Pass Your Exam Easily! 312-39 Real Question Answers Updated on Feb 23, 2023 [Q47-Q62]

NO.47 If the SIEM generates the following four alerts at the same time:
I.Firewall blocking traffic from getting into the network alerts
II.SQL injection attempt alerts
III.Data deletion attempt alerts
IV.Brute-force attempt alerts
Which alert should be given least priority as per effective alert triaging?

NO.48 Daniel is a member of an IRT, which was started recently in a company named Mesh Tech. He wanted to find the purpose and scope of the planned incident response capabilities.
What is he looking for?

NO.49 Which of the following data source can be used to detect the traffic associated with Bad Bot User-Agents?

NO.50 Which of the following is a Threat Intelligence Platform?

NO.51 An organization wants to implement a SIEM deployment architecture. However, they have the capability to do only log collection and the rest of the SIEM functions must be managed by an MSSP.
Which SIEM deployment architecture will the organization adopt?

NO.52 Which of the following process refers to the discarding of the packets at the routing level without informing the source that the data did not reach its intended recipient?

NO.53 Which of the following directory will contain logs related to printer access?

NO.54 Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.

NO.55 Which of the following formula represents the risk levels?

NO.56 Which of the following attack can be eradicated by converting all non-alphanumeric characters to HTML character entities before displaying the user input in search engines and forums?

NO.57 Which of the log storage method arranges event logs in the form of a circular buffer?

NO.58 Which of the following can help you eliminate the burden of investigating false positives?

NO.59 Robin, a SOC engineer in a multinational company, is planning to implement a SIEM. He realized that his organization is capable of performing only Correlation, Analytics, Reporting, Retention, Alerting, and Visualization required for the SIEM implementation and has to take collection and aggregation services from a Managed Security Services Provider (MSSP).
What kind of SIEM is Robin planning to implement?

NO.60 Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.

What does this event log indicate?

NO.61 What does [-n] in the following checkpoint firewall log syntax represents?
fw log [-f [-t]] [-n] [-l] [-o] [-c action] [-h host] [-s starttime] [-e endtime] [-b starttime endtime] [-u unification_scheme_file] [-m unification_mode(initial|semi|raw)] [-a] [-k (alert name|all)] [-g] [logfile]

NO.62 Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?