312-39 ECCouncil Certified SOC Analyst (CSA v2) Free Practice Exam Questions (2026 Updated)

Ingress filtering is a technique used to ensure that incoming packets are actually from the networks that they claim tooriginate from. This is particularly useful in mitigating IP spoofing, where an attacker might use a legitimate IP address to send malicious packets, making it appear as though the packets are coming from a trusted source. By implementing ingress filtering, networks can check that the source IP address of incoming packets is within a range that logically should be entering the network from that point. This helps in tracing back flooding attacks to their true source and is a recommended practice to protect against such attacks.

PCI-DSS stands for Payment Card Industry Data Security Standard. It is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. The PCI-DSS is a widely recognized set of guidelines that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures. This comprehensive standard is intended to help organizations proactivelyprotect customer account data.

Log normalization is the key step that converts heterogeneous logs into a consistent, common schema so analysts and detections can reliably query and correlate events. In real SOC workflows, different sources use different field names, timestamp formats, severity labels, and value conventions (for example, “src_ip” vs “SourceIP,” “user” vs “AccountName”). Normalization standardizes these into consistent fields (time, host, user, source/destination, action, outcome), enabling rule logic and dashboards to work across vendors without constant manual translation. Log collection is simply getting logs into a central place; it does not guarantee they are usable or consistent. Log transformation is a broader term that can include parsing or enrichment, but normalization is the specific practice of mapping diverse formats into a common model. Log correlation comes after normalization; correlation links related events (e.g., failed logons + suspicious process + outbound beaconing) and depends on normalized data to work well. Since the problem is explicitly “multiple formats” and manual conversion delays investigation, the best solution is normalization to accelerate triage, reduce query complexity, and improve detection fidelity.

Once the event sources are validated, the next logical step is to define the detection logic—correlation rules and conditions that represent privilege escalation patterns. In SOC engineering, validated sources mean you have the raw ingredients; now you must specify what “bad” looks like in those logs. For privilege escalation on Windows, this might include abnormal group membership changes, creation of new privileged accounts, suspicious privilege assignment events, UAC bypass indicators, or admin logons from non-admin workstations. Defining correlation rules also includes setting time windows, selecting strong pivots (account, host, SID), and incorporating context to reduce noise (approved admin accounts, maintenance windows, known tooling). Defining response actions is important, but it should follow detection logic so you don’t automate reactions to unstable or noisy detections. Testing immediately in production is risky; best practice is to test in a controlled manner or pilot mode first to avoid operational disruption and excessive false positives. Collecting historical logs can help tune baselines, but the scenario states sources are already validated; the next step is to codify the conditions that detect the targeted behavior.

User and Entity Behavior Analytics (UEBA) is a cybersecurity process that uses machine learning, algorithms, and statistical analyses to detect abnormal behavior of users and entities within an organization. UEBA systems analyze patterns of behavior and can identify anomalies that deviate from the norm, which could indicate a potential security threat.

Anomaly-based detection is the technique that aligns with UEBA’s functionality. It contrasts with:

Rule-based detection, which relies on predefined rules to detect threats.

Heuristic-based detection, which uses experience-based techniques.

Signature-based detection, which depends on known patterns orsignatures of malware to identify threats.

Anomaly-based detection systems are designed to be dynamic, continuously learning and establishing what is considered normal to identify deviations. This approach is particularly effective in identifying previously unknown threats, hence its alignment with UEBA.

Theprimary step in containing a malware incident is to isolate the infected machine to prevent the malware from spreading to other systems. This can be done by disconnecting it from the network and turning it off. This action helps to contain the incident and allows for a proper investigation without the risk of further infection or data loss.

In Microsoft Sentinel, Playbooks are the component used to automate incident response workflows. From a SOC analyst perspective, playbooks operationalize consistent actions at machine speed: enrich alerts (who, what, where), notify stakeholders, open tickets, isolate endpoints, disable accounts, block indicators, and orchestrate approvals. This directly addresses high alert volume by standardizing repetitive tasks and reducing manual handling time, which improves mean time to acknowledge (MTTA) and mean time to respond (MTTR). “Analytics” in Sentinel is where detection rules and correlations are configured to generate alerts and incidents; it is not the workflow engine for response actions. A “Workspace” is the Log Analytics environment where data is stored and queried, which is foundational but not the automation component. “Community” refers to shared content and contributions (rules, workbooks, playbooks), but it is not the mechanism that executes your organization’s automated response. Therefore, for building automated workflows that act on incidents and alerts, Playbooks are the correct choice.

Jennifer is in the Incident Triage phase because she is validating whether the alert is a true incident and quickly assessing scope, severity, and credibility. Triage is the “is this real and how bad is it?” step, typically performed immediately after alert generation or escalation. Pulling EDR logs, SIEM network patterns, and email gateway data is classic triage activity: it helps confirm maliciousness, identify the likely entry vector (phishing attachment vs. drive-by vs. lateral movement), and determine whether containment is needed. Evidence gathering and forensic analysis usually implies a deeper, formalized investigation once an incident is confirmed, including preservation actions, comprehensive artifact collection, and detailed root cause work. Notification is about informing stakeholders after classification and initial scoping. Incident recording and assignment is the ticketing/logging step (creating the case, assigning ownership), which the scenario does not emphasize. Because her stated objective is specifically to determine whether the alert represents a legitimate security incident and she is rapidly checking multiple telemetry sources for confirmation, the best fit is Incident Triage.

The type of threat intelligence that helps in understanding adversary intent and making informed decisions to ensure appropriate security in alignment with risk is known as Strategic Threat Intelligence. This form of intelligence is concerned with the broader goals and motivations of threat actors, as well as the long-term trends and implications of their activities. It provides insights into the cyber threat landscape and helps organizations shape their security strategy and policies to mitigate risks.

Strategic Threat Intelligence is used to inform decision-makers about the nature of threats, the potential impact on the organization, and the necessary steps to align security measures with business objectives. It is less technical than Tactical or Operational Threat Intelligence and does not focus on the specific details of attacks or the technical indicators of compromise. Instead, it provides a high-level view of the threats and their relevance to the organization’s risk management.

The described activities—acquiring RAM dumps, extracting event logs, and collecting PCAPs—are evidence gathering and forensic analysis. This phase focuses on preserving and analyzing artifacts to understand what happened, how it happened, and what the scope is. RAM capture can reveal in-memory indicators such as encryption keys, injected code, running processes, network connections, and credential material that may not be present on disk. Windows Event Logs provide timelines for process creation, logons, privilege changes, and service activity. PCAP data supports validation of lateral movement, C2 communication, and exfiltration paths. Containment has already occurred in the scenario (infected endpoints were isolated), and eradication would involve removing ransomware, closing persistence, patching exploited paths, and ensuring the threat cannot return. Recovery is restoring systems and data to normal operations. In SOC practice, evidence collection should occur as early as safely possible (often immediately after containment) to avoid losing volatile artifacts, which is why the forensic team is acting now. Therefore, the current phase is evidence gathering and forensic analysis.

)∗∗ComprehensiveDetailedStepbyStepExplanation:∗∗InWindowssecurityeventlogs,EventCode4688signifiesaprocesscreationevent.TheSplunkquery‘index=windowsLogName=SecurityEventCode=4688NOT(AccountN​ame=∗)is used to fetch logs related to process creation activities. This query filters the logs to only show events where a new process has been created, which is indicated by EventCode 4688. TheNOT (Account_Name=$)` part of the query excludes any events where the account name ends with a dollar sign, which typically represents a machine or service account.

Static analysis is the correct approach when the requirement is to understand what the script is intended to do without executing it. For PowerShell embedded in documents, static analysis includes extracting the script content, de-obfuscating it (common techniques include base64 decoding, string reconstruction, and analyzing encoded commands), and reviewing functions, URLs/IPs, file paths, registry keys, and command-line arguments. This allows the SOC to determine likely behaviors such as downloading payloads, establishing persistence, credential theft, or disabling security controls—without risking system impact. Dynamic or behavioral analysis involves running code in a controlled sandbox to observe actions, which can be valuable but violates the constraint “without triggering it,” and can be risky if containment fails or the malware has evasive logic. Network traffic analysis can help once execution has occurred or in a sandbox run, but it cannot fully explain logic that never ran. Static analysis is also useful for creating detections (hashes, strings, YARA-like patterns, command-line indicators) and for scoping across the environment by searching for matching script fragments or document markers.

MagicTree is a data management tool designed for penetration testers, incident handlers, and IT security professionals. It is particularly useful for handling the voluminous data typically generated during a security assessment or incident response process. MagicTree allows users to import and aggregate data from various sources, organize it in a structured manner, and generate comprehensive reports. This tool helps in consolidating and making sense of the data, which is crucial for efficient incident handling and reporting.

These actions align most strongly with eradication because they are removing the root cause of compromise and eliminating the adversary’s ability to persist. Applying an emergency patch to the exploited mail server closes the vulnerability that enabled initial access. Updating mail filtering rules to block the malicious payload reduces reinfection risk and removes the delivery path. Network segmentation can be a containment measure, but in this context it is being implemented as a corrective control to prevent continued lateral movement and re-compromise as part of eliminating the threat’s operational pathways. Evidence gathering is already implied by the forensic identification of the exploited CVE; recovery would involve restoring services and data after the threat is removed. In SOC practice, containment stops immediate spread (isolate servers, block traffic), while eradication focuses on removing malware, closing exploited vulnerabilities, removing persistence, and making the environment safe for return-to-service. Because the scenario explicitly includes patching and control changes aimed at eliminating the exploit vector and stopping recurrence, eradication is the best fit.

Insecure deserialization often leads to critical vulnerabilities allowing attackers to perform various attacks, such as remote code execution. To mitigate these vulnerabilities, Wesley should avoid considering the serialization of security-sensitive classes because it can expose sensitive data to untrusted sources or lead to arbitrary code execution.

Here are the steps Wesley should follow:

Avoid Serialization of Sensitive Data: Do not serialize sensitiveinformation. If it’s essential to serialize, then ensure it’s encrypted and the process is secure.

Implement Integrity Checks: Use digital signatures or checksums to verify that the serialized data has not been tampered with before deserializing it.

Enforce Strict Type Constraints: When deserializing, ensure that the data adheres to strict type constraints to prevent the instantiation of unexpected types.

Logging and Monitoring: Keep detailed logs of serialization and deserialization processes to monitor for any suspicious activities.

Security Controls Review: Regularly review and update security controls related to serialization and deserialization to ensure they are effective against emerging threats.

Strategic threat intelligence is aimed at executive and program-level decision-making. It focuses on high-level risk trends, geopolitical drivers, adversary motivations, target selection, and emerging threat landscapes that influence long-term security posture and investment priorities. The question emphasizes senior management concerns, long-term implications, and broad risks affecting financial institutions—hallmarks of strategic intelligence. Technical intelligence is focused on specific indicators (IPs, domains, hashes) and technical artifacts for immediate detection. Tactical intelligence focuses on adversary tactics, techniques, and procedures (TTPs) that help defenders improve detections and controls. Operational intelligence is more immediate, relating to current campaigns, adversary capabilities, and near-term targeting information used for active defense and incident response. While tactical and operational intelligence are valuable for SOC detections and playbooks, the requirement here is “high-level risks and long-term implications,” which maps most directly to strategic threat intelligence.

Initial containment for suspected data exfiltration by a specific user account should prioritize immediately restricting that account’s ability to access and transfer data. “Access control” is the broad containment category that includes disabling the account, suspending sessions, revoking tokens, removing access to sensitive shares, and applying conditional access blocks. This is the fastest way to stop ongoing data loss while preserving evidence for investigation. “Change passwords regularly” is a general security hygiene practice, not an initial incident containment action, and it may not stop exfiltration quickly if active sessions or tokens remain valid. “Isolate the storage” can be appropriate if a particular repository is being actively exfiltrated, but it can be disruptive to business operations and may not address the actor’s continued access paths across other systems. DCAP is a programmatic capability for monitoring and controlling data access over time; it is valuable, but it is not the immediate first step when the SOC must rapidly stop suspected exfiltration. From a SOC playbook view, the initial action is to reduce attacker/insider access immediately (account restriction), then scope what data was accessed, preserve logs, and coordinate with HR/legal for insider procedures.