10 free EC-Council 312-39v2 CSA v2 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 196 questions. Work through them, then open each answer to check your reasoning.
Get all 196 questions (US$39) · Download these 10 as a PDF
Question 1
A SIEM alert is triggered due to unusual network traffic involving NetBIOS. The System log shows that “The TCP/IP NetBIOS Helper service entered the running state”. Concurrently, Event Code 4624: “An account was successfully logged on” appears for multiple machines within a short time frame. The logon type is identified as 3 (Network logon).
Which of the following security incidents is the SIEM detecting?
Show answer and explanation
Correct answer: D. An attacker performing lateral movement within the network
The indicators present, NetBIOS traffic, TCP/IP NetBIOS Helper service activation, and multiple successful Network logons (type 3) across machines in rapid succession, are characteristic of lateral movement. An attacker compromising one system uses it to authenticate across the network to other machines using the SMB/NetBIOS protocol. This pattern differs from routine user activity across multiple workstations, which would show different logon patterns and distribution, and differs from simple file access. While malware could spread via SMB, the specific focus on successful authentications and NetBIOS activation points to deliberate lateral movement rather than autonomous malware propagation.
Why the other options are wrong
- A. Normal multi-workstation file access would not trigger sustained NetBIOS traffic alerts or show concentrated authentication events across multiple systems in rapid succession.
- B. Malware spreading autonomously via SMB would show different infection patterns and network signatures rather than successful logon events across multiple systems.
- C. Routine maintenance by administrators would typically be scheduled, documented, and not trigger multiple unexpected authentications flagged as anomalous by the SIEM.
Question 2
A manufacturing company is deploying a SIEM system and wants to improve both its security monitoring and regulatory compliance capabilities.
During the planning phase, the team decides to use an output-driven approach, starting with use cases that address unauthorized access to production control systems. They configure data sources and alert specific to this use case, ensuring they receive actionable alerts without excessive false positives. After validating its success, they move on to use cases related to supply chain disruptions and malware detection.
Which of the following best describes the primary advantage of using an output-driven approach in SIEM deployment?
Show answer and explanation
Correct answer: D. The company can create more complex use cases with greater scope.
An output-driven approach begins with defined, high-value use cases and builds the SIEM implementation around them, starting with unauthorized access to production control systems. After validating success, the team progressively adds more complex use cases related to supply chain disruptions and malware detection. This methodical expansion allows the organization to build increasingly sophisticated detection capabilities with validated, tuned alerting at each stage. The primary advantage is the ability to systematically create more complex use cases with greater scope as the program matures, rather than attempting to address everything simultaneously.
Why the other options are wrong
- A. Log collection from non-critical systems is not the focus of an output-driven approach, which prioritizes high-impact use cases regardless of system criticality.
- B. Real-time response to all incidents is an operational capability goal, not an advantage of the deployment methodology itself.
- C. Automatic blocking of all unauthorized access is a technical control decision, not a primary advantage of using an output-driven deployment approach.
Question 3
An attacker attempts to gain unauthorized access to a secure network by repeatedly guessing login credentials. The SIEM is configured to generate an alert after detecting 10 consecutive failed login attempts within a short timeframe. However, the attacker successfully logs in on the 9th attempt, just before the threshold is reached, bypassing the alert mechanism. Security teams only become aware of the incident after detecting suspicious activity post-login, highlighting a gap in the SIEM’s detection rules.
What type of alert classification does this represent?
Show answer and explanation
Correct answer: C. False Negative
A False Negative occurs when a security event actually occurs but the detection system fails to generate an alert. In this scenario, the attacker successfully gained unauthorized access on the 9th attempt, which is a genuine security incident, but the SIEM did not alert because the threshold of 10 consecutive failed attempts was not reached. The malicious event occurred but went undetected by the alert mechanism, representing a missed detection that was only discovered through post-login investigation.
Why the other options are wrong
- A. A True Positive would require the SIEM to correctly identify an actual attack with an alert, which did not occur in this scenario.
- B. A False Positive is an alert triggered for activity that is not actually malicious, whereas here there was no alert generated despite actual malicious activity.
- D. A True Negative would be correctly identifying non-malicious activity as benign, which does not apply to this unauthorized access scenario.
Question 4
Daniel Clark, a cybersecurity specialist working in the Cloud SOC for a government agency, is responsible for ensuring secure access to cloud applications while maintaining compliance with regulatory frameworks. His team needs a security solution that can enforce access policies to prevent unauthorized access to cloud based applications, monitor and restrict data sharing within SaaS, PaaS, and IaaS environments, ensure compliance with government regulations for data security and privacy, and apply security controls to prevent sensitive data exposure in the cloud.
To achieve these objectives, the team has implemented a security technology that governs control over cloud resources, applies security policies, and protects sensitive cloud-stored data.
Which Cloud SOC technology is Daniel’s team using?
Show answer and explanation
Correct answer: D. Cloud Access Security Broker
Cloud Access Security Broker (CASB) is the technology that governs control over cloud resources, applies security policies to cloud applications, monitors and restricts data sharing within SaaS/PaaS/IaaS environments, and protects sensitive data from exposure. A CASB acts as an intermediary between users and cloud services, enforcing access policies, monitoring user activity, and preventing unauthorized data access or exfiltration, exactly matching the requirements described for Daniel's team to ensure secure access while maintaining compliance.
Why the other options are wrong
- A. Cloud Security Posture Management focuses on assessing and remediating misconfigurations in cloud infrastructure, not on enforcing access policies to applications or monitoring data sharing.
- B. Cloud-native anomaly detection identifies unusual patterns in cloud environments but does not enforce access controls or govern cloud resource usage policies.
- C. Cloud Workload Protection Platform protects individual workloads and containers but does not specifically govern access to cloud applications or monitor SaaS/PaaS data sharing.
Question 5
A mid-sized healthcare organization is facing frequent phishing and ransomware attacks. They lack an internal SOC and want proactive threat detection and response capabilities. Compliance with HIPAA regulations is essential. The organization seeks a solution that includes both monitoring and rapid response to incidents.
Which service best meets their needs?
Show answer and explanation
Correct answer: C. MDR with proactive threat hunting and incident containment
Managed Detection and Response (MDR) provides both proactive threat hunting and rapid incident containment, exactly matching the organization's need for proactive detection without an internal SOC. MDR services include continuous monitoring, threat investigation, and active response capabilities, all critical for addressing frequent phishing and ransomware attacks. This approach is superior to MSSP log monitoring alone because it includes expert threat hunters who proactively investigate suspicious activity, not just alert escalation.
Why the other options are wrong
- A. While MSSP with monitoring provides 24/7 coverage, it primarily focuses on alert generation and escalation rather than proactive threat hunting and containment capabilities.
- B. Self-hosted SIEM with in-house analysts contradicts the premise that the organization lacks an internal SOC and cannot staff security expertise.
- D. Cloud-based SIEM with MSSP services provides monitoring but lacks the proactive threat hunting and active incident response capabilities that MDR specifically offers.
Question 6
A Security Operations Center (SOC) analyst receives a high-priority alert indicating unusual user activity. An employee account is attempting to access company resources from a different country and outside of their normal working hours. This behavior raises concerns about potential account compromise or unauthorized access to automate the initial response and quickly restrict access while further investigating the incident, which SOAR Playbook would be relevant to adapt and implement?
Show answer and explanation
Correct answer: A. Deprovisioning Users SOAR Playbook
The Deprovisioning Users SOAR Playbook is the appropriate response when an employee account shows signs of compromise (accessing resources from unexpected locations and outside normal hours). To rapidly restrict access and prevent further unauthorized activity, deprovisioning or credential revocation is the initial containment step. This playbook automates the process of disabling the account, resetting credentials, or revoking access tokens while the incident investigation proceeds, effectively automating the immediate protective response needed.
Why the other options are wrong
- B. Phishing Investigations Playbook addresses email-based compromise, not account compromise indicated by anomalous login patterns and geographic/temporal anomalies.
- C. Alert Enrichment Playbook focuses on gathering additional context about an alert, not on immediate containment and access restriction of a compromised account.
- D. Malware Containment Playbook addresses system-level malware infection, not the account compromise and unusual access pattern presented in this scenario.
Question 7
A government agency responsible for protecting sensitive information needs to monitor its network for unusual data exfiltration attempts. Since traditional log data alone is insufficient to identify suspicious traffic patterns, the SIEM team decides to integrate traffic flow data into their system. This data will help detect anomalies, such as large data transfers to unauthorized destinations or unexpected traffic spikes. The team must choose the appropriate protocol to collect IP traffic information from network devices like routers and switches.
Which protocol should be used to collect this data?
Show answer and explanation
Correct answer: C. IPFIX (IP Flow Information Export)
IPFIX (IP Flow Information Export) is the standardized protocol for collecting IP traffic flow information from network devices like routers and switches. It captures detailed flow-level data including source/destination IPs, ports, protocols, and byte counts, enabling detection of anomalies such as large data transfers to unauthorized destinations and unexpected traffic spikes. IPFIX is the modern, standardized replacement for NetFlow and is specifically designed for this type of traffic analytics.
Why the other options are wrong
- A. Syslog is used for collecting log messages from systems and applications, not network traffic flow data from routers and switches.
- B. SNMP is for network device management and monitoring, not for collecting detailed IP traffic flow information for exfiltration detection.
- D. NetFlow (RFC 3954) is an earlier proprietary protocol; while it serves a similar function, IPFIX is the standards-based successor and the preferred choice for modern SIEM implementations.
Question 8
SecureTech Solutions, a managed security service provider (MSSP), is optimizing its log management architecture to enhance log storage, retrieval, and analysis efficiency. The SOC team needs to ensure that security logs are stored in a structured or sem-tructured format, allowing for easy parsing, querying, and correlation of security events. To achieve this, they decide to implement a log storage format that organizes data in a text file in tabular structure, ensuring each log entry is stored in rows and columns. Additionally, they require a format that supports easy export to databases or spreadsheet-based analysis while maintaining readability.
Which log format should the SOC team choose to store logs in a structured or semi structured format for efficient analysis?
Show answer and explanation
Correct answer: C. Comma-Separated Values (CSV) Format
Comma-Separated Values (CSV) format organizes data in a structured, tabular format with rows and columns, enabling easy parsing, querying, and correlation of security events. CSV files are human-readable, can be directly imported into databases and spreadsheet applications, and support efficient analysis while maintaining a simple tex-ased structure. This format specifically meets the requirements for structured/sem-tructured storage, easy export, and spreadsheet compatibility.
Why the other options are wrong
- A. Syslog format is a log transmission protocol and message format, not a structured tabular storage format suitable for database import and spreadsheet analysis.
- B. Cloud Storage is a location/infrastructure choice, not a log format; it does not address how logs are organized in rows and columns for structured analysis.
- D. Database is a storage architecture, not a file format; while databases store structured data, the question asks for a format suitable for text file storage and spreadsheet export.
Question 9
A large web hosting service provider Web4Everyone is responsible for hosting multiple major websites, social media platforms and more. You are working here as a L1 SOC analyst responsible for investigating web server logs for potential malicious activity. Recently, your team detected multiple failed login attempts and unusual traffic patterns targeting the company’s web application. To efficiently analyze the logs and identify key details such as the remote host, username, timestamp, requested resource, and HTTP status code, and user-agent you need a structured log format that ensures quick and accurate parsing.
Which standardized log format will you choose for this scenario?
Show answer and explanation
Correct answer: A. Extended Log Format (ELF)
Extended Log Format (ELF) is the standardized format specifically designed for web server logging that provides comprehensive fields including remote host, username, timestamp, requested resource, HTTP status code, and user-agent. ELF is more flexible and extensible than Common Log Format, allowing organizations to customize which fields are logged while maintaining compatibility with standard parsing tools. This makes it ideal for SOC analysts who need quick and accurate parsing of detailed security-relevant information from web server logs.
Why the other options are wrong
- B. Tab-Separated Format is not a standardized web server log format and lacks the structured specification needed for reliable parsing across different systems.
- C. Common Log Format (CLF) lacks the user-agent field and other extended information required for comprehensive security analysis of web traffic.
- D. JSON Format, while flexible, is not the traditional standardized format for web server logs and would require additional configuration on most web servers.
Question 10
At 10:30 AM, during routine monitoring, SOC’s Tier-1 Jennifer detects unusual network traffic and confirms an active LockBit ransomware infection targeting systems in the finance department. She escalates the issue to the SOC lead, Sarah, who activates the Incident Response Team (IRT) and instructs the network team to isolate the finance department’s VLAN to prevent further spread across the network.
Which phase of the Incident Response process is currently being implemented?
Show answer and explanation
Correct answer: D. Containment
Containment is the phase focused on stopping the spread of an incident and limiting its impact. By isolating the finance department's VLAN, the team is preventing the LockBit ransomware from propagating to other parts of the network. This is a classic containment action taken after detection and escalation but before eradication and recovery efforts begin.
Why the other options are wrong
- A. Notification refers to alerting stakeholders about an incident, which occurred before the isolation decision.
- B. Evidence Gathering and Forensic Analysis focuses on collecting data about the incident for investigation, not on stopping its spread.
- C. Eradication involves removing the threat from systems, which comes after containment has been established.
That was 10 of 196.
The full EC-Council 312-39v2 CSA v2 pack has all 196 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.