EC-Council 312-39 Practice Exam

EC-Council Certified SOC Analyst (CSA) 312-39

The EC-Council Certified SOC Analyst (CSA) 312-39 exam validates the skills of a Tier I or Tier II analyst in a security operations center. It covers eight domains: security operations and management, cyber threats, IoCs and attack methodology, log management, incident detection and triage with a SIEM, proactive threat detection, incident response, forensic investigation and malware analysis, and SOC for cloud environments, with SIEM detection and incident response the largest. This practice exam mirrors the real exam's single-answer multiple-choice questions, many in EC-Council's 'Which of the following' and named-scenario style.

Question bank updated : questions, answers, explanations and chapters.

Certification Overview

  • Exam name: CSA
  • Vendor: EC-Council
  • Exam code: 312-39
  • Duration: 180 minutes
  • Total questions: about 100
  • Official passing score: 70% (source)
  • Our practice exam pass mark: 70%

Who Should Take This Exam?

Tier I and Tier II SOC Analyst, Junior SOC Security Analyst, SOC Threat Analyst, Security Incident Response Analyst, Cybersecurity Analyst, Network and Security Administrator, Network Defense Engineer

Prerequisites

No formal prerequisite is published on the exam page; EC-Council recommends a basic knowledge of networking, TCP/IP, firewalls and IDS/IPS, and cyber threats.

Topics Covered

  • Security Operations and Management
  • Understanding Cyber Threats, IoCs, and Attack Methodology
  • Log Management
  • Incident Detection and Triage
  • Proactive Threat Detection
  • Incident Response
  • Forensics Investigation and Malware Analysis
  • SOC for Cloud Environments

Question Types

  • Multiple Choice (Single Answer)

CSA Practice Questions

Our question bank contains 700+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With full access, you get unlimited practice exams with randomised questions from our full question bank.

Security Operations and Management

A mid-sized insurer has no dedicated SOC facility. Staff from the IT and network teams watch security alerts from their normal desks and handle incidents as they arise, alongside their regular jobs. Which SOC model does this describe?
  • A. Virtual SOC Correct answer
  • B. Co-managed SOC
  • C. Command SOC
  • D. In-house dedicated SOC

Option A is correct because a virtual SOC has no dedicated facility and is staffed by part-time members who monitor and respond from their normal locations alongside other duties. A co-managed SOC shares work with an external provider, a command SOC coordinates other SOCs, and an in-house dedicated SOC has its own facility and full-time staff.

Which of the following is the main focus of security operations within an organization's security management?
  • A. Independent assessment, testing and reporting on control effectiveness
  • B. Risk appetite, policy approval and funding for the security program
  • C. IT budgeting, staffing and project planning for all business units
  • D. Daily monitoring, detection and response using the approved controls Correct answer

Option D is correct because security operations is the day-to-day function that monitors, detects and responds using controls the organization has already approved. Options A, B and C describe assurance, governance and budgeting work, which belong to audit and security management rather than operations.

A credit union's board approves a policy requiring round-the-clock monitoring of all customer-data systems. Which activity then falls to security operations rather than to security management?
  • A. Reviewing alerts from those systems and escalating confirmed incidents Correct answer
  • B. Deciding how much residual risk the board will accept for customer data
  • C. Mapping the policy to the regulations that apply to the credit union
  • D. Funding the monitoring program and approving its annual targets

Option A is correct because reviewing alerts and escalating confirmed incidents is the operational work of the SOC. Options B, C and D (setting risk acceptance, mapping regulations, and funding or approving targets) are management and governance decisions made above the operations level.

Understanding Cyber Threats, IoCs, and Attack Methodology

After a user opened a malicious macro-enabled document last week, an analyst sees the user's workstation sending small HTTPS requests to the same rarely seen domain every 60 seconds. In which phase of the Cyber Kill Chain does this activity fall?
  • A. Delivery
  • B. Exploitation
  • C. Command and control Correct answer
  • D. Installation

Option C is correct because small, regular beacons to a rarely seen external domain after a compromise show the infected host communicating with an attacker's server, which is the command and control phase. Delivery was the arrival of the document, exploitation was the macro running, and installation is the placing of the persistent malware.

Priya, a Tier 1 analyst at an online retailer, sees a volumetric flood against the storefront that network engineers are already mitigating. At the same time, a first-ever administrator login to the payment database arrives from an unfamiliar external address. Which action should she take first?
  • A. Block the login source address and resume the flood work
  • B. Escalate the flood to Tier 2 as the likely breach path
  • C. Join the engineers to restore storefront availability
  • D. Investigate the database login as a possible intrusion Correct answer

Option D is correct because a first-ever administrator login to the payment database from an unfamiliar external address is a possible intrusion, and a volumetric flood is a common distraction for exactly that. The network engineers already own the flood mitigation, so options B and C spend the analyst's time on the noisy event. Option A blocks the source but drops the investigation of what the login accessed.

Which network attack sends spoofed requests to open servers so that their much larger replies flood the victim?
  • A. ARP poisoning, redirecting local traffic
  • B. SYN flood, exhausting half-open connections
  • C. Reflection attack, abusing third-party servers Correct answer
  • D. Session hijacking, taking over a live connection

Option C is correct because a reflection (amplification) attack spoofs the victim's address in requests to third-party servers, which then send much larger replies to the victim. A SYN flood exhausts half-open connections, ARP poisoning is local, and session hijacking takes over an existing session, so none of them use open servers to amplify replies.

Log Management

A router sends a log message at syslog severity level 3. Which severity name does this level correspond to?
  • A. Notice
  • B. Critical
  • C. Warning
  • D. Error Correct answer

Option D is correct because syslog severity 3 is Error. The levels run 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational and 7 Debug, so Critical is 2, Warning is 4 and Notice is 5.

Linux servers in a company keep their logs only on local disks, and an intruder with root access could delete the evidence of a break-in. What is the best way for the SOC to protect the logs?
  • A. Restrict the log directory to the root account
  • B. Extend local log retention on each server to 90 days
  • C. Forward events to a central log server in real time Correct answer
  • D. Mirror the log directory to a second disk on the same server

Option C is correct because forwarding events in real time to a central log server means the evidence leaves the host before an intruder can alter it. Root can override permissions on the local directory, longer retention does not stop deletion, and a mirror on a second disk of the same server is still reachable by root.

Which of the following iptables log fields holds the destination port of the logged packet?
  • A. DST
  • B. DPT Correct answer
  • C. LEN
  • D. SPT

Option B, DPT, is correct because iptables LOG entries use DPT for the destination port and SPT for the source port. DST is the destination IP address and LEN is the packet length, so neither of them carries a port number.

Incident Detection and Triage

Which of the following is the first step when planning a SIEM deployment?
  • A. Define the business objectives and scope of monitoring Correct answer
  • B. Build dashboards for executive reporting
  • C. Tune the correlation rules to cut false positives
  • D. Onboard the firewall and server log sources to collectors

Option A is correct because a SIEM deployment starts by defining the business objectives and scope of monitoring, which decide the log sources, use cases and sizing. Dashboards, rule tuning and log source onboarding all come after the goals and scope are set.

A software startup runs all of its workloads in SaaS applications and one public cloud. It has no data center, nobody to patch or scale servers, and it wants SIEM storage that grows with log volume. Which type of SIEM deployment fits best?
  • A. Self-hosted open-source SIEM
  • B. Cloud-based SIEM Correct answer
  • C. On-premises SIEM appliance
  • D. Hybrid SIEM with on-site collectors

Option B is correct because a cloud-based SIEM removes the need to patch or scale servers and its storage grows with log volume, which suits an organization that runs only in SaaS and public cloud. Self-hosted, on-premises appliance and hybrid options all require the team to run infrastructure.

A SOC engineer uses a generative AI assistant to draft a SIEM correlation rule for suspicious PowerShell activity. What should the team do before enabling the rule in production?
  • A. Replace the existing log parsers with the field mappings the assistant suggested
  • B. Test the rule against historical logs and tune it to reduce false positives Correct answer
  • C. Upload a week of production logs to the AI service to refine the rule
  • D. Ask the assistant to score its own rule and deploy it if the score is high

Option B is correct because AI-generated detection content must be validated before production: testing it against historical logs and tuning it reduces false positives and shows whether it detects the behavior. Replacing working parsers, sending production logs to an external AI service, or letting the assistant grade its own rule skips independent validation and creates risk.

Proactive Threat Detection

Dmitri, a SOC lead at a utility company, wants a report describing how a threat group gains initial access, moves laterally and which tools it uses, so the SOC can plan its defenses against that group. Which type of threat intelligence should he request?
  • A. Tactical Correct answer
  • B. Strategic
  • C. Operational
  • D. Technical

Option A is correct because tactical threat intelligence describes the tactics, techniques and procedures of threat actors, such as initial access, lateral movement and tools, and is used by detection engineers and SOC analysts. Strategic intelligence is high-level for executives, operational intelligence covers specific campaigns and attacker intent, and technical intelligence is indicators such as hashes, IPs and domains.

In a YARA rule, which section contains the logical expression that decides whether a scanned file matches the rule?
  • A. meta
  • B. tags
  • C. condition Correct answer
  • D. strings

Option C is correct because the condition section of a YARA rule holds the Boolean expression that decides whether a file matches, usually combining the strings defined earlier. The meta section holds descriptive information, tags label the rule, and strings defines the patterns to look for but does not decide the match.

Incident Response

Rosa, a SOC analyst at a law firm, has four open alerts and time to start only one investigation. Which alert should she work first?
  • A. A scanner report listing 40 medium-severity findings on a test server
  • B. A critical-severity injection attempt blocked by the WAF on the public web server
  • C. An interactive service-account logon to a domain controller from an HR workstation Correct answer
  • D. An antivirus alert on a sales laptop for a file already quarantined

Option C is correct because an interactive logon by a service account to a domain controller from an HR workstation is anomalous and may signal credential misuse or lateral movement against a critical asset. The other alerts involve a test server, an attack already blocked by the WAF, and a file already quarantined, so they carry less immediate risk.

An EDR console flags a laptop running a process that matches known ransomware behavior. The analyst wants to stop it from spreading while keeping the host available for investigation. Which response action fits best?
  • A. Remotely shut the laptop down through the management console
  • B. Quarantine the matching attachment in all user mailboxes
  • C. Isolate the laptop from the network through EDR Correct answer
  • D. Lock the affected user's account in the directory service

Option C is correct because network isolation through the EDR stops the ransomware spreading while the console connection remains, so the host stays available for investigation and memory is preserved. Shutting down loses volatile evidence, quarantining the attachment in mailboxes does not contain the running host, and locking the account does not stop a process already running.

Forensics Investigation and Malware Analysis

Which of the following activities belongs to static malware analysis?
  • A. Running the file in an isolated VM and watching its registry changes
  • B. Reviewing the file's embedded strings and imported functions Correct answer
  • C. Capturing the traffic a sample sends while it is executing
  • D. Attaching a debugger to the process and stepping through its instructions

Option B is correct because static analysis examines a file without running it, such as reviewing its embedded strings and imported functions. Running it in a VM and watching registry changes, capturing its network traffic during execution, and stepping through it with a debugger are all dynamic analysis.

Which benefit does NTP clock synchronization give an investigation that spans many log sources?
  • A. Encrypted log transport to the SIEM
  • B. A reliable combined timeline of events Correct answer
  • C. Smaller log files on each host
  • D. Faster indexing of incoming logs

Option B is correct because NTP keeps every host and device clock aligned, so events from different log sources can be merged into one reliable timeline. NTP does not encrypt log transport (A), shrink log files (C) or speed up indexing (D).

SOC for Cloud Environments

A security team runs GuardDuty, Inspector and Macie in an AWS account and wants one place that aggregates and prioritizes their findings. Which service should they use?
  • A. AWS Security Hub Correct answer
  • B. AWS CloudTrail
  • C. Amazon Detective
  • D. AWS Config

Option A is correct because AWS Security Hub aggregates, normalizes and prioritizes findings from services such as GuardDuty, Inspector and Macie. CloudTrail records API activity, Amazon Detective investigates the root cause of findings, and AWS Config tracks resource configuration compliance.

Which Microsoft Sentinel component presents collected data as interactive dashboards and charts?
  • A. A workbook Correct answer
  • B. A playbook
  • C. An incident
  • D. A notebook

Option A is correct because a Sentinel workbook visualizes collected data as interactive dashboards and charts built on Azure Monitor workbooks. A playbook is an automated response workflow, an incident is a grouped set of alerts, and a notebook is a Jupyter-based hunting and investigation tool rather than a dashboard.

Free Study Guide

Read the free EC-Council 312-39 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.

More EC-Council Practice Exams

All EC-Council practice exams →

Practise with realistic mock exams to prepare for your EC-Council certification.