesh Tech. He wanted to find the purpose and scope of the planned incident response capabilities.
What is he looking for?
- A. Incident Response Intelligence
- B. Incident Response Mission
- C. Incident Response Vision
- D. Incident Response Resources
Answer: D
NEW QUESTION 77
Which of the following directory will contain logs related to printer access?
- A. /var/log/cups/Printeraccess_log file
- B. /var/log/cups/accesslog file
- C. /var/log/cups/Printer_log file
- D. /var/log/cups/access_log file
Answer: C
NEW QUESTION 78
A type of threat intelligent that find out the information about the attacker by misleading them is known as
.
- A. Operational Intelligence
- B. Detection Threat Intelligence
- C. Threat trending Intelligence
- D. Counter Intelligence
Answer: A
NEW QUESTION 79
Banter is a threat analyst in Christine Group of Industries. As a part of the job, he is currently formatting and structuring the raw data.
He is at which stage of the threat intelligence life cycle?
- A. Processing and Exploitation
- B. Dissemination and Integration
- C. Collection
- D. Analysis and Production
Answer: A
NEW QUESTION 80
......
312-39 Dumps PDF and Test Engine Exam Questions: https://www.validdumps.top/312-39-exam-torrent.html
Get New 312-39 Certification – Valid Exam Dumps Questions: https://drive.google.com/open?id=1eUu5m-Kur-ycbRJ9aVQrf808jUrsK1AK