CSA (312-39) SOC Simulation Lab

Step into the shoes of a Tier 3 SOC Analyst. In this simulation, you will differentiate between various cybersecurity frameworks and correctly identify which one maps tactical defensive countermeasures directly to adversarial techniques.

Scenario Context

You are an L2 SOC Analyst at T3ch Solutions. During a routine hunting shift, your EDR solution (CrowdStrike Falcon) flags an anomaly originating from a compromised developer workstation. An adversary is attempting to interact with the Local Security Authority Subsystem Service (LSASS) to dump plaintext credentials.

You escalate the incident and your IR team begins to execute an automated playbook. To formalize the response strategy and improve future detections, you document the incident by explicitly mapping the adversary's actions to specific, tactical countermeasures.

Security Environment

You review the automated playbook execution log from your SOAR platform to see how the defenses were mapped:

--- INTRUSION DETECTION ALERT --- Severity: HIGH Adversary Action: OS Credential Access (Target: lsass.exe) ATT&CK Tactic: Credential Access (TA0006) ATT&CK Technique: OS Credential Dumping (T1003) --- AUTOMATED DEFENSIVE PLAYBOOK MAPPING --- [+] Enforcing Defensive Technique mapping... -> Executing: Process Isolation (D3-PI) Result: Applied Protected Process Light (PPL) to LSASS to block unauthorized handle requests. -> Executing: Credential Encryption (D3-CE) Result: Verified Windows Defender Credential Guard is active and VBS is enforcing virtualization. -> Executing: Behavioral Analytics (D3-BAP) Result: EDR heuristics engine confirmed malicious intent; endpoint isolated from enterprise network.

Question

You are working at T3ch Solutions, global technology firm that provides web and software solutions to many multinational corporations across the globe. Your role is an L2 SOC analyst in their cybersecurity department. Your team detects an adversary attempting to bypass authentication controls and escalate privileges within the enterprise network. To counter the threat, you implement credential encryption, behavioral analytics, and process isolation. Your approach follows a structured framework that systematically maps defensive techniques to known adversarial tactics, allowing you to anticipate and mitigate evolving cyber threats. Which framework did you choose to apply in this scenario?

SOC Hint: Look at the tags in the SOAR log (e.g., "D3-PI", "D3-CE"). While MITRE ATT&CK is the encyclopedia of offensive techniques, this framework acts as its defensive counterpart, providing a matrix of specific countermeasures like "Process Isolation" and "Credential Encryption."

Expert Insight

What is actually happening here?

An adversary has gained initial access and is trying to escalate privileges by dumping credentials from system memory (e.g., using a tool like Mimikatz targeting lsass.exe). The SOC is not just randomly applying fixes; they are using a structured matrix to map the exact offensive technique (Credential Dumping) to the most effective defensive countermeasures (Process Isolation, Credential Encryption, Behavioral Analytics).

Why is "A. MITRE D3FEND Framework" the correct answer?

MITRE D3FEND stands for "Detection, Denial, and Disruption Framework Empowering Network Defense." It is a knowledge graph of cybersecurity countermeasures explicitly designed to map to the offensive tactics and techniques found in the MITRE ATT&CK framework. When you see specific tactical defenses like "Credential Encryption" and "Process Isolation" mapped systematically against adversarial actions, it points directly to D3FEND.

Why are the other options incorrect?

B. Cybersecurity Capability Maturity Model (CMMC): CMMC is a DoD certification framework used to verify that defense contractors have appropriate levels of cybersecurity controls in place. It measures program maturity, not tactical defensive techniques.
C. Systems Security Engineering CMM (SSE-CMM): This is an older process improvement framework that evaluates security engineering practices within an organization, focusing on methodology rather than specific technical countermeasures.
D. NIST Cybersecurity 2.0 (NIST CSF): While vital to SOCs, NIST CSF provides high-level outcomes (Govern, Identify, Protect, Detect, Respond, Recover). It guides organizational strategy but is not granular enough to provide a matrix of specific technical countermeasures mapped to individual adversary techniques.

SOC MINI LESSON: ATT&CK vs. D3FEND vs. NIST CSF

As a SOC analyst, you must know when to apply which framework. Think of them as operating at different altitudes:

Strategic Altitude (The "What" and "Why"): NIST CSF. Used by CISOs to build the security program. (e.g., "We need to Detect anomalies and Protect identities.")
Tactical Offensive Altitude (The "Red"): MITRE ATT&CK. Used by Threat Hunters and Red Teams to understand adversary behavior. (e.g., "The attacker is using T1003 OS Credential Dumping.")
Tactical Defensive Altitude (The "Blue"): MITRE D3FEND. Used by Detection Engineers and IR to build specific countermeasures. (e.g., "To counter T1003, we will implement D3-CE Credential Encryption via Windows Credential Guard.")

Want to improve your SOC detection logic and IR skills?

Explore more CSA 312-39 simulations on ExamRange ➔