Certified SOC Analyst (CSA) Certification Exam Questions 312-39 Study Guide

Are you familiar with the Certified SOC Analyst (CSA) certification exam? The Certified SOC Analyst (CSA) is one of the EC-Council certification exams, which is the first step to joining a security operations center (SOC). The 312-39 exam is available for the CSA certification, which helps the candidate acquire trending and in-demand technical skills through instruction by some of the most experienced trainers in the industry. 312-39 study guide, which was created by the top team of ITExamShop, are based on the actual 312-39 exam objectives, so we can be sure that the 312-39 ertified SOC Analyst (CSA) exam questions could be the best study guide for 100% passing. It is best to get started preparationon time with the valid EC-Council 312-39 exam questions.

Certified SOC Analyst (CSA) 312-39 Free Questions Are Below For Checking

Page 1 of 2

 Loading...

1. Which of the following tool is used to recover from web application incident?

CrowdStrike FalconTM Orchestrator

Symantec Secure Web Gateway

Smoothwall SWG

Proxy Workbench

Launch demo modal

 Loading...

2. Where will you find the reputation IP database, if you want to monitor traffic from known bad IP reputation using OSSIM SIEM?

/etc/ossim/reputation

/etc/ossim/siem/server/reputation/data

/etc/siem/ossim/server/reputation.data

/etc/ossim/server/reputation.data

Launch demo modal

 Loading...

3. According to the Risk Matrix table, what will be the risk level when the probability of an attack is very high, and the impact of that attack is major?

NOTE: It is mandatory to answer the question before proceeding to the next one.

High

Extreme

Low

Medium

Launch demo modal

 Loading...

4. According to the forensics investigation process, what is the next step carried out right after collecting the evidence?

Create a Chain of Custody Document

Send it to the nearby police station

Set a Forensic lab

Call Organizational Disciplinary Team

Launch demo modal

 Loading...

5. David is a SOC analyst in Karen Tech. One day an attack is initiated by the intruders but David was not able to find any suspicious events.

This type of incident is categorized into?

True Positive Incidents

False positive Incidents

True Negative Incidents

False Negative Incidents

Launch demo modal

 Loading...

6. Sam, a security analyst with INFOSOL INC., while monitoring and analyzing IIS logs, detected an event matching regex /\w*((%27)|(’))((%6F)|o|(%4F))((%72)|r|(%52))/ix.

What does this event log indicate?

SQL Injection Attack

Parameter Tampering Attack

XSS Attack

Directory Traversal Attack

Launch demo modal

 Loading...

7. Which of the following data source can be used to detect the traffic associated with Bad Bot User-Agents?

Windows Event Log

Web Server Logs

Router Logs

Switch Logs

Launch demo modal

 Loading...

8. Which of the following tool can be used to filter web requests associated with the SQL Injection attack?

Nmap

UrlScan

ZAP proxy

Hydra

Launch demo modal

 Loading...

9. Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?

$ tailf /var/log/sys/kern.log

$ tailf /var/log/kern.log

# tailf /var/log/messages

# tailf /var/log/sys/messages

Launch demo modal

 Loading...

10. In which of the following incident handling and response stages, the root cause of the incident must be found from the forensic results?

Evidence Gathering

Evidence Handling

Eradication

Systems Recovery

Launch demo modal

Page 2 of 2

 Loading...

11. Emmanuel is working as a SOC analyst in a company named Tobey Tech. The manager of Tobey Tech recently recruited an Incident Response Team (IRT) for his company. In the process of collaboration with the IRT, Emmanuel just escalated an incident to the IRT.

What is the first step that the IRT will do to the incident escalated by Emmanuel?

Incident Analysis and Validation

Incident Recording

Incident Classification

Incident Prioritization

Launch demo modal

 Loading...

12. An attacker exploits the logic validation mechanisms of an e-commerce website. He successfully purchases a product worth $100 for $10 by modifying the URL exchanged between the client and the server.

Original URL: http://www.buyonline.com/product.aspx?profile=12&debit=100 Modified URL:

http://www.buyonline.com/product.aspx?profile=12&debit=10

Identify the attack depicted in the above scenario.

Denial-of-Service Attack

SQL Injection Attack

Parameter Tampering Attack

Session Fixation Attack

Launch demo modal

 Loading...

13. Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.





What does this event log indicate?

Directory Traversal Attack

XSS Attack

SQL Injection Attack

Parameter Tampering Attack

Launch demo modal

 Loading...