Free EC-COUNCIL 312-39 Exam Dumps Questions & Answers

In which phase of Lockheed Martin's - Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?

• A.  Reconnaissance
• B.  Weaponization
• C.  Delivery
• D.  Exploitation

Properly applied cyber threat intelligence to the SOC team help them in discovering TTPs.
What does these TTPs refer to?

• A.  Tactics, Targets, and Process
• B.  Targets, Threats, and Process
• C.  Tactics, Techniques, and Procedures
• D.  Tactics, Threats, and Procedures

A health corporation is implementing a SIEM solution to improve detection and response and comply with HIPAA requirements. They need the SIEM to efficiently collect, analyze, and correlate security events from network devices, servers, and security applications, and generate timely alerts for potential HIPAA violations.
Which capability is needed to meet these needs?

• A.  Log management and security analytics
• B.  Centralized SIEM implementation
• C.  Threat hunting and intelligence
• D.  Log collection through agents

A threat hunter analyzing an infected endpoint finds that malicious processes keep reappearing even after termination, making traditional remediation ineffective. The user reports slowdowns, abnormal pop-ups, and unauthorized application launches. Deeper inspection reveals multiple scheduled tasks executing unknown scripts at intervals, along with suspicious registry modifications enabling automatic execution on startup. The endpoint makes intermittent encrypted outbound connections to an unclassified external server. The organization also observed multiple failed privileged logins from the same subnet. Which signs should the threat hunter look for to confirm and mitigate the threat?

• A.  Network-based artifacts
• B.  Indicators of Attack (IoAs)
• C.  Threat intelligence and adversary context
• D.  Host-based artifacts

The SOC team at a national cybersecurity agency detects anomalous network traffic from a sensitive government server and escalates to forensics. The forensic team discovers a trojan suspected of data exfiltration and persistence. The lead malware analyst must determine capabilities and persistence mechanisms by analyzing the trojan's binary code at the instruction level without executing it. Which technique should the analyst use?

• A.  Malware disassembly
• B.  Interactive debugging
• C.  Dynamic code injection
• D.  Network behavior monitoring