Get 100% Success with Latest EC-COUNCIL CSA 312-39 Exam Dumps Mar 07, 2026 [Q43-Q65]

Q43. Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company and wanted to check the logs that are generated by access control list numbered 210.
What filter should Peter add to the ‘show logging’ command to get the required output?

Q44. Properly applied cyber threat intelligence to the SOC team help them in discovering TTPs.
What does these TTPs refer to?

Q45. If the SIEM generates the following four alerts at the same time:
I.Firewall blocking traffic from getting into the network alerts
II.SQL injection attempt alerts
III.Data deletion attempt alerts
IV.Brute-force attempt alerts
Which alert should be given least priority as per effective alert triaging?

Q46. Which of the following formula represents the risk levels?

Q47. John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming.
Which of the following data source will he use to prepare the dashboard?

Q48. Which of the following is a set of standard guidelines for ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection?

Q49. Which of the following directory will contain logs related to printer access?

Q50. Which of the following factors determine the choice of SIEM architecture?

Q51. An attacker exploits the logic validation mechanisms of an e-commerce website. He successfully purchases a product worth $100 for $10 by modifying the URL exchanged between the client and the server.
Original
URL: http://www.buyonline.com/product.aspx?profile=12
&debit=100
Modified URL: http://www.buyonline.com/product.aspx?profile=12
&debit=10
Identify the attack depicted in the above scenario.

Q52. Jason, a SOC Analyst with Maximus Tech, was investigating Cisco ASA Firewall logs and came across the following log entry:
May 06 2018 21:27:27 asa 1: %ASA -5 – 11008: User ‘enable_15’ executed the ‘configure term’ command What does the security level in the above log indicates?

Q53. If the SIEM generates the following four alerts at the same time:
I.Firewall blocking traffic from getting into the network alerts
II.SQL injection attempt alerts
III.Data deletion attempt alerts
IV.Brute-force attempt alerts
Which alert should be given least priority as per effective alert triaging?

Q54. Ray is a SOC analyst in a company named Queens Tech. One Day, Queens Tech is affected by a DoS/DDoS attack. For the containment of this incident, Ray and his team are trying to provide additional bandwidth to the network devices and increasing the capacity of the servers.
What is Ray and his team doing?

Q55. Which of the following formula is used to calculate the EPS of the organization?

Q56. Which of the following is a report writing tool that will help incident handlers to generate efficient reports on detected incidents during incident response process?

Q57. Jason, a SOC Analyst with Maximus Tech, was investigating Cisco ASA Firewall logs and came across the following log entry:
May 06 2018 21:27:27 asa 1: %ASA -5 – 11008: User ‘enable_15’ executed the ‘configure term’ command What does the security level in the above log indicates?

Q58. Which of the following Windows features is used to enable Security Auditing in Windows?

Q59. Which of the following is a default directory in a Mac OS X that stores security-related logs?

Q60. The Syslog message severity levels are labelled from level 0 to level 7.
What does level 0 indicate?

Q61. Which of the following Windows event is logged every time when a user tries to access the “Registry” key?

Q62. Which of the following formula is used to calculate the EPS of the organization?

Q63. Which attack works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?

Q64. John, a SOC analyst, while monitoring and analyzing Apache web server logs, identified an event log matching Regex /(.|(%|%25)2E)(.|(%|%25)2E)(/|(%|%25)2F|\|(%|%25)5C)/i.
What does this event log indicate?

Q65. Which of the following process refers to the discarding of the packets at the routing level without informing the source that the data did not reach its intended recipient?