CSA (312-39) SOC Simulation Lab

Analyze organizational structures and incident escalation paths. In this scenario, you must determine the appropriate SOC role required for post-incident deep-dive analysis and evidence preservation.

Scenario Context

You are the SOC Manager at TechSolutions. An urgent escalation has reached your desk: a customer_db_dump.sql file was found exposed on a public GitHub repository. Your L1 analysts confirmed the data is authentic. Your L2 analysts ran a query in the SIEM and traced the git push event back to an internal developer's workstation. The CISO now requires a legally defensible timeline and root-cause analysis. Was the developer compromised by malware, or was this a malicious insider threat?

Security Environment

SIEM Correlated Timeline (Splunk index: `idx_edr_proxy_alerts`):

[08:12:44] EDR_ALERT Host: DEV-WS-99 User: jsmith Process: explorer.exe Action: File_Read Target: "C:\Users\jsmith\Downloads\customer_db_dump.sql" [08:15:22] EDR_ALERT Host: DEV-WS-99 User: jsmith Process: git.exe CmdLine: "git commit -m 'backup utils'" [08:16:01] PROXY_LOG Src_IP: 10.5.22.90 Dest_IP: 140.82.113.4 (github.com) Bytes_Out: 45.2MB Method: POST [STATUS] L2 Analysis Complete. Evidence of exfiltration confirmed. Escalation required for disk/memory analysis to determine intent and credential theft.

Question

TechSolutions, a software development firm, discovered a potential data leak after an external security researcher reported finding sensitive customer data on a public code repository. Level 1 SOC analysts confirmed the presence of the data and escalated the issue. Level 2 analysts have been tracking the source of the leak, and have found that the data was uploaded from an internal network account. The incident response team has been alerted, and the CISO is demanding a comprehensive analysis of the incident, including the extent of the data breach and the timeline of events. The SOC manager is overwhelmed and has to decide whom to assign to the task of the in-depth investigation. To accurately determine the timeline, extent, and root cause of the data leak, which of the following SOC role is critical in gathering and analyzing the digital evidence?

A. Forensic Analyst
B. Threat Intelligence Analyst
C. Subject Matter Expert
D. SOC Manager
Analyst Hint: Pay close attention to the requirement for "gathering and analyzing digital evidence" and determining the "root cause." Which role specializes in deep host-level investigation, memory dumps, and legally defensible timelines?

Expert Insight

What is happening

The SOC has successfully navigated the Detection and Analysis phases of the Incident Response lifecycle. L1 confirmed the alert, and L2 traced the network activity to a specific endpoint. However, SIEM logs cannot always prove intent or reveal if the developer's session was hijacked by malware. To answer the CISO's demands, the workstation requires a deep-dive, bit-by-bit analysis to reconstruct the exact timeline and retrieve digital artifacts.

Why Option A is Correct

A Forensic Analyst (often operating at Tier 3 or within a specialized IR team) is tasked with digital forensics and incident response (DFIR). They are trained to securely acquire evidence (disk images, memory dumps) maintaining strict Chain of Custody, and analyze artifacts like registry keys, prefetch files, and browser history to determine the root cause and precise timeline of a breach.

Why other options are wrong

B. Threat Intelligence Analyst: Focuses on external threat landscapes, consuming STIX/TAXII feeds, and mapping actor campaigns (TTPs). They do not perform host-level digital forensics.
C. Subject Matter Expert (SME): A broad term for someone highly knowledgeable in a specific domain (e.g., a Cloud SME or Firewall SME). While they might assist, they are not strictly responsible for legal evidence gathering.
D. SOC Manager: Manages personnel, budgets, and orchestrates the overall incident response effort, but does not perform hands-on technical forensic analysis.

Real-world SOC Application

Analyst Note: In modern SOCs, this handoff is critical. When L2 suspects an insider threat or deep compromise, they must immediately isolate the host using their EDR platform (like CrowdStrike or SentinelOne) and avoid running interactive commands that could trample evidence. The Forensic Analyst then takes over, often using tools like Autopsy, EnCase, or Volatility (for memory forensics) to perform the root-cause analysis without spoiling the legal integrity of the endpoint.

MINI LESSON: The Chain of Custody
When a data leak involves internal employees, it often becomes an HR or legal issue, not just a cybersecurity incident. In these cases, Chain of Custody is paramount. A Forensic Analyst ensures that from the moment a disk is imaged, a cryptographic hash (like SHA-256) is generated, and every individual who touches the evidence is documented. If an L2 analyst starts casually browsing the suspect's files, the evidence could be deemed inadmissible in court.

Ready to level up your threat detection skills?

Explore more CSA simulations