New 312-39 Test Materials & Valid 312-39 Test Engine
312-39 Updated Exam Dumps [2021] Practice Valid Exam Dumps Question
EC-COUNCIL 312-39 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
The EC-Council 312-39 exam is designed to evaluate and validate the extensive knowledge and skills of the candidates in the job tasks associated with the SOC Analyst role. This test is the first step towards becoming an active player in the security operations center. The potential individuals for the exam demonstrate the in-demand and trending technical skills in carrying out the entry-level and mid-level operations. The students will be measured based on their expertise in log correlation and management, advanced incident detection, SIEM deployment, incident detection, incident response, and management of different SOC processes.
NEW QUESTION 44
John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming.
Which of the following data source will he use to prepare the dashboard?
- A. DNS/ Web Server logs with IP addresses.
- B. DHCP/Logs capable of maintaining IP addresses or hostnames with IPtoName resolution.
- C. IIS/Web Server logs with IP addresses and user agent IPtouseragent resolution.
- D. Apache/ Web Server logs with IP addresses and Host Name.
Answer: D
NEW QUESTION 45
Which of the following formula represents the risk?
- A. Risk = Likelihood * Impact * Asset Value
- B. Risk = Likelihood * Severity * Asset Value
- C. Risk = Likelihood * Impact * Severity
- D. Risk = Likelihood * Consequence * Severity
Answer: D
NEW QUESTION 46
Robin, a SOC engineer in a multinational company, is planning to implement a SIEM. He realized that his organization is capable of performing only Correlation, Analytics, Reporting, Retention, Alerting, and Visualization required for the SIEM implementation and has to take collection and aggregation services from a Managed Security Services Provider (MSSP).
What kind of SIEM is Robin planning to implement?
- A. Cloud, Self-Managed
- B. Self-hosted, MSSP Managed
- C. Self-hosted, Self-Managed
- D. Hybrid Model, Jointly Managed
Answer: B
NEW QUESTION 47
What type of event is recorded when an application driver loads successfully in Windows?
- A. Information
- B. Warning
- C. Error
- D. Success Audit
Answer: A
NEW QUESTION 48
Which of the following are the responsibilities of SIEM Agents?
1.Collecting data received from various devices sending data to SIEM before forwarding it to the central engine.
2.Normalizing data received from various devices sending data to SIEM before forwarding it to the central engine.
3.Co-relating data received from various devices sending data to SIEM before forwarding it to the central engine.
4.Visualizing data received from various devices sending data to SIEM before forwarding it to the central engine.
- A. 1 and 2
- B. 3 and 1
- C. 2 and 3
- D. 1 and 4
Answer: D
NEW QUESTION 49
Which of the following technique protects from flooding attacks originated from the valid prefixes (IP addresses) so that they can be traced to its true source?
- A. Ingress Filtering
- B. Rate Limiting
- C. Throttling
- D. Egress Filtering
Answer: A
NEW QUESTION 50
Which of the following data source can be used to detect the traffic associated with Bad Bot User-Agents?
- A. Web Server Logs
- B. Router Logs
- C. Switch Logs
- D. Windows Event Log
Answer: A
NEW QUESTION 51
An organization is implementing and deploying the SIEM with following capabilities.
What kind of SIEM deployment architecture the organization is planning to implement?
- A. Self-hosted, Jointly Managed
- B. Self-hosted, Self-Managed
- C. Cloud, MSSP Managed
- D. Self-hosted, MSSP Managed
Answer: C
NEW QUESTION 52
Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.
Where will Harley find the web server logs, if he wants to investigate them for any anomalies?
- A. SystemDrive%\inetpub\logs\LogFiles\W3SVCN
- B. %SystemDrive%\LogFiles\logs\W3SVCN
- C. SystemDrive%\ inetpub\LogFiles\logs\W3SVCN
- D. SystemDrive%\LogFiles\inetpub\logs\W3SVCN
Answer: D
NEW QUESTION 53
A type of threat intelligent that find out the information about the attacker by misleading them is known as
.
- A. Operational Intelligence
- B. Detection Threat Intelligence
- C. Threat trending Intelligence
- D. Counter Intelligence
Answer: A
NEW QUESTION 54
Which of the following attack can be eradicated by disabling of "allow_url_fopen and allow_url_include" in the php.ini file?
- A. LDAP Injection Attacks
- B. Command Injection Attacks
- C. URL Injection Attacks
- D. File Injection Attacks
Answer: C
NEW QUESTION 55
Which of the following stage executed after identifying the required event sources?
- A. Validating the event source against monitoring requirement
- B. Implementing and Testing the Use Case
- C. Identifying the monitoring Requirements
- D. Defining Rule for the Use Case
Answer: A
NEW QUESTION 56
What does HTTPS Status code 403 represents?
- A. Forbidden Error
- B. Unauthorized Error
- C. Internal Server Error
- D. Not Found Error
Answer: A
NEW QUESTION 57
Jony, a security analyst, while monitoring IIS logs, identified events shown in the figure below.
What does this event log indicate?
- A. XSS Attack
- B. Directory Traversal Attack
- C. Parameter Tampering Attack
- D. SQL Injection Attack
Answer: C
NEW QUESTION 58
Which of the following attack can be eradicated by filtering improper XML syntax?
- A. Web Services Attacks
- B. Insufficient Logging and Monitoring Attacks
- C. SQL Injection Attacks
- D. CAPTCHA Attacks
Answer: C
NEW QUESTION 59
Wesley is an incident handler in a company named Maddison Tech. One day, he was learning techniques for eradicating the insecure deserialization attacks.
What among the following should Wesley avoid from considering?
- A. Deserialization of trusted data must cross a trust boundary
- B. Allow serialization for security-sensitive classes
- C. Validate untrusted input, which is to be serialized to ensure that serialized data contain only trusted classes
- D. Understand the security permissions given to serialization and deserialization
Answer: B
NEW QUESTION 60
Which of the following tool is used to recover from web application incident?
- A. Smoothwall SWG
- B. Symantec Secure Web Gateway
- C. CrowdStrike FalconTM Orchestrator
- D. Proxy Workbench
Answer: B
NEW QUESTION 61
Identify the type of attack, an attacker is attempting on www.example.com website.
- A. Cross-site Scripting Attack
- B. Denial-of-Service Attack
- C. Session Attack
- D. SQL Injection Attack
Answer: A
NEW QUESTION 62
Identify the attack, where an attacker tries to discover all the possible information about a target network before launching a further attack.
- A. Reconnaissance Attack
- B. Man-In-Middle Attack
- C. DoS Attack
- D. Ransomware Attack
Answer: A
NEW QUESTION 63
What does the Security Log Event ID 4624 of Windows 10 indicate?
- A. An account was successfully logged on
- B. A share was assessed
- C. Service added to the endpoint
- D. New process executed
Answer: A
NEW QUESTION 64
Which of the following contains the performance measures, and proper project and time management details?
- A. Incident Response Process
- B. Incident Response Tactics
- C. Incident Response Policy
- D. Incident Response Procedures
Answer: D
NEW QUESTION 65
Which of the following Windows Event Id will help you monitors file sharing across the network?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
NEW QUESTION 66
Shawn is a security manager working at Lee Inc Solution. His organization wants to develop threat intelligent strategy plan. As a part of threat intelligent strategy plan, he suggested various components, such as threat intelligence requirement analysis, intelligence and collection planning, asset identification, threat reports, and intelligence buy-in.
Which one of the following components he should include in the above threat intelligent strategy plan to make it effective?
- A. Threat boosting
- B. Threat pivoting
- C. Threat buy-in
- D. Threat trending
Answer: C
NEW QUESTION 67
Which of the following Windows features is used to enable Security Auditing in Windows?
- A. Windows Firewall
- B. Bitlocker
- C. Windows Defender
- D. Local Group Policy Editor
Answer: D
NEW QUESTION 68
......
312-39 Sample with Accurate & Updated Questions: https://www.test4engine.com/312-39_exam-latest-braindumps.html
312-39 Exam Info and Free Practice Test | Test4Engine: https://drive.google.com/open?id=1TRVslLGHrF_vTwqE9nOJ8sXUMAzaYYY7