PSAP Practice Questions - TCM Practical SOC Analyst Professional Exam - PSAP Practice Questions - TCM Practical SOC Analyst Professional Exam

Question 1

Which threat hunting maturity model level describes an organization that relies exclusively on automated alerting with no proactive hunting capability?

Level 0 — Initial Level 1 — Minimal Level 2 — Procedural Level 3 — Innovative

Correct Answer:

Level 0 — Initial

Question 2

A threat hunter is building a hypothesis before a hunt. Which input best drives a TTP-based hunting hypothesis according to the MITRE ATT&CK framework?

A specific ATT&CK technique observed in recent threat reports Known bad IP addresses from a threat feed Open vulnerability scanner findings Firewall block counts from the past 24 hours

Correct Answer:

A specific ATT&CK technique observed in recent threat reports

Question 3

During an investigation, an analyst observes a Windows process with a parent of 'svchost.exe' spawning 'cmd.exe' which in turn executes 'whoami.exe'. Which MITRE ATT&CK technique does this process tree most strongly suggest?

T1059.003 — Windows Command Shell T1055 — Process Injection T1543.003 — Windows Service T1078 — Valid Accounts

Correct Answer:

T1059.003 — Windows Command Shell

Question 4

Which PowerShell command-line artifact in Windows Event ID 4104 (Script Block Logging) most strongly indicates an attacker is attempting to bypass the Execution Policy?

-ExecutionPolicy Bypass -NonInteractive -WindowStyle Hidden -EncodedCommand

Correct Answer:

-ExecutionPolicy Bypass

Question 5

An analyst reviews Splunk logs and notices a spike in outbound DNS queries from a single endpoint to randomized 30-character subdomains of a single apex domain. What technique does this most likely indicate?

DNS Tunneling (C2) DNS Cache Poisoning DNS Zone Transfer BGP Hijacking

Correct Answer:

DNS Tunneling (C2)

Question 1

Exam overview

About this Exam

Prepare with the PSAP Practice Questions - TCM Practical SOC Analyst Professional Exam practice quiz. This question bank includes 100 questions covering threat, windows, analyst, hunter, and attacker. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

PSAP Practice Questions - TCM Practical SOC Analyst Professional Exam

This practice set contains 100 questions from the matching question bank and focuses on threat, windows, analyst, hunter, and attacker. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Keep studying

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

PSAP Practice Questions - TCM Practical SOC Analyst Professional Exam

Frequently Asked Questions

Related Questions

Certified Professional Public Buyer (CPPB) Practice Exam

Certified Supplier Quality Professional (CSQP) Practice Exam

Certified Supply Chain Professional (CSCP) Practice Exam

Certified Third-Party Risk Professional (CTPRP) Practice Exam

Certified Treasury Professional Practice Exam

Certified Treecare Safety Professional (CTSP) Practice Exam