Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 41Question →

A security operations team is configuring a Security Information and Event Management (SIEM) data pipeline to handle heterogeneous syslog and event streams from enterprise endpoints, firewalls, and application servers. Place the following SIEM processing stages in the correct chronological order from initial data intake to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for processing logs within a SIEM pipeline is: Log Collection, Log Parsing, Log Normalization, SIEM Correlation, and Alert Generation.
The correct order follows the standard SIEM processing pipeline lifecycle: Raw log entries are first gathered during Log Collection. Once ingested, Log Parsing extracts discrete data elements from raw strings. Next, Log Normalization maps these parsed elements to a unified schema so logs from different vendors can be compared uniformly. SIEM Correlation then evaluates rules across the normalized event streams to detect multi-host or multi-step threats. Finally, Alert Generation triggers incident tickets and notifications for security analysts when correlation thresholds are matched.

Step-by-Step Solution

1
Identify the initial intake phase of raw log data from distributed security controls and endpoints.
Log Collection is established as the first stage.
Data must be gathered from source systems before any downstream processing or analysis can occur.
2
Determine how raw log strings are structured into key-value data elements.
Log Parsing follows collection.
Unstructured text entries must be parsed into distinct key-value pairs before standardizing field formats.
3
Standardize variable field naming conventions across diverse vendor logs.
Log Normalization follows parsing.
Mapping parsed fields to a unified data model allows the correlation engine to evaluate heterogeneous logs consistently.
4
Analyze cross-system normalized events against security logic rules.
SIEM Correlation follows normalization.
Correlation rules require standardized inputs from multiple log sources to detect multi-stage attack indicators.
5
Output security events requiring human intervention or automated incident response.
Alert Generation is the final stage.
Alerts and tickets are generated only after correlation logic identifies suspicious behavior matching defined thresholds.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Question 42Question →

A digital forensics analyst must collect evidence from a powered-on virtual machine host following an active intrusion. In what sequence should the analyst capture the following evidence sources, starting from the most volatile to the least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and CPU cache memory, followed by System RAM, Swap space and paging files, Local persistent disk storage, and finally Offsite archival tape backups.
Order of Volatility dictates collecting evidence in sequence of how quickly data is lost or altered. The order moves from CPU registers/cache (microsecond volatility), to system RAM (volatile RAM state), swap/pagefiles (temporary disk storage), local persistent disks (non-volatile system storage), and finally offsite archival backups (static offline storage).

Step-by-Step Solution

1
Identify the volatility level of CPU-internal components.
CPU registers and cache are placed first because data is overwritten almost instantaneously.
According to RFC 3227 standards for order of volatility, CPU registers change continuously with execution cycles and represent the highest volatility.
2
Capture physical system memory (RAM).
System RAM is extracted immediately after CPU cache before system power down or state changes.
RAM contains live processes, active network connections, and encryption keys that disappear when powered off.
3
Acquire temporary disk-backed memory artifacts.
Swap space and pagefiles are collected third.
Swap/paging files reside on disk but hold temporary memory structures vulnerable to kernel reallocation.
4
Perform bit-stream imaging of persistent local drives.
Local SSD/HDD persistent storage is imaged fourth.
Persistent disk data remains intact across reboots and is less volatile than system memory.
5
Retrieve long-term backup archives.
Offsite backup tapes are logged last.
Archival media is stable, read-only/offline, and has the lowest rate of data change.

Key Concept

Order of Volatility in Digital Forensics
Question 43Question →

A security architect is designing a jump box administrative access path for a high-security internal database zone. Arrange the sequence of network traffic flows and security enforcement controls in the correct order, starting from the administrator's initial remote connection attempt and ending at the destination database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with external traffic entering the perimeter DMZ to contact the bastion host, followed by multi-factor authentication on the bastion host, then initiating a separate internal connection from the bastion host, and finally passing internal firewall microsegmentation checks to access the database server.
Secure network administrative access relies on a multi-tier defense-in-depth sequence: traffic first enters the management DMZ via the perimeter firewall, requires strong authentication on the jump box, originates a brand-new internal session from the jump box, and is strictly filtered by internal firewall microsegmentation rules before touching sensitive internal assets.

Step-by-Step Solution

1
Inbound Ingress to DMZ
The initial remote session passes through the outer edge firewall and terminates at the dedicated bastion host in the DMZ segment.
Direct management traffic from external networks to internal zones must be blocked at the perimeter; all management ingress must terminate in a screened management zone.
2
Identity & Posture Validation
The administrator authenticates via MFA on the jump box to unlock management capabilities.
Security controls on the jump server ensure only authenticated administrators with valid privileges can launch internal sessions.
3
Secondary Session Initiation
A secondary, isolated connection is launched from the jump box across the internal network boundary.
Breaching protocol continuation (session break) prevents direct pass-through tunneling from external clients into core internal networks.
4
Microsegmentation Policy Enforcement
The internal firewall verifies that ingress to the database zone is restricted to the specific bastion host IP and allowed protocol/port.
Microsegmentation enforces least privilege network access, ensuring database servers only accept connections from trusted administrative jump hosts.

Key Concept

Secure Network Transit & Bastion Architecture
Question 44Question →

A cybersecurity responder is acquiring digital evidence from a running Linux enterprise server suspected of executing an in-memory malware payload. Adhering strictly to the Order of Volatility (RFC 3227), in what order should the responder capture the following evidence components from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: Processor cache memory and CPU registers, followed by System RAM and active kernel process tables, Swap space and temporary file systems (/tmp), Local solid-state drive (SSD) persistent storage, and finally Archived remote log repositories and cloud backups.
According to RFC 3227 evidence collection guidelines, forensic data must be gathered starting from the shortest lifespan to the longest lifespan to prevent evidence destruction. CPU registers and cache fluctuate constantly and are lost first. Main memory (RAM) contains volatile active state data. Swap space and temporary directories exist on storage controllers but undergo constant churn. Local persistent drives preserve non-volatile disk blocks across power events. Remote log repositories and backups are offsite and immutable, sitting at the bottom of the volatility hierarchy.

Step-by-Step Solution

1
Identify the highest volatility layer in system hardware.
Processor cache memory and CPU registers are placed first.
Registers and CPU cache operate at system clock speed and lose contents immediately upon state changes or interruption.
2
Identify active dynamic system memory components.
System RAM and kernel process tables are placed second.
System RAM holds transient runtime structures, active network connections, and decrypted payloads that disappear when power is removed.
3
Identify transient disk storage structures.
Swap space and temporary file systems are placed third.
Paging files and temporary directories are stored on disk but are heavily modified during normal system activity.
4
Identify persistent local storage media.
Local solid-state drive (SSD) persistent storage is placed fourth.
Local disk storage maintains data without active electrical power and persists across system reboots.
5
Identify offsite and immutable archival sources.
Archived remote log repositories and cloud backups are placed fifth.
Centralized logs and remote backups are insulated from local system changes and represent stable long-term evidence.

Key Concept

Order of Volatility in Digital Forensics
Question 45Question →

A security analyst is executing an incident response playbook following the detection of an unauthorized rogue wireless access point connected to an enterprise network switch. According to the NIST Incident Response Framework (NIST SP 800-61 Rev. 2), in what chronological order should the analyst perform the response actions below?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the NIST Incident Response lifecycle: 1) Validate the alert via WIPS logs (Detection & Analysis), 2) Disable the switch port (Containment), 3) Physically remove the rogue access point and configure 802.1X (Eradication & Recovery), and 4) Hold a post-incident review meeting (Post-Incident Activity).
The standard incident response framework dictates four major sequential phases: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. The response begins by validating the alert through WIPS log analysis to confirm the threat. Next, the switch port is disabled to contain network traffic and limit potential compromise. Following containment, the physical rogue device is eradicated and port security controls are applied for recovery. Finally, post-incident activities occur to document lessons learned and update operational playbooks.

Step-by-Step Solution

1
Execute Detection and Analysis
The incident is verified as a true positive rogue access point.
Initial analysis confirms the scope and validity of the threat before initiating containment.
2
Execute Containment
Network access for the unauthorized device is terminated at the switch layer.
Immediate containment limits exposure and prevents attacker lateral movement or eavesdropping.
3
Execute Eradication and Recovery
The physical device is removed and port security controls are reinforced.
Eradication removes the unauthorized artifact and recovery ensures the infrastructure returns to a secure baseline.
4
Execute Post-Incident Activity
Incident details are documented and response playbooks are refined.
Lessons learned activities occur post-mitigation to institutionalize improvements for future incidents.

Key Concept

NIST Incident Response Lifecycle (NIST SP 800-61 Rev. 2)
Estimated Time:1m 30s
Question 46Question →

Place the core phases of the NIST SP 800-61 Incident Response Lifecycle in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the NIST Incident Response Lifecycle phases is Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity.
The standard NIST SP 800-61 incident response framework follows a logical four-stage lifecycle. It begins with Preparation to establish capabilities, moves to Detection and Analysis to uncover and assess security events, continues to Containment, Eradication, and Recovery to mitigate and recover from the threat, and concludes with Post-Incident Activity to analyze lessons learned.

Step-by-Step Solution

1
Identify the foundation step required before any attack occurs.
Preparation is established first to equip the team with training and resources.
Without preparation, an organization cannot effectively detect or respond to security threats.
2
Determine the step that follows once operational monitoring begins.
Detection and Analysis comes second to identify security events and validate incidents.
An incident must be detected and analyzed before any mitigation measures can be applied.
3
Identify the active response phase after confirming an incident.
Containment, Eradication, and Recovery takes place third.
Once an incident is identified, responders work to stop threat propagation, eliminate the malware or malicious artifacts, and restore systems.
4
Identify the final phase following system restoration.
Post-Incident Activity concludes the lifecycle.
After operations return to normal, documenting lessons learned ensures continuous improvement of the security posture.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 47Question →

In Security Information and Event Management (SIEM) workflow, log data undergoes several processing stages from initial ingestion to analyst notification. Which sequence correctly places the stages of SIEM log processing in chronological order from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages is Log Collection, Log Parsing, Log Normalization, Event Correlation, and Alerting.
The standard SIEM data ingestion and processing flow follows five sequential steps: first, raw data is gathered (Log Collection); second, raw log strings are split into field elements (Log Parsing); third, parsed fields are mapped into common standard formats across all vendor logs (Log Normalization); fourth, normalized events are evaluated across time and sources against security correlation rules (Event Correlation); and finally, confirmed security incidents generate notifications for security analysts (Alerting).

Step-by-Step Solution

1
Identify the initial ingestion phase
Log Collection is identified as the mandatory first step to gather raw data from sources.
Data cannot be processed until it is ingested by the collector or agent.
2
Determine data structure and standard format conversion
Log Parsing occurs prior to Log Normalization.
Raw unstructured logs must first be parsed into individual key-value fields before those fields can be mapped to a standardized taxonomy.
3
Identify analytical logic execution and final output
Event Correlation runs on normalized logs, followed by Alerting as the final output.
Correlation rules require standardized fields across different logs to evaluate patterns, and alerts are only generated after correlation triggers a rule match.

Key Concept

SIEM Log Processing Pipeline
Question 48Question →

An incident response investigator is tasked with preserving forensic evidence from a live high-frequency trading server that was compromised during an active cyber intrusion. The server is currently powered on and running critical processes in memory. To ensure that digital evidence is collected without destroying highly transient artifact state in compliance with RFC 3227 guidelines, in what sequence should the investigator acquire the artifacts from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition order from most volatile to least volatile is: CPU registers and cache → System RAM and active network state → Swap files and temporary file systems → Local NVMe drives and non-volatile disk volumes → Offsite archival tape backups.
Digital evidence collection must strictly follow RFC 3227 guidelines starting with the shortest lifespan items to prevent evidence destruction. CPU registers and caches alter state in nanoseconds and are lost first, followed by volatile system memory (RAM and active network caches), swap/page files on storage drives, non-volatile local disk storage, and finally offline archival backup tapes.

Step-by-Step Solution

1
Identify the most volatile hardware components.
CPU registers, L1/L2 caches, and pipeline states are identified as changing on a nanosecond scale.
According to RFC 3227, processor-level memory is lost almost instantaneously upon state change or interruption.
2
Locate volatile volatile system memory and transient OS tables.
System RAM, ARP cache, routing tables, and process memory are placed immediately after CPU cache.
Physical RAM and active network structures cleared upon power-down represent the primary target for live memory analysis.
3
Sequence secondary dynamic disk structures.
Pagefiles, swap space, and temporary file systems are placed after physical RAM.
Swap space resides on disk but changes rapidly during system execution, persisting longer than physical RAM but changing faster than static disk files.
4
Capture static non-volatile primary storage media.
Local NVMe storage volumes and bit-stream disk images are sequenced after temporary/swap storage.
Persistent local storage retains data across reboots and power outages.
5
Place long-term offline media at the end of the sequence.
Offsite archival tape backups and optical media are established as the least volatile evidence.
Offline backup media is immutable and disconnected from active host execution.

Key Concept

RFC 3227 Order of Volatility
Question 49Question →

Following the detection and initial triage of an active web shell exploit on an enterprise web server, a Security Operations Center (SOC) analyst must execute the incident response playbook. Arrange the following operational response procedures in the correct chronological sequence according to standard NIST incident response lifecycle guidelines, from the earliest action to the final action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of incident response actions is: 1) Perform host-level containment by isolating the web server to a sandbox VLAN, 2) Execute eradication procedures by purging malicious artifacts and patching vulnerabilities, 3) Initiate recovery operations by restoring system software from a verified baseline and resuming production traffic, and 4) Conduct post-incident activities by documenting lessons learned and updating playbooks.
Standard incident response frameworks (NIST SP 800-61 and ISO 27035) dictate a strict sequence: Containment -> Eradication -> Recovery -> Post-Incident Activity. First, the affected asset must be isolated (containment) to stop lateral movement and C2 traffic while preserving volatile evidence. Second, malicious artifacts (web shell) and vulnerabilities must be removed (eradication). Third, systems are rebuilt and reintegrated into production (recovery). Finally, post-incident activities analyze root causes and update IR playbooks.

Step-by-Step Solution

1
Identify the immediate priority post-detection: Containment.
Containment limits adversary expansion; isolation to a quarantine VLAN halts lateral movement while preserving volatile evidence.
According to NIST SP 800-61, containment must precede eradication to ensure the attacker cannot pivot or deploy destructive counter-measures during cleanup.
2
Identify the remediation phase: Eradication.
Eradication removes threat components (web shell) and remediates underlying vulnerabilities (patch application, credential revocation).
Eradication ensures that the host and network environment are fully cleaned of malicious artifacts before attempting service restoration.
3
Identify the operational restoration phase: Recovery.
Recovery restores clean configurations, reinstates production connectivity, and applies targeted monitoring.
Restoration to production can only safely occur once eradication of the threat vector and vulnerability remediation are confirmed.
4
Identify the evaluation and closure phase: Post-Incident Activity.
Lessons learned are documented, and security playbooks are updated based on incident metrics.
Post-incident analysis ensures long-term security posture enhancements and satisfies compliance requirements after system recovery.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases (Containment -> Eradication -> Recovery -> Post-Incident Activity)
Estimated Time:2m 0s
Question 50Question →

A digital forensics responder is preparing to collect evidence from a powered-on target workstation. Place the following memory and storage components in the correct sequence according to the standard Order of Volatility, starting from the MOST volatile to the LEAST volatile.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most volatile to least volatile is: CPU registers and cache memory, followed by System RAM (Random Access Memory), then Local solid-state drive (SSD) storage, and finally Archival backup tape media.
According to standard digital forensics guidelines (such as RFC 3227), evidence collection must proceed from the most transient/volatile data to the least volatile data. CPU cache and registers change constantly and are lost first, followed by system RAM. Local disk storage retains data permanently across reboots, while offline archival tapes are static and non-volatile.

Step-by-Step Solution

1
Identify the data source with the shortest lifespan
CPU registers and cache memory are identified as the most volatile because contents change continuously during CPU cycles.
Data in registers and processor cache is extremely transient and easily overwritten or cleared.
2
Identify volatile system runtime memory
System RAM is placed second.
RAM contains live system memory (running processes, network sockets, unencrypted secrets) which disappears when the host loses power.
3
Identify non-volatile local storage
Local SSD storage is placed third.
Disk storage persists data across power cycles and system reboots, making it significantly less volatile than RAM or CPU cache.
4
Identify long-term offline storage
Archival backup tape media is placed last.
Archival backups are offline, highly resilient, and change least frequently among all listed sources.

Key Concept

Order of Volatility in Digital Forensics
Question 51Question →

During a multi-vector attack on a hybrid enterprise infrastructure, a security operations team identifies active data exfiltration using a compromised cloud service account API key, alongside automated ransomware scripts terminating database processes on internal servers. To effectively mitigate damage and recover services according to standard incident response frameworks, what is the correct chronological sequence of steps the response team must execute?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with credential revocation and IP blocking (Containment), followed by volatile memory and disk forensic acquisition (Analysis/Preservation), followed by malware and persistence removal (Eradication), followed by clean backup restoration and integrity verification (Recovery), and concludes with a formal lessons-learned post-incident review (Post-Incident Activity).
According to NIST SP 800-61 and industry standard IR playbooks, containment (revoking compromised credentials and blocking origin IPs) must occur immediately to stop active exfiltration. Evidence acquisition (memory and disk forensic imaging) must follow prior to modifying systems. Eradication (purging malware binaries and persistence) ensures the adversary cannot maintain access. Recovery (restoring from clean offline backups and integrity validation) safely brings operations back online. Finally, post-incident activity (lessons learned and playbook updates) synthesizes the findings to improve future response.

Step-by-Step Solution

1
Execute immediate Containment controls by revoking compromised cloud API keys and applying perimeter IP blocks.
Stops ongoing data exfiltration and blocks active command-and-control communication.
Containment limits the scope of damage before additional actions are taken.
2
Perform Evidence Acquisition by capturing volatile memory and disk images from targeted database hosts.
Preserves forensic artifacts without altering volatile evidence needed for investigation.
Eradication or system re-imaging without prior forensic capture destroys volatile memory evidence.
3
Execute Eradication by removing ransomware artifacts, backdoor accounts, and scheduled tasks.
Completely eliminates the threat actor's presence and malware components from the environment.
Systems cannot be safely restored until all malicious presence has been removed.
4
Perform Recovery by restoring databases from known-good offline backups and validating system functionality.
Returns production services to normal operational state safely.
Restoration must occur after eradication to prevent re-infection upon bringing systems back online.
5
Conduct Post-Incident Activity including root-cause reporting and updating incident playbooks.
Improves security posture and response playbooks for future incidents.
Post-incident review requires complete incident resolution and documentation to evaluate overall performance.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Sequencing
Estimated Time:3m 0s
Question 52Question →

A security team is defining an automated containment and investigation workflow for suspicious host behavior flagged by an Endpoint Detection and Response (EDR) agent. Order the steps in the correct chronological sequence from initial detection through remediation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the EDR incident response workflow is: (1) EDR sensor detects anomalous process behavior, (2) Automated playbook executes host isolation, (3) SOC analyst examines telemetry logs and process tree, (4) Forensic artifacts and memory dumps are collected, and (5) Newly identified IoCs are deployed to security controls.
The workflow follows standard incident response phases tailored to EDR functionality: Detection (EDR agent alerts on process anomaly) -> Containment (automated network isolation) -> Analysis (SOC analyst investigates process lineage) -> Investigation/Forensics (memory dump and artifact extraction) -> Remediation/Post-Incident (distributing IoCs enterprise-wide).

Step-by-Step Solution

1
Identify the event triggering the incident response sequence.
The EDR sensor identifies suspicious activity on the local endpoint.
Detection is the prerequisite step that triggers automated playbooks and alerts.
2
Contain the threat automatically using EDR capabilities.
Network interface of the affected host is isolated from the rest of the enterprise network.
Immediate containment limits blast radius and prevents lateral movement while preserving management access for EDR control.
3
Perform preliminary investigation of endpoint telemetry.
Analyst inspects process lineage, command-line arguments, and parent-child relationships.
Investigating telemetry confirms whether the alert is a true positive and pinpoints attacker tactics.
4
Collect deep forensic evidence.
Volatile memory and system triage packages are acquired from the isolated endpoint.
Detailed forensic collection supplies evidence for root-cause analysis and malware analysis.
5
Remediate and update organizational security posture.
Extracted IoCs are added to SIEM, firewalls, and EDR detection rules.
Feedback into security infrastructure prevents duplicate compromise across other enterprise endpoints.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Incident Investigation Workflow
Question 53Question →

An analyst is defining an automated incident response playbook within an Endpoint Detection and Response (EDR) system to handle high-severity malware execution alerts on enterprise workstations. Place the following steps of the automated containment, analysis, and recovery workflow in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the EDR response workflow begins with isolating the endpoint from the network, followed by terminating the malicious processes, gathering volatile memory telemetry for forensic analysis, and finally lifting network isolation after remediation.
The correct response order follows standard incident handling best practices in EDR environments: immediate network containment to prevent lateral movement, termination of malicious processes to stop active damage, acquisition of telemetry and forensics to analyze attack vectors, and host network restoration after remediation is confirmed.

Step-by-Step Solution

1
Perform immediate host isolation via EDR capabilities.
The endpoint is blocked from communicating with local network resources and external command-and-control servers while retaining EDR management connectivity.
Containment is the primary initial operational priority to restrict the attack blast radius without disrupting SOC control.
2
Terminate active threat processes.
Malicious process trees and memory-injected code execution are halted on the local host.
Stopping active malicious code prevents ongoing unauthorized actions, such as ransomware encryption or local credential harvesting.
3
Gather forensic telemetry and volatile memory artifacts.
Detailed process lineages, network sockets, and memory dumps are collected for SOC investigation.
Investigating telemetry determines the attack vector and identifies persistence mechanisms established prior to host isolation.
4
Lift host isolation and restore connectivity.
The host resumes standard enterprise network communications.
Network access should only be restored after confirming the host is completely remediated and secure.

Key Concept

EDR Automated Containment and Remediation Workflow
Question 54Question →

Place the following steps of an Endpoint Detection and Response (EDR) automated containment and incident investigation workflow in the correct sequential order from initial event detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard incident containment lifecycle: telemetry detection of suspicious activity, automated network isolation, analyst investigation of process lineage telemetry, and final threat remediation followed by network restoration.
The workflow begins with continuous behavioral detection by the EDR agent. Once an alert triggers, automated playbooks isolate the endpoint from the network to block lateral spread while keeping memory intact. Next, a SOC analyst reviews the rich process lineage and telemetry gathered by the sensor to determine root cause. Finally, remediation scripts eradicate the threat and host network connectivity is safely restored.

Step-by-Step Solution

1
Identify initial threat detection
The local EDR sensor flags anomalous behavior via host telemetry monitoring.
Detection must occur before any containment or investigation actions can be initiated.
2
Execute immediate automated containment
Network isolation is automatically applied to the affected endpoint.
Isolating the endpoint stops lateral movement across the enterprise network while preserving host volatility.
3
Conduct analyst telemetry investigation
The analyst examines process trees and parent-child execution paths in the central EDR console.
Investigation must take place on the isolated endpoint's collected data to understand the attack scope.
4
Perform threat remediation and host restoration
Malicious items are cleaned and full network connectivity is reinstated.
Remediation and reconnecting the system to normal operations is the final step in resolving an endpoint incident.

Key Concept

EDR Incident Containment and Response Lifecycle
Estimated Time:1m 0s
Question 55Question →

A Security Operations Center (SOC) engineering team is designing an enterprise SIEM processing architecture to handle unstructured log streams from hybrid cloud applications, perimeter firewalls, and endpoint agents. In what order should the log processing pipeline execute these stages from initial log retrieval to automated response handling?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the SIEM log processing pipeline is: Log Ingestion, Parsing and Normalization, Contextual Enrichment, Cross-Source Correlation, and Alerting and Orchestration.
The standard SIEM data pipeline processes incoming events sequentially: first ingesting raw log data, parsing it into a normalized schema, enriching the normalized fields with context (such as threat intelligence and asset metadata), correlating the enriched events across sources using defined rules, and finally alerting analysts or triggering SOAR automation.

Step-by-Step Solution

1
Identify the initial collection phase
Log Ingestion (item 1) receives raw telemetry from agents, syslog streams, and APIs into the central SIEM receiver.
Data must be ingested into the pipeline before any transformation or inspection can occur.
2
Structure and format the raw log payload
Parsing and Normalization (item 2) converts unstructured strings into standardized key-value pairs using a common schema.
Downstream processing requires consistent attribute naming (e.g., src_ip, user_id) across different vendor log formats.
3
Augment normalized logs with external and environmental context
Contextual Enrichment (item 3) attaches threat intelligence feeds, asset values, and IP geolocation to normalized events.
Enrichment adds necessary risk scoring and IP reputation metadata to standardized fields prior to complex rule evaluation.
4
Analyze events across multiple log sources for threat patterns
Cross-Source Correlation (item 4) compares enriched, normalized events against temporal rules and behavioral logic.
Correlation requires clean, normalized, and enriched data across disparate sources within specific time windows to detect complex attacks.
5
Take action on correlated security events
Alerting and Orchestration (item 5) dispatches incident tickets and initiates automated playbooks.
Response actions and analyst alerts are executed only after correlation rules determine a high-fidelity security incident.

Key Concept

SIEM Log Processing Pipeline Sequence
Question 56Question →

During operational monitoring, a Security Operations Center (SOC) analyst identifies unusual Windows Management Instrumentation (WMI) execution on a core Domain Controller, indicating potential credential harvesting. Following the standard NIST SP 800-61 Incident Response Framework, in which chronological sequence should the security team perform the following response procedures?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct incident response sequence follows the NIST SP 800-61 lifecycle phases: 1) Detection and Analysis (analyzing SIEM logs and memory), 2) Containment (isolating the host), 3) Eradication and Recovery (purging persistence mechanisms and restoring from backup), and 4) Post-Incident Activity (conducting lessons learned and updating rules).
Standard NIST incident response lifecycle dictates progressing through Preparation (pre-established), Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Analyzing logs and volatile memory confirms the threat (Detection and Analysis). Isolating the server stops lateral spread (Containment). Removing artifacts and restoring from backup cleanses the environment (Eradication and Recovery). Finally, conducting a post-mortem review updates organizational playbooks (Post-Incident Activity).

Step-by-Step Solution

1
Perform initial investigation and scope analysis
Confirmed incident details and extent of system impact
Detection and Analysis must occur first to understand the threat prior to taking operational action.
2
Enforce network segmentation and host isolation
Prevented lateral movement across the enterprise network
Containment limits damage and prevents adversaries from spreading deeper into the infrastructure.
3
Remediate threat artifacts and restore systems
Clean system state restored and credentials rotated
Eradication and Recovery removes threat components and safely returns systems to normal operations.
4
Document findings and refine security controls
Updated playbooks and improved SOC readiness
Post-Incident Activity ensures long-term organizational learning and playbook optimization.

Key Concept

NIST Incident Response Lifecycle Phases
Question 57Question →

A security administrator is establishing an automated failover sequence for an active-passive high-availability firewall pair to ensure continuous uptime during a node failure while preserving connection state tables. Place the operational failover steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with the standby node detecting missed heartbeat probes, followed by the standby node transitioning to active and broadcasting a GARP message, then assuming the Virtual IP and activating synchronized state tables, and concluding with network traffic routing through the secondary appliance without disruption.
In stateful high availability failover, the process begins when health monitoring detects loss of heartbeat probes from the primary appliance. Next, the standby appliance promotes itself to active status and transmits a Gratuitous ARP (GARP) frame to update switch forwarding tables for the shared virtual IP (VIP). The new active appliance then assumes the VIP and applies the synchronized connection state table. Finally, network traffic transitions through the secondary firewall seamlessly.

Step-by-Step Solution

1
Identify the event that triggers the failover routine.
Failure of primary node heartbeat probes alerts the standby firewall.
Redundant clusters require continuous health checks to detect primary node degradation before executing role promotion.
2
Determine how network switching infrastructure is alerted to the topology change.
The standby node promotes itself to active and issues Gratuitous ARP (GARP) broadcasts.
GARP messages instantly update the Layer 2 MAC address tables on upstream switches, pointing the virtual IP interface to the new physical port.
3
Apply high availability session state controls to maintain connection persistence.
The newly active node binds the VIP and loads synchronized connection state data.
Stateful failover relies on continuously replicated state tables so existing TCP sessions do not require renegotiation.
4
Verify traffic flow restoration.
Production network traffic successfully flows through the newly active node without user disruption.
Once routing and MAC tables converge, live production connections proceed through the failover target seamlessly.

Key Concept

Active-Passive Stateful High Availability Failover Sequence
Question 58Question →

A cybersecurity forensic analyst has just completed a bit-stream disk acquisition of a target drive seized during an insider threat investigation. The analyst must now process and secure the physical drive and digital image to ensure legal admissibility in court. Place the following evidence handling and chain of custody steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order for preserving forensic disk evidence is: (1) Generate and document a baseline cryptographic hash of the acquired forensic image, (2) Complete the initial chain of custody log entry with item details, timestamps, collector identity, and baseline hash value, (3) Place the original drive into an antistatic tamper-evident bag and apply a signed tamper-proof seal, and (4) Deposit the sealed evidence package into a secure evidence vault and log the storage location transfer.
Digital forensic integrity relies on immediate verification followed by meticulous documentation and physical security. First, generating a baseline cryptographic hash immediately after bit-stream acquisition verifies that the copy is exact and unaltered. Second, recording this hash alongside collector details, serial numbers, and timestamps on the chain of custody form creates an official legal record. Third, physically enclosing the drive in a sealed tamper-evident bag ensures protection against tampering and static. Finally, transferring the sealed item to a secure evidence locker and logging the location transfer maintains an unbroken chain of custody.

Step-by-Step Solution

1
Verify baseline data integrity
Generating a SHA-256 hash immediately after image capture creates a mathematical signature of the evidence state.
Cryptographic hashes prove non-repudiation and verify that the evidence has not been tampered with or corrupted during acquisition.
2
Record chain of custody documentation
The collector logs essential metadata including collector name, date, time, serial number, and baseline hash.
Detailed documentation establishes accountability and legal defensibility before the evidence is packaged.
3
Package and seal physical evidence
The physical media is secured inside a anti-static tamper-evident bag with a signed security seal across the opening.
Physical sealing ensures protection against electrostatic discharge and detects any physical compromise.
4
Secure evidence and log custodial transfer
The sealed bag is transferred to an access-controlled evidence vault, and the transfer of custody log is updated.
Maintaining continuous custody tracking prevents claims of evidence contamination or unrecorded access.

Key Concept

Chain of Custody and Evidence Integrity Preservation Workflow
Question 59Question →

An incident responder arrives at a compromised live workstation suspected of running volatile in-memory malware. To preserve digital evidence without destroying transient data, the responder must extract system artifacts in strict adherence to the forensic Order of Volatility (RFC 3227). In what sequence should the analyst collect the following evidence items, starting with the MOST volatile artifact (collected first) and ending with the LEAST volatile artifact (collected last)?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of collection from most volatile to least volatile is: CPU registers and cache contents, System RAM and active network socket tables, Swap file and pagefile contents on the local drive, Bit-stream image of the local secondary storage drive, and Off-site archival backup tapes.
Digital forensics standards (RFC 3227) mandate collecting evidence in order of lifetime volatility: CPU cache and registers change constantly (nanoseconds), System RAM and active network connections are cleared upon power-down (seconds to minutes), temporary swap/pagefiles retain paged data on disk, non-volatile local disk partitions persist across power cycles, and offline archival backup tapes remain stable over long periods.

Step-by-Step Solution

1
Identify the most transient artifacts that change within nanoseconds.
CPU registers and cache contents must be acquired first because any processor instruction or context switch instantly overwrites this state.
Top tier of volatility per RFC 3227.
2
Capture main memory and running kernel state before rebooting or modifying system state.
System RAM and active network socket tables are extracted using live acquisition tools before any changes to operating system processes occur.
Volatile system memory loses all data upon host shutdown.
3
Extract temporary memory paging files stored on disk.
Swap files and pagefiles are collected next, as they contain remnants of volatile RAM swapped to disk during system operations.
Transient storage bridges the gap between dynamic RAM and static disk contents.
4
Perform bit-stream disk acquisition of non-volatile local drives.
A forensic duplicate of the secondary storage drive is imaged using a hardware write-blocker.
Non-volatile storage persists through power cycles and is captured after all live volatile memory artifacts.
5
Identify persistent offline and long-term archival evidence.
Off-site archival backup tapes are cataloged and secured last.
Offline backup media is highly static and has the lowest risk of immediate volatility or decay.

Key Concept

Order of Volatility (RFC 3227)
Question 60Question →

A security engineer is configuring an enterprise Security Information and Event Management (SIEM) pipeline to process raw web application traffic logs and detect potential SQL injection attacks. Arrange the following log processing and analysis stages in the correct sequential order from initial log generation to SOC notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: (1) Raw web server log generation, (2) Field parsing via regular expressions, (3) Data normalization into a common schema, (4) Contextual telemetry enrichment, (5) Correlation rule evaluation across time windows, and (6) SIEM alert generation and SOC escalation.
The SIEM pipeline strictly processes events in sequential stages: raw log creation at the host is followed by parsing string text into discrete key-value fields. Once parsed, fields are normalized to a common enterprise schema so correlation logic remains vendor-agnostic. Enriched telemetry (such as threat intelligence reputational scores) is added next. The correlation engine then compares the normalized, enriched events against time-window thresholds. Finally, matching correlation conditions trigger an automated alert and escalation in the SOC dashboard.

Step-by-Step Solution

1
Identify the event origination point.
The web server creates raw log text locally upon receiving an HTTP request.
Log data must first exist at the source endpoint before it can be collected and processed by SIEM infrastructure.
2
Structure the raw data payload.
SIEM ingestion regex splits string data into discrete key-value pairs.
Unstructured text cannot be efficiently queried or correlated until field boundaries are extracted.
3
Standardize variable names.
Parsed fields map to standard enterprise schema tags.
Normalization ensures correlation logic written for one device type applies across all vendor formats.
4
Augment event data with security context.
Event record receives threat intelligence risk scores and geographic metadata.
Enrichment allows correlation engines to weigh contextual risk (e.g., suspicious IP reputation) during rule evaluation.
5
Analyze multi-event patterns.
Stateful correlation engine detects threshold breaches for malicious patterns within a specified timeframe.
Correlation links individual enriched events together to detect broader attack behaviors.
6
Trigger security response.
An actionable alert is pushed to the SOC queue.
Alert generation notifies analysts after correlation logic confirms a high-confidence security event.

Key Concept

SIEM Log Processing Pipeline Lifecycle
PreviousPage 3 / 9Next
All practice questions — CompTIA Security+ | Examkin