Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 21Question →

A network administrator needs to establish a remote management session to perform critical database maintenance from an untrusted external network. Arrange the following network boundary transit steps and control points in the correct order, starting from the external connection initiation to the final session establishment on the internal database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with external session initiation, passes North-South inspection at the perimeter firewall into the DMZ, authenticates at the bastion host, undergoes East-West firewall rule evaluation, and terminates at the isolated database server.
In a secure multi-tiered network design, incoming external administrative traffic must first cross the perimeter firewall into a screened network segment (DMZ). The session is authenticated and proxied by a DMZ bastion host before initiating a separate internal connection. This East-West transit from the DMZ to the internal database zone is separately controlled and filtered by an internal firewall before reaching the destination database server.

Step-by-Step Solution

1
Identify the entry point of external network traffic.
The initial step is the remote administrator workstation sending traffic across the Internet toward the enterprise network edge.
Traffic originates at the remote client before reaching internal enterprise security controls.
2
Evaluate perimeter access control and DMZ redirection.
The perimeter firewall processes North-South ingress traffic and restricts access directly to the DMZ bastion host.
Secure network design prohibits direct external access to internal subnets; all management traffic must terminate in a screened zone first.
3
Enforce identity verification and administrative proxy controls.
The DMZ bastion host authenticates the administrator via MFA and establishes a proxy channel.
Jump servers/bastion hosts act as intermediate staging points to validate identity before granting access to internal zones.
4
Inspect inter-zone East-West network traffic.
The internal firewall evaluates rule sets governing traffic moving between the DMZ subnet and the internal database subnet.
Internal segment isolation ensures that only explicitly permitted source IP addresses (the bastion host) can connect across internal zone boundaries.
5
Complete session establishment on the internal target endpoint.
The database server receives and accepts the management session request.
The destination endpoint processes the connection request after all perimeter and internal segmentation controls have validated the flow.

Key Concept

Multi-Tier Network Boundary Segmentation and Jump Server Session Transit Controls
Estimated Time:1m 30s
Question 22Question →

A security architect is reviewing the access control path for remote administrators connecting from an untrusted management subnet to a high-security internal database zone holding regulated financial records. To enforce defense-in-depth and zero-trust principles, traffic must traverse multiple inspection boundaries and transit controls in a precise order. Sequence the security controls and transit points in the correct order that administrative network traffic must navigate from the originating management workstation to the target database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts at the perimeter firewall filtering incoming management traffic, proceeds to session establishment on the Jump Server in the DMZ, moves through the internal NGFW performing East-West inspection, and finishes at the microsegmented target switch port and host boundary.
In secure network architecture, traffic moving from an outer management zone to an inner critical zone follows a strict transit path: 1) Initial perimeter firewall filtering, 2) Intermediate bastion/jump box session proxying in a DMZ, 3) Internal NGFW microsegmentation and East-West inspection, and 4) Final Layer 2 PVLAN and host-level enforcement.

Step-by-Step Solution

1
Filter ingress connection attempts at the perimeter boundary.
Unsanctioned external traffic is blocked before entering management proxies.
Perimeter firewalls filter initial traffic entering from outer or untrusted administrative networks.
2
Terminate administrative credentials and session handling on a dedicated Jump Server within the DMZ.
Direct connections between management workstations and internal databases are prevented.
Bastion hosts act as authorized intermediate transit points for administrative commands.
3
Inspect inter-zone (East-West) traffic leaving the Jump Server using an internal NGFW.
Application-layer protocols and microsegmentation rules are verified before traffic crosses into internal zones.
Internal firewalls enforce granular policy barriers between DMZ transit hosts and restricted database tiers.
4
Deliver traffic to the destination database server host across Private VLAN (PVLAN) isolated switch ports.
Target server accepts traffic exclusively from the authorized NGFW gateway IP.
Layer 2 PVLAN isolation and endpoint firewalls ensure lateral isolation within the database subnet itself.

Key Concept

Zone Traversal and Network Segmentation Order
Question 23Question →

A security analyst is configuring a new Security Information and Event Management (SIEM) solution. Place the core stages of the SIEM log processing pipeline in the correct sequential order from initial log entry to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of stages in a SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
In a standard SIEM processing pipeline, raw log data is gathered via Log Collection, extracted into data fields via Parsing, converted to a unified taxonomy during Normalization, cross-analyzed against rules during Correlation, and dispatched to analysts during Alerting.

Step-by-Step Solution

1
Identify the initial log ingestion activity.
Log Collection occurs first as raw data must be received from source devices before processing.
Data cannot be parsed or analyzed until it is ingested by the SIEM collector.
2
Extract raw fields from collected logs.
Parsing splits unstructured log strings into discrete key-value pairs.
Specific attributes must be recognized within raw log strings before standardizing formats.
3
Standardize variable names and field formats.
Normalization converts heterogeneous fields into a unified system schema.
Standardized data structures allow consistent cross-source log analysis.
4
Evaluate normalized data against rule engines.
Correlation cross-references standardized events across different logs to identify indicators of compromise.
Pattern identification requires normalized inputs from multiple security sources.
5
Dispatch notification of identified incidents.
Alerting informs analysts or triggers security orchestration when correlation logic fires.
Alerting is the final outcome of pipeline processing intended to initiate human or automated incident response.

Key Concept

SIEM Log Processing Pipeline
Question 24Question →

During the deployment of a new Security Information and Event Management (SIEM) system, a security engineer is configuring the automated pipeline for handling enterprise security events. Arrange the stages of the SIEM data processing pipeline in the correct chronological order from initial log intake to final analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the SIEM log processing pipeline is: Log Collection and Ingestion -> Parsing and Normalization -> Event Correlation -> Alert Generation and Dispatch.
The correct sequence reflects the standard data lifecycle within a SIEM: raw log streams are ingested from hosts and networks, normalized into standard field formats, evaluated by correlation logic to detect multi-event attack patterns, and finally dispatched as actionable alerts to security analysts.

Step-by-Step Solution

1
Identify the initial data intake phase
Log Collection and Ingestion occurs first as raw data must be gathered from sources before processing.
Without raw log intake, no downstream parsing or analysis can occur.
2
Identify the data formatting phase
Parsing and Normalization occurs second to standardize field names and structures across disparate sources.
Correlation rules require standardized fields (like source IP or username) to evaluate events across different log sources.
3
Identify the detection and rule evaluation phase
Event Correlation occurs third as normalized data is evaluated against threat logic and correlation rules.
SIEM rules analyze relationships between parsed events to identify multi-source security incidents.
4
Identify the notification phase
Alert Generation and Dispatch occurs last when correlation rules trigger security alerts for SOC analysts.
Alerting is the output produced after an incident scenario is identified by correlation logic.

Key Concept

SIEM Log Processing Pipeline
Question 25Question →

A security administrator must securely access an internal database server located within a restricted database zone from a remote management workstation. Place the following connection and transit steps in the correct sequential order from initial external access to final database session establishment according to secure network design principles.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with authenticating to the DMZ bastion host using MFA, passing posture and AAA checks on the bastion, traversing the internal stateful firewall via restrictive bastion-to-database rules, and finally establishing the privileged database session.
Secure network design dictates that administrative access to sensitive internal zones (such as a database subnet) must pass through a jump server located within a DMZ or management zone. First, the administrator must authenticate to the bastion host using MFA. Second, device posture and AAA authorization controls evaluate the session on the bastion host. Third, the connection traverses the internal stateful firewall, which uses tight microsegmentation rules to permit transit only from the bastion host IP address to the database server port. Finally, the user establishes the authenticated session on the internal target database.

Step-by-Step Solution

1
Initiate connection to the perimeter management DMZ
Administrator successfully authenticates to the jump box via MFA at the network boundary.
Direct connections from remote devices into internal secure zones are prohibited by network segmentation policies.
2
Perform posture and access authorization validation on the jump box
The bastion gateway verifies device health and confirms administrative permissions.
Zero trust microsegmentation requires verifying identity and device security posture before allowing transit deeper into the network.
3
Pass through internal stateful firewall microsegmentation controls
Network traffic is permitted through the internal boundary filter specifically targeting the database zone.
Internal firewalls should enforce strict firewall policies allowing DB ports only from the specific IP address of the jump box.
4
Authenticate to the internal target database server
Privileged database administration session begins inside the target subnet.
This is the final destination node requiring database-level credential verification.

Key Concept

Bastion Host Transit & Secure Network Segmentation
Question 26Question →

A enterprise security architect is configuring an automated cross-region database failover workflow between two active-passive data centers to maintain zero Recovery Point Objective (RPO) and minimal Recovery Time Objective (RTO) during an ungraceful outage. Arrange the operational steps of the automated failover sequence in the correct chronological order from first step executed to final step completed.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for automated database failover is: 1) Evaluate cluster quorum consensus via an independent witness site; 2) Execute node fencing (STONITH) to forcibly isolate the failed primary database; 3) Verify write-ahead log sequence numbers (LSN) on the standby node; 4) Promote the standby database instance to read-write state; 5) Update Global Server Load Balancing (GSLB) health checks and DNS records.
The sequence follows standard high-availability resiliency protocols: Cluster quorum must first be established to prevent split-brain, followed immediately by STONITH fencing of the legacy node. Once fenced, data consistency (LSN sync) must be verified on the target node before promoting it to primary. Finally, global network routing (GSLB/DNS) is updated to steer client traffic to the newly active environment.

Step-by-Step Solution

1
Quorum Validation
Cluster consensus confirmed via witness node.
Prevents split-brain scenarios where both nodes concurrently assume primary role.
2
Node Fencing
Unresponsive primary node isolated and write privileges revoked.
Guarantees data integrity and prevents corrupting writes from a flapping primary server.
3
Log Sequence Synchronization Audit
Standby database confirms all synchronous transactions are committed.
Ensures adherence to the zero Recovery Point Objective (RPO) requirement before promotion.
4
Node Promotion
Secondary database becomes active write target.
Establishes a functional database primary capable of accepting new application transactions.
5
Traffic Redirection
GSLB points application requests to the newly promoted site.
Completes failover by restoring service availability to end clients.

Key Concept

High-Availability Failover & Fencing Sequences
Question 27Question →

A Security Operations Center (SOC) engineer is building an automated Security Information and Event Management (SIEM) pipeline to process multi-cloud telemetry and on-premises event streams. To ensure correlation rules operate efficiently and reduce false positives, log data must be processed in a precise operational order. What is the correct sequence of stages for log processing within a SIEM pipeline from initial data reception to security incident notification?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of the SIEM pipeline stages is: Log Ingestion and Collection, followed by Parsing and Normalization, followed by Contextual Enrichment, followed by Rule Correlation, and concluding with Alerting and Incident Dispatch.
The SIEM log processing pipeline follows a logical data flow: First, Log Ingestion and Collection gathers raw event data from distributed endpoints. Second, Parsing and Normalization converts unformatted raw strings into standard key-value fields with unified UTC timestamps. Third, Contextual Enrichment adds value to parsed fields by attaching threat intelligence markers, asset risk levels, and location data. Fourth, Rule Correlation analyzes these normalized and enriched events against rule logic across time windows to detect suspicious patterns. Finally, Alerting and Incident Dispatch triggers analyst notifications and SOAR response playbooks upon confirmed rule matches.

Step-by-Step Solution

1
Identify the entry point of the SIEM data pipeline.
Raw logs must first be gathered from source systems (firewalls, servers, cloud APIs) via collectors.
Data cannot be transformed or analyzed before it is ingested into the system.
2
Determine the data structuring requirement.
Raw logs are parsed into key-value pairs and timestamps are normalized to UTC.
Correlation and querying require standardized field structures across disparate log sources.
3
Apply contextual intelligence to structured logs.
Enrich normalized fields with GeoIP data, threat feeds, and asset risk scores.
Enrichment depends on having distinct, standardized fields (like source IP) to look up external context.
4
Evaluate enriched events against threat detection logic.
Run events through correlation rules across time-windowed cross-source event streams.
Correlation logic requires enriched contextual data and normalized fields to reliably match patterns across different sources without false positives.
5
Identify the final output phase of the pipeline.
Trigger SOC console alerts, ticketing, and SOAR orchestration responses.
Alerting is the output triggered only after correlation conditions are satisfied.

Key Concept

SIEM Log Processing Pipeline Order
Estimated Time:2m 0s
Question 28Question →

A security administrator is reviewing the automated failover process for a high-availability cluster to ensure continuous operations during a hardware failure. What is the correct order of steps the cluster system takes when a primary node fails?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with detecting the node failure via heartbeat loss, followed by fencing the primary node to prevent split-brain condition, promoting the secondary node and assigning the virtual IP, and concluding with service initialization and client traffic resumption.
In high-availability clustering, failover must strictly proceed from failure detection (heartbeat loss) to node fencing (isolation), followed by role promotion/virtual IP takeover, and finally service resumption. Fencing must occur before promotion to protect data integrity against split-brain scenarios.

Step-by-Step Solution

1
Detect primary node failure
Heartbeat loss alerts the cluster that the primary node is offline or unreachable.
Monitoring tools must detect an outage before initiating automated failover.
2
Isolate the failed primary node
Fencing (such as STONITH) cuts off the unresponsive node's access to shared resources.
Prevents split-brain scenarios where two nodes simultaneously act as primary and corrupt shared data.
3
Promote standby node and reassign virtual network identities
The secondary node changes state to active and rebinds the virtual IP address to its interface.
Ensures network traffic directed to the cluster IP gets routed to the new active node.
4
Resume application processing
Services start up completely and handle incoming user sessions.
Completes the failover procedure to achieve high availability.

Key Concept

High-Availability Automated Failover Sequence and Fencing
Question 29Question →

A security engineer is configuring an enterprise Security Information and Event Management (SIEM) system to process event data collected from heterogeneous endpoints and network appliances across the organization. Arrange the stages of the SIEM log processing pipeline in the correct chronological sequence from initial log capture to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of stages in a SIEM log processing pipeline is: 1) Log Ingestion and Collection, 2) Parsing and Normalization, 3) Event Correlation, and 4) Alert Generation.
The standard SIEM data ingestion lifecycle begins with raw log collection from target endpoints and systems. Once ingested, raw logs are parsed and normalized into a unified structure so that different log formats share common field definitions. The SIEM correlation engine then processes these normalized events against correlation rules and threat intelligence to identify complex threat patterns across multiple hosts. Finally, when correlation conditions are satisfied, the SIEM generates alerts and notifications for security analyst response.

Step-by-Step Solution

1
Identify the initial source interaction stage.
Raw event streams are gathered from remote agents, syslog, and enterprise applications.
Log Ingestion and Collection must occur first because data cannot be formatted or analyzed until it is acquired from source devices.
2
Determine how heterogeneous log data is standardized.
Raw entries are parsed into key-value pairs and mapped to a single unified field schema.
Parsing and Normalization must follow collection so that events from different vendors can be understood under common variable names.
3
Analyze how standardized logs are processed for security logic.
Normalized event logs from disparate systems are analyzed simultaneously against security correlation rules.
Event Correlation requires normalized data to effectively evaluate multi-source telemetry and recognize complex attack vectors.
4
Determine the final output step of the pipeline.
Notifications and incident tickets are dispatched to security analysts for investigation.
Alert Generation occurs as the end result when correlation rules confirm actionable threat indicators.

Key Concept

SIEM Log Processing Lifecycle
Estimated Time:1m 30s
Question 30Question →

An enterprise web application triggers a high-severity alert indicating that an active OAuth access token is simultaneously originating requests from two geographically disparate IP addresses. A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to remediate the account takeover attempt while preserving evidence. Place the following SOAR automated playbook steps into the correct execution sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for the SOAR playbook is: 1) Ingest the API Gateway anomaly webhook event, 2) Query threat intelligence and identity logs for enrichment, 3) Execute API requests to revoke OAuth tokens and terminate user sessions, 4) Push automated API commands to the WAF to block malicious IPs, and 5) Create an enriched ITSM incident ticket with attached forensic artifacts.
A standard SOAR automated incident response workflow adheres to a strict logical lifecycle. First, the playbook ingests the security alert payload from the detection system (API Gateway). Second, it queries external Threat Intelligence Platforms and Internal Identity Providers to enrich the alert with reputation scores and session metadata. Third, it performs identity-level containment by revoking active OAuth tokens and invalidating sessions via API integrations to neutralize compromised credentials instantly. Fourth, it enforces perimeter network filtering at the WAF to block malicious source IPs. Finally, it documents all orchestration actions, attaches collected evidence, and opens/updates an ITSM ticket for analyst review.

Step-by-Step Solution

1
Trigger & Ingestion
The SOAR platform receives the initial security event payload from the API Gateway.
Automation workflows cannot process data until the initial alert webhook is ingested into the orchestration engine.
2
Automated Contextual Enrichment
IP reputation scores and IdP session details are attached to the incident context.
Enrichment provides necessary context and validates the anomaly before executing destructive containment actions.
3
Identity & Account Containment
The compromised token is revoked and active user sessions are terminated.
Direct identity containment prevents further authenticated access regardless of the attacker's network location.
4
Infrastructure & Perimeter Containment
Network traffic from the attacker's IP addresses is dropped at the WAF boundary.
Network mitigation blocks ongoing unauthenticated scan or attack traffic from the malicious source IPs.
5
Documentation & ITSM Escalation
An incident ticket is updated with full audit trails, context, and mitigation status.
Recording automated actions ensures compliance, chain of custody, and operational visibility for SOC analysts.

Key Concept

SOAR Playbook Execution Order (Ingestion -> Enrichment -> Containment -> Documentation)
Question 31Question →

An organization is aligning its cybersecurity procedures with the NIST SP 800-61 incident response framework. Place the core phases of the incident response process in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of the incident response lifecycle is Preparation, followed by Detection and Analysis, then Containment, Eradication, and Recovery, and ending with Post-Incident Activity.
According to the NIST SP 800-61 framework, the incident response lifecycle progresses through four major phases: Preparation (setting up tools, policies, and teams), Detection and Analysis (identifying and investigating security events), Containment, Eradication, and Recovery (limiting impact, eliminating the threat, and restoring operations), and Post-Incident Activity (conducting lessons learned to refine future response).

Step-by-Step Solution

1
Identify the foundational phase established prior to active incidents.
Preparation is identified as the first phase.
Security teams must develop playbooks, configure monitoring tools, and establish communication plans before a security event occurs.
2
Determine the phase initiated when anomalous activity or security alerts are reported.
Detection and Analysis is identified as the second phase.
Analysts must evaluate alerts, scope the impact, and validate whether an active breach or compromise is taking place.
3
Identify the active response and mitigation actions taken after confirmation of an incident.
Containment, Eradication, and Recovery is identified as the third phase.
Responders must limit damage by containing affected systems, eliminate root causes/malware, and securely restore services.
4
Determine the final phase following complete system restoration.
Post-Incident Activity is identified as the fourth phase.
Conducting lessons-learned analysis and updating documentation ensures continuous improvement of the organization's security posture.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 32Question →

A network security architect is establishing ingress and zone traversal inspection controls for a public-facing e-commerce platform. The architecture requires multi-tiered network segmentation to isolate external web traffic from sensitive internal backend databases. In what order should inbound network traffic pass through these security controls and network zones, starting from initial external ingress to the final destination in the isolated database zone?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for inbound traffic traversal begins at the Perimeter Edge Router with Anti-DDoS Filtering, moves to the Screened Subnet (DMZ) Web Application Firewall (WAF), passes through the Internal Next-Generation Firewall (NGFW) Enforcement Boundary, and completes at the Database Zone Microsegmentation Gateway.
In a defense-in-depth architecture, external traffic must be inspected in progressive layers of increasing security. Traffic first hits the perimeter edge router for high-volume network filtering, enters the Screened Subnet (DMZ) WAF for web application inspection, crosses the internal firewall boundary to reach application services, and finally passes through microsegmentation controls protecting the high-value database zone.

Step-by-Step Solution

1
Filter network-layer threats at the external entry point
Volumetric DDoS traffic and spoofed IP packets are blocked at the perimeter edge router before reaching internal services.
Perimeter routers protect edge infrastructure from being overwhelmed by raw network traffic.
2
Perform application-layer payload inspection in the public-facing DMZ
Web traffic is decrypted and inspected by the Web Application Firewall (WAF) in the screened subnet for web vulnerabilities such as SQL injection or XSS.
Public-facing web services must terminate in a DMZ so untrusted external sessions never reach internal networks directly.
3
Enforce network boundary controls between DMZ and internal application servers
The internal NGFW validates stateful traffic rules allowing only authorized web application requests into the internal application tier.
An internal boundary control prevents compromised DMZ hosts from directly traversing into sensitive enterprise network segments.
4
Apply microsegmentation policy at the high-security database tier
The microsegmentation gateway isolates database servers and ensures only approved application server nodes can communicate using specific database ports.
Microsegmentation enforces zero trust granularity around high-value backend data assets.

Key Concept

Multi-tier network segmentation and defense-in-depth traffic flow inspection
Question 33Question →

Place the core stages of the Security Information and Event Management (SIEM) log processing pipeline in the correct sequential order from initial intake to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the SIEM log processing pipeline is Log Collection, followed by Parsing and Normalization, then Event Correlation, and finally Alert Generation.
The standard SIEM data ingestion workflow begins with raw Log Collection from enterprise systems. These logs undergo Parsing and Normalization so that events from diverse operating systems and security appliances fit a common data model. Once normalized, the SIEM executes Event Correlation across logs to detect complex multi-host attack patterns. When correlation threshold rules are met, the system performs Alert Generation to notify security analysts.

Step-by-Step Solution

1
Identify the initial data ingestion phase
Log Collection occurs first as raw logs must be collected from disparate endpoint and network sources before processing.
Downstream parsing and analysis tools require raw event data to operate.
2
Identify the data structuring phase
Parsing and Normalization occurs second to reformat incoming raw text logs into standard, structured fields.
SIEM engines require consistent field definitions across different log vendors to execute detection logic.
3
Identify the threat detection and analysis phase
Event Correlation occurs third to analyze structured logs against rule sets and baseline behaviors.
Correlation logic depends on pre-normalized fields to associate related events across different systems.
4
Identify the incident escalation phase
Alert Generation occurs last when correlation conditions indicate a potential security event.
Alerting informs analysts only after potential threat indicators have been identified and prioritized.

Key Concept

SIEM Log Processing Pipeline
Question 34Question →

An incident response specialist is preparing to collect evidence from an active, powered-on server involved in a security incident. In what sequence should the specialist acquire the following digital evidence sources to strictly adhere to the Order of Volatility, moving from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most volatile to least volatile is: CPU cache and registers, System Random Access Memory (RAM), Temporary swap space and pagefiles, and Local solid-state or hard disk drive storage.
Digital evidence acquisition must follow the Order of Volatility to prevent the loss of ephemeral data. The standard sequence begins with ultra-transient CPU cache and registers, proceeds to live system RAM, moves to temporary disk swap/pagefile space, and finishes with non-volatile local disk storage.

Step-by-Step Solution

1
Identify the data source with the shortest life expectancy.
CPU cache and registers are identified as the most volatile.
CPU registers and memory caches alter content with every clock cycle and instruction execution.
2
Identify active dynamic system memory.
System Random Access Memory (RAM) is placed second.
RAM holds volatile runtime environment details that vanish if power is disconnected or the operating system halts.
3
Identify secondary virtual memory files stored on disk.
Temporary swap space and pagefiles are placed third.
Swap/pagefiles contain memory artifacts written to storage, changing regularly during system operation but less ephemeral than physical RAM.
4
Identify non-volatile persistent storage media.
Local solid-state or hard disk drive storage is placed fourth.
Disk drives store non-volatile data that remains intact even after a system is powered off.

Key Concept

Order of Volatility (RFC 3227)
Question 35Question →

A security operations team has confirmed a active malware infection on a financial database administrator's workstation. Arrange the incident response playbook actions in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with host network isolation (containment), followed by volatile memory acquisition (forensics/preservation), followed by system sanitization and image restoration (eradication/recovery), and concludes with the post-incident review (lessons learned).
According to NIST SP 800-61 standards, once an incident is confirmed, the immediate step is Containment (isolating the host from the network). Next comes Evidence Preservation (capturing volatile RAM while the machine is running). Following evidence collection, Eradication and Recovery take place (removing malware and re-imaging from clean media). Finally, Post-Incident Activities (lessons learned) occur once operations return to normal.

Step-by-Step Solution

1
Isolate the infected host from the enterprise network.
Containment is achieved, halting active command-and-control communication and lateral propagation.
Immediate containment stops potential compromise progression before pursuing offline analysis.
2
Acquire volatile memory evidence prior to system shutdown.
RAM memory dump and volatile system state are preserved for investigation.
Volatile data resides in RAM and will be permanently lost if the machine is powered off or rebooted during remediation.
3
Perform eradication of threat artifacts and execute recovery procedures.
Malware persistence is removed and the system is safely restored to operational status from a verified baseline.
Eradication ensures the environment is clean before returning the system to production.
4
Hold a post-incident review and update documentation.
Lessons learned are compiled into an incident report to improve security operations.
Post-incident analysis evaluates performance metrics and identifies playbook improvements for future incidents.

Key Concept

NIST Incident Response Lifecycle (Containment, Evidence Preservation, Eradication/Recovery, Lessons Learned)
Question 36Question →

A security operations team is configuring an enterprise Security Information and Event Management (SIEM) data pipeline to process heterogeneous log sources across cloud and on-premises environments. In what sequential order does the SIEM pipeline process incoming event data from initial receipt to alert generation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for processing raw event data into an actionable alert in a SIEM pipeline is: 1) Log Aggregation & Transport, 2) Parsing & Field Extraction, 3) Data Normalization, 4) Contextual Enrichment, and 5) Correlation & Rule Evaluation.
The standard SIEM data ingestion pipeline follows a strict logical flow: raw logs are ingested and transported to the collector, parsed into discrete field tokens, normalized into a uniform data schema, enriched with external contextual metadata (such as threat intelligence and asset ownership), and finally processed by the correlation engine to evaluate detection logic and trigger alerts.

Step-by-Step Solution

1
Receive raw log stream from endpoints and security appliances
Log Aggregation & Transport moves raw events from source hosts to the central collector.
Data must arrive at the SIEM collector before processing can take place.
2
Break down raw log strings into key-value pairs
Parsing & Field Extraction converts unstructured text strings into indexed attributes.
Raw string data must be tokenized into discrete attributes like IP addresses and usernames.
3
Standardize variable names into a unified vendor-agnostic schema
Data Normalization aligns disparate field names across vendor products into a single field taxonomy.
Unified querying across firewall, OS, and application logs requires a standardized schema.
4
Augment normalized log attributes with contextual threat and identity data
Contextual Enrichment attaches threat intelligence feed scores, GeoIP location data, and LDAP user roles.
Rule engines need rich contextual indicators to calculate risk scores accurately.
5
Execute correlation rules against normalized and enriched event streams
Correlation & Rule Evaluation checks events against multi-stage detection logic to generate security alerts.
Correlation is performed on fully normalized and enriched logs to minimize false positives and detect complex attacks.

Key Concept

SIEM Ingestion and Event Processing Pipeline Architecture
Question 37Question →

A Security Operations Center (SOC) team is investigating a multi-stage enterprise breach. A SIEM correlation engine collected logs across web application firewalls, endpoint detection agents, and Windows Domain Controllers. Based on log signatures and attack techniques, arrange the following log events in the correct chronological order of the attacker's progression through the cyber kill chain (from initial access to persistence).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the intrusion progression is: (1) SQL injection web access log, (2) Obfuscated PowerShell execution from web daemon, (3) LSASS process memory dump via comsvcs.dll, (4) Network Logon Type 3 lateral movement using NTLMv2, and (5) Scheduled Task creation for persistence.
Analyzing log artifacts chronologically requires mapping specific event signatures to the Cyber Kill Chain / MITRE ATT&CK framework: 1. Web exploitation (SQL Injection in web access logs) provides Initial Access. 2. Web daemon spawning encoded PowerShell (EDR log) represents Execution. 3. Dumping LSASS memory via comsvcs.dll (Event 4688) represents Credential Access. 4. Using stolen credentials to log into an internal system via network authentication (Event 4624 Type 3) represents Lateral Movement. 5. Creating a scheduled task (Event 4698) on the internal target host represents Persistence.

Step-by-Step Solution

1
Identify Initial Access / Exploitation phase
Recognize the web server log showing a HTTP POST request containing 'UNION SELECT SQL injection payload as the initial attack vector.
Attacks begin with initial perimeter exposure or application exploitation before internal execution can occur.
2
Identify Execution / Payload delivery phase
Locate EDR process creation log showing the web process (www-data) spawning cmd.exe and encoded PowerShell.
Exploitation of web vulnerabilities is immediately followed by shell command execution to establish operational control.
3
Identify Credential Access / Privilege Escalation phase
Identify Windows Event 4688 executing rundll32.exe comsvcs.dll MiniDump to dump LSASS memory.
Once on a host, attackers dump memory to extract cleartext credentials or hashes required for lateral movement.
4
Identify Lateral Movement phase
Correlate Windows Event 4624 (Logon Type 3) originating from the compromised web server (10.0.4.15) using DomainAdmin credentials.
Harvested credentials enable network authentication to access other internal enterprise systems.
5
Identify Persistence phase
Identify Windows Event 4698 indicating a scheduled task creation running an encoded PowerShell script.
After establishing access on internal high-value targets, persistent mechanisms (scheduled tasks, registry run keys) ensure continuous access.

Key Concept

Multi-Source Log Correlation and Attack Lifecycle Reconstruction
Question 38Question →

A security operations center (SOC) analyst confirms an active Golden Ticket attack originating from a compromised Active Directory Domain Controller within an enterprise network. Arrange the following incident response procedures in the correct chronological order according to standard NIST incident response lifecycle guidelines, starting with the earliest step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard NIST SP 800-61 r2 Incident Response Lifecycle: Containment (network isolation and session revocation) → Eradication (double krbtgt password reset and malware removal) → Recovery (backup restoration, service re-engagement, and monitoring) → Post-Incident Activity (after-action review and playbook updates).
According to standard NIST incident response guidelines (SP 800-61 r2), containment must always precede eradication to restrict adversary movement. Once isolated, eradication eliminates the root cause and attacker access methods (such as invalidating Kerberos TGTs via a double krbtgt reset). Recovery follows to safely restore verified services into production under heightened monitoring, and post-incident activities take place last to document lessons learned and refine security controls.

Step-by-Step Solution

1
Identify the initial Containment action.
Network isolation of the Domain Controller and revocation of administrative sessions prevents the attacker from propagating across the enterprise.
Containment must occur first upon confirming an intrusion to limit the scope of compromise.
2
Identify the Eradication action.
Resetting the krbtgt account password twice invalidates all existing Ticket Granting Tickets (including forged Golden Tickets), and removing backdoors eliminates root access vectors.
Eradication neutralizes the threat completely so that systems can be safely brought back online.
3
Identify the Recovery action.
Restoring directory services from clean backups, resuming domain authentication, and closely monitoring ticket traffic confirms operational integrity.
Recovery restores impacted infrastructure to normal operational status in a controlled, monitored environment.
4
Identify the Post-Incident Activity action.
Performing an after-action debriefing, updating incident playbooks, and implementing stronger access controls enhances enterprise resilience.
Lessons learned activities document the incident response performance and refine operational defenses against future attacks.

Key Concept

NIST Incident Response Lifecycle (Containment, Eradication, Recovery, Post-Incident Activity)
Question 39Question →

An organization is updating its cybersecurity incident response plan according to the standard NIST SP 800-61 framework. In what sequential order should the core phases of the incident response lifecycle be performed from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of the NIST incident response lifecycle phases is Preparation, followed by Detection and Analysis, then Containment, Eradication, and Recovery, and finally Post-Incident Activity.
According to NIST SP 800-61, the standard incident response process follows four sequential phases: Preparation (setting up response tools, policies, and training), Detection and Analysis (identifying security events and determining their scope), Containment, Eradication, and Recovery (limiting impact, purging threat actors or artifacts, and restoring systems), and Post-Incident Activity (conducting lessons-learned analysis to improve future readiness).

Step-by-Step Solution

1
Identify the foundational phase established prior to security incidents.
Preparation is the initial phase.
An incident response team must prepare infrastructure, tools, and playbooks before attacks occur.
2
Identify the phase triggered by suspicious activity or system alerts.
Detection and Analysis follows Preparation.
Security operations teams must detect anomalies, validate security events, and analyze threat vectors.
3
Identify the phase dedicated to stopping the threat and restoring operational baselines.
Containment, Eradication, and Recovery follows Detection and Analysis.
Once an incident is confirmed and analyzed, responders must limit its spread, clean infected hosts, and bring systems back online securely.
4
Identify the concluding evaluation phase after threat resolution.
Post-Incident Activity is the final phase.
After the incident is mitigated and operations are restored, the team holds lessons-learned meetings to update playbooks and improve future response.

Key Concept

NIST Incident Response Lifecycle Phases
Question 40Question →

A security analyst discovers that an operational AWS IAM access key belonging to a production microservice repository was inadvertently committed to a public version control repository. Following standard incident response playbook procedures for credential exposure, place the following response actions in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of incident response actions is: 1) Revoke the exposed IAM access key and apply an explicit deny policy, 2) Isolate affected compute instances and preserve volatile memory, 3) Analyze CloudTrail logs to identify and eradicate persistence mechanisms, 4) Deploy clean application instances with rotated credentials and restore operations, and 5) Conduct a post-incident review to implement automated secret scanning and update playbooks.
The correct order follows standard incident response frameworks applied to credential exposure playbooks: initial containment (revoking credentials and isolating workloads), eradication (analyzing audit logs to uncover and remove adversary persistence), recovery (redeploying clean workloads with newly generated secrets), and post-incident activity (updating preventive secret-scanning hooks and playbooks).

Step-by-Step Solution

1
Revoke Compromised Credentials
Terminates ongoing malicious API transactions using the exposed access key.
Immediate containment must disable the attack vector before the adversary can execute further actions.
2
Isolate Systems and Safeguard Evidence
Prevents adversary lateral movement and preserves volatile memory dumps.
Workload isolation limits blast radius while preserving digital forensic evidence for investigation.
3
Scope Impact and Eradicate Persistence
Identifies unauthorized infrastructure modifications, rogue IAM roles, and persistent backdoors.
Complete eradication requires identifying and removing all adversary footholds prior to system recovery.
4
System Recovery and Secret Rotation
Restores application workloads using clean images and new secrets.
Recovery ensures business services resume securely without lingering threat actor access.
5
Post-Incident Lessons Learned
Implements automated CI/CD secret scanning and improves the response playbook.
Post-incident activities address root causes and update organizational controls to prevent recurrence.

Key Concept

Incident Response Lifecycle & Playbook Execution Sequence
PreviousPage 2 / 9Next
All practice questions — CompTIA Security+ | Examkin