312-39 Practice Questions

The co-managed model offers the best of both worlds for this scenario. The MSSP can provide the expensive and difficult-to-staff 24/7 monitoring, handling initial alert triage. The skilled in-house team can then focus on higher-level tasks, such as threat hunting and incident response, bringing their deep contextual understanding of the company's critical manufacturing and Operational Technology (OT) systems. This synergy is crucial for protecting an environment where downtime is unacceptable. The in-house team understands what is normal for their unique environment, which an MSSP alone would lack.

This activity is a port scan, a common reconnaissance technique used by attackers to discover open and listening services on a target system. The fact that many ports are being probed from a single source is the key indicator. The non-sequential nature of the scan is a common tactic used by tools like Nmap to evade simple, pattern-based detection.

Phishing email analysis is an ideal initial use case for SOAR. It is a high-volume, repetitive task with a well-defined process. A SOAR playbook can automatically: 1) extract observables (URLs, hashes, IPs) from the email, 2) query threat intelligence platforms for reputation, 3) detonate attachments in a sandbox, and 4) present the enriched data to an analyst for a final decision or even take automated actions like deleting similar emails. This provides immediate, significant time savings. Automating complex APT investigations is an advanced goal that requires a very mature SOAR implementation.

The best practice is to create an official incident ticket after the initial triage (Stage B) confirms that an alert is a potential incident and not an obvious false positive. Creating a ticket for every single raw alert (Stage A) would flood the system with noise. Once an alert is validated and requires further investigation (moving to Stage D), it should be formally tracked. This ensures that all legitimate investigations are documented, assigned, and managed through their lifecycle.

The most critical immediate step is to understand what the PowerShell command is attempting to do. Blocking the IP or isolating the host are containment actions that should be taken, but not before gaining context. Without understanding the payload, the analyst cannot determine the scope or severity of the incident. Decoding the Base64 string from the full log entry will reveal the actual commands being executed, providing the necessary intelligence to guide subsequent containment and eradication steps.

Modern attackers rarely use plain-text SQL injection strings. They employ various encoding techniques (URL encoding, Base64, etc.) and obfuscation methods to bypass simple string-matching rules. A rule that only looks for literal strings like 'UNION SELECT' is trivial to evade and will result in a high number of false negatives (missed attacks). A more effective rule would need to look for patterns, special characters, or use more advanced analytics that can decode and normalize log data before inspection.

PsExec works by installing a temporary service (PSEXESVC) on the remote machine to execute commands. This action generates a 'A service was installed in the system' event with Event ID 4697 in the Windows Security Log on the target host. Searching for this specific event across multiple workstations is a high-fidelity method for detecting PsExec usage. While firewall logs show the necessary SMB traffic, they don't confirm what the traffic is for. DNS logs are too generic. Process creation logs on the source machine would show psexec.exe running, but logs on the target machine provide definitive proof of the lateral movement.

MTTD measures the time from when an attack occurs until it is detected. A rising MTTD indicates a problem with the detection capabilities. This is often caused by poorly tuned SIEM rules, outdated threat intelligence, or gaps in log source coverage, leading to alerts being missed or delayed. Since MTTR (the time from detection to resolution) is stable, it means the response team is performing their job effectively once an incident is identified. Therefore, the problem lies in the detection phase, not the response phase.