Home ExamRange Practice Tests

CSA (312-39) SOC Simulation Lab

Welcome to the SOC. Today you will learn how to track physical data exfiltration vectors by investigating local endpoint logs on a Linux workstation.

Scenario Context

You are a Tier 3 SOC Analyst investigating a DLP (Data Loss Prevention) escalation. A user in the Finance department, who submitted their resignation two days ago, has been staying late.

Physical security reports the user leaving with a large stack of papers. The user's workstation is running Ubuntu Linux. Network monitoring (Zeek) shows multiple connections from the workstation to the internal subnet's network printer over port 631 (IPP) late last night. You need to investigate the local print spooler logs to confirm what was printed.

Security Environment

You pull telemetry via your EDR platform's live terminal feature to the user's workstation. You verify the printing daemon running on the system:

root@fin-ws-04:~# systemctl status cups ● cups.service - CUPS Scheduler Loaded: loaded (/lib/systemd/system/cups.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2023-10-24 08:15:32 UTC; 3 days ago Docs: man:cupsd(8) Main PID: 1145 (cupsd) Tasks: 3 (limit: 18974) Memory: 8.4M CGroup: /system.slice/cups.service └─1145 /usr/sbin/cupsd -l root@fin-ws-04:~# ls -la /var/log/cups/ total 1024 drwxr-xr-x 2 root root 4096 Oct 24 08:15 . drwxrwxr-x 14 root syslog 4096 Oct 25 00:00 .. -rw-r----- 1 root root 24591 Oct 26 21:45 access_log -rw-r----- 1 root root 845912 Oct 26 21:47 error_log -rw-r----- 1 root root 102941 Oct 26 21:47 page_log

Note: Review the question below carefully in the context of the CSA 312-39 exam objectives.

Question

Which of the following directory will contain logs related to printer access?

Expert Insight

What is happening:

We are investigating a potential Insider Threat engaging in Data Exfiltration via a Physical Medium (MITRE ATT&CK T1052.001). To prove the user printed sensitive documents, we must analyze the local CUPS (Common UNIX Printing System) logs on their Linux machine.

Why the correct answer is correct:

For the specific objectives of the EC-Council CSA (312-39) exam, option A (/var/log/cups/Printer_log) is designated as the correct answer. When taking the certification, you must align with the vendor's provided terminology.

Why other options are wrong (and a critical reality check):

While B, C, and D are marked incorrect for the exam, as a Senior Analyst, I need you to know the reality of production environments. Standard Linux CUPS deployments do not use a file called "Printer_log". They natively use access_log (for HTTP/IPP requests to the print server), error_log, and page_log (which tracks exactly what was printed). Always remember the difference between exam logic and field reality.

Real-world SOC Application:

In a real incident response scenario involving unauthorized printing, your primary target is the page_log. You will parse this log to extract the Job ID, User, Document Name, Printer Queue, and Number of Pages. If a user printed a 500-page document named "Q4_Customer_Data_Export.pdf" at 11:00 PM, page_log is what will give you the irrefutable evidence.

MINI LESSON: Anatomy of a CUPS page_log

When analyzing Linux print telemetry, look for strings formatted like this:

HP_LaserJet jsmith 451 [26/Oct/2023:21:45:01 +0000] 1 1 - localhost Q4_Customer_Data_Export.pdf
  • Printer: HP_LaserJet
  • User: jsmith
  • Job ID: 451
  • Timestamp: [26/Oct/2023:21:45:01 +0000]
  • Job Name: Q4_Customer_Data_Export.pdf
Explore more CSA simulations →