Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 61Question →

An incident response team is conducting live digital forensics on a powered-up enterprise database server experiencing active kernel-level malware execution and network exfiltration. To prevent the loss of critical evidence during acquisition, in what exact sequence should the investigator collect the following digital evidence sources, starting with the MOST volatile source and ending with the LEAST volatile source?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and cache memory → System RAM and active network/kernel tables → Temporary file systems and swap space → Local non-volatile NVMe/SSD storage → Off-site archived backup media.
In digital forensics, evidence acquisition follows RFC 3227 Order of Volatility guidelines to ensure ephemeral data is captured before it evaporates or gets overwritten. CPU registers and L1/L2/L3 cache represent the most volatile tier because data shifts within nanoseconds. Physical RAM, active network sockets, ARP tables, and running process tables form the second tier because they rely on continuous system power. Pagefiles and swap space form the third tier; while located on disk, their contents change rapidly during OS memory swapping. Local persistent storage (SSDs/NVMe) is non-volatile and forms the fourth tier. Off-site archival media and cold backups are static long-term records, placing them in the final, least volatile tier.

Step-by-Step Solution

1
Apply the RFC 3227 Order of Volatility guidelines for digital evidence collection.
Standard hierarchy established: Registers/Cache > System RAM/Kernel Tables > Swap/Temp Files > Local Disk Storage > Remote/Archival Media.
Volatile evidence collection must prioritize storage components with the shortest lifespan to prevent automated memory decay or overwriting.
2
Identify CPU hardware state data as position 1.
Item 1 (CPU registers, L1/L2/L3 cache) is placed first.
Processor registers and cache levels change continuously with every clock instruction cycle, making them extremely transient.
3
Identify system volatile RAM and live kernel structures as position 2.
Item 2 (System RAM, ARP cache, kernel tables) is placed second.
Random access memory depends on constant electrical charge and active power, losing all context immediately upon shutdown or power failure.
4
Identify virtual memory paging and swap structures as position 3.
Item 3 (Swap space, pagefile.sys, temporary file systems) is placed third.
Paging files reside on physical disk sectors but undergo rapid dynamic updates during memory swapping operations.
5
Identify local persistent drive storage as position 4.
Item 4 (Local non-volatile storage, NVMe, SSD) is placed fourth.
Local solid-state or magnetic drives are non-volatile and maintain stored data without electrical power.
6
Identify off-site long-term backups as position 5.
Item 5 (Off-site archived backup tapes, cold cloud snapshots) is placed fifth.
Archival storage backups are static, stored offline or in write-once repositories, and present zero risk of immediate volatile alteration.

Key Concept

Order of Volatility (RFC 3227)
Estimated Time:2m 30s
Question 62Question →

A security architect is configuring a zero-trust network ingress path for an administrator connecting remotely to a sensitive database in an isolated zone. Arrange the operational steps for establishing this administrative session in the correct chronological sequence, from initial external initiation to final host authorization.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with establishing the encrypted transport session to the DMZ bastion host, authenticating identity via MFA on the bastion host, filtering East-West network traffic at the internal stateful firewall, and enforcing endpoint microsegmentation policy on the database server.
Establishing remote administrative access into a restricted segment requires a defense-in-depth sequence. Initial encrypted transport terminates at a DMZ bastion host, followed by MFA verification. Next, stateful internal firewalls allow East-West transit only from the verified jump host IP. Finally, the target host applies microsegmentation policies to validate process identity and grant connection access.

Step-by-Step Solution

1
Establish perimeter ingress session
Client connects securely to the bastion host interface in the DMZ.
Direct connections from external untrusted networks to internal zones are blocked; traffic must terminate at a designated perimeter host.
2
Authenticate user identity and evaluate posture
Administrator identity is verified and granted temporary jump privileges.
MFA and identity verification prevent unauthorized users from using the bastion as an internal relay.
3
Traverse internal zone boundaries
Internal stateful firewall allows traffic from the bastion IP to the protected subnet.
Network-level access control rules enforce zone separation and restrict East-West traffic to explicit administrative paths.
4
Enforce host-level microsegmentation
Target database workload accepts and decrypts the application connection.
Zero trust architecture dictates that host endpoints perform independent, granular verification of incoming traffic regardless of network perimeter checks.

Key Concept

Secure Jump Host Transit and Microsegmentation Enforcement
Question 63Question →

An enterprise Incident Response Team (IRT) detects unauthorized DNS redirection caused by ARP cache poisoning on a critical core network segment. According to standard NIST SP 800-61 incident response frameworks, in what order should the incident response team execute the following operational response steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the standard NIST incident response lifecycle: 1) Preserve evidence during Detection and Analysis, 2) Isolate the attack source during Containment, 3) Purge malicious tools and flush caches during Eradication, 4) Restore operations with monitoring during Recovery, and 5) Perform a lessons-learned review during Post-Incident Activity.
The standard incident response process requires systematically moving through Detection and Analysis (capturing volatile evidence), Containment (blocking rogue switch ports and applying static ARP mappings), Eradication (clearing poisoned ARP tables and deleting malicious scripts), Recovery (restoring standard network behavior under monitoring), and Post-Incident Activity (updating playbooks and holding a lessons-learned meeting).

Step-by-Step Solution

1
Detection & Analysis Evidence Preservation
Network packet captures and volatile RAM are safely preserved without disturbing system artifacts.
Forensic evidence preservation is critical before taking intrusive isolation actions that could alter volatile memory state.
2
Containment
The rogue device's switch port is disabled and static ARP mappings temporarily halt active man-in-the-middle redirection.
Immediate containment prevents further scope expansion and stops unauthorized traffic interception.
3
Eradication
Malicious ARP spoofing tools are removed from compromised systems, and poisoned ARP tables across subnet hosts are cleared.
Eradication eliminates the threat vector and removes corrupted state from the environment.
4
Recovery
Normal dynamic network services are restored while heightened traffic logging verifies system health.
Recovery safely returns infrastructure to operational status under close monitoring to detect any persistence.
5
Post-Incident Activity
A formal lessons learned report is drafted and Network Access Control (NAC) policies are updated.
Post-incident activities complete the lifecycle by enhancing organizational security posture against future attacks.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 64Question →

A Security Operations Center (SOC) team is configuring an automated Endpoint Detection and Response (EDR) incident response workflow to handle host-based malicious script execution. In what sequence should the EDR platform execute the containment, mitigation, and post-incident investigation actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with initial detection, followed by host network isolation, active process termination and file quarantine, volatile forensic artifact collection, and finally deploying updated IOCs across the enterprise.
Effective EDR incident response relies on a structured sequence: detecting anomalous behavior triggers automated playbooks, network isolation prevents lateral movement while preserving volatile state, process termination and quarantine neutralize host impact, forensic data capture enables root-cause investigation, and enterprise-wide IOC deployment prevents repeat attacks.

Step-by-Step Solution

1
Detect malicious behavior to initiate response
Automated incident playbook is triggered upon rule match.
Containment workflows require an initial detection event or alert threshold.
2
Isolate host network interfaces
Host is logically isolated from network traffic except for the EDR management channel.
Prevents lateral movement across the network immediately without shutting down the system or losing volatile RAM evidence.
3
Terminate malicious process and quarantine binaries
Active threat execution on the endpoint is stopped.
Eliminates ongoing execution on the host while keeping host isolation active.
4
Perform forensic evidence collection
Volatile memory dumps and telemetry logs are extracted for investigation.
Evidence preservation and root-cause analysis can be conducted safely after active threats are contained.
5
Broaden protection across enterprise endpoints
Newly identified IOCs are deployed to all agents.
Ensures enterprise-wide immunity against similar attack vectors in future incidents.

Key Concept

EDR Incident Containment and Remediation Workflow
Question 65Question →

Following an EDR telemetry alert indicating an active credential-harvesting attempt on a Windows domain controller, a SOC analyst must execute an incident response procedure. In what sequence should the analyst execute the following actions to effectively contain the threat, preserve evidence, and remediate the endpoint?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response steps is: Apply logical endpoint network isolation through the EDR console -> Acquire a volatile memory snapshot via live response -> Kill the malicious process tree -> Quarantine binary artifacts and remove persistence -> Release the endpoint from network isolation.
The response sequence follows standardized incident handling rules adapted for EDR capabilities. First, host network isolation is applied to halt C2 communications and lateral movement without severing the management channel. Second, volatile memory and telemetry must be collected while processes remain active to capture memory evidence. Third, the malicious process tree is killed to stop execution. Fourth, persistence mechanisms are purged and malicious binaries quarantined. Finally, network isolation is lifted after verifying the host is clean and compliant.

Step-by-Step Solution

1
Isolate the endpoint logically via EDR software controls
External C2 channels and lateral movement vectors are severed instantly, while the analyst retains full EDR remote command capabilities.
Containment must occur first to minimize damage and prevent attacker exfiltration or pivot operations.
2
Collect volatile RAM and process state telemetry
Critical evidence of in-memory credential harvesting is captured.
Volatile evidence must be captured prior to killing processes or altering system state, as terminating processes destroys in-memory artifacts.
3
Terminate the malicious process tree
Active execution of credential-harvesting code is halted.
Stopping malicious execution prevents further unauthorized activity on the endpoint.
4
Remediate host artifacts and persistence
Malicious files are quarantined and registry/scheduled task persistence mechanisms are purged.
Remediation ensures the threat cannot reactivate automatically when system services restart.
5
Restore host network access
The host resumes normal business operations.
Network access should only be restored after verification that all malicious elements are eradicated and baseline policies are active.

Key Concept

EDR Automated Containment and Sequential Incident Response Workflow
Question 66Question →

An incident responder is preparing to collect digital evidence from a powered-on corporate workstation suspected of compromise. According to standard forensic evidence collection guidelines (Order of Volatility), in what sequence should the responder capture the following components, from MOST volatile to LEAST volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and processor cache, System RAM (Random Access Memory), Pagefile / Swap space on the local drive, and Off-site archival backup tape.
Digital forensics principles dictate collecting evidence starting with the most fragile, transient data (CPU cache/registers), moving sequentially through dynamic main memory (RAM), temporary disk files (swap/pagefile), and ending with static offline media (archival tapes).

Step-by-Step Solution

1
Identify the storage locations that lose data almost instantaneously during system execution.
CPU registers and processor cache are prioritized first.
Processor registers and cache change constantly with every instruction cycle and are the most transient data sources.
2
Identify active main memory components that require continuous power.
System RAM is placed second.
Main physical RAM holds active network connections and process structures that disappear upon power loss.
3
Identify temporary virtual memory artifacts stored on persistent media.
Pagefile / Swap space is placed third.
Swap files exist on local hard drives or solid-state drives, making them persistent across reboots despite holding temporary memory structures.
4
Identify long-term static archival media.
Off-site archival backup tape is placed last as the least volatile.
Offline backup media retains data persistently over years without requiring power or active system interaction.

Key Concept

Order of Volatility in Digital Forensics
Question 67Question →

An enterprise Security Operations Center (SOC) detects abnormal outbound DNS traffic indicating potential data exfiltration via DNS tunneling from an internal host. Place the incident response actions in the correct chronological order according to standard NIST incident handling guidelines, starting from the initial response through completion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the standard NIST incident response lifecycle: Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. First, analyze DNS logs and SIEM alerts to verify the threat and scope. Second, apply firewall rules and isolate the compromised workstation to contain exfiltration. Third, terminate malicious processes and remove malware during the eradication phase. Finally, conduct a post-incident review and update playbooks during the lessons learned phase.
The correct order follows the standard NIST SP 800-61 incident response lifecycle. The response begins with Detection and Analysis to confirm the incident and identify affected systems, followed by Containment to halt active DNS exfiltration and network movement. Eradication and Recovery follow to clear malicious artifacts and restore clean state, concluding with Post-Incident Activity to document lessons learned and enhance detection rules.

Step-by-Step Solution

1
Perform Detection & Analysis
Identified the compromised host and verified active DNS tunneling exfiltration.
Accurate scope identification is required before technical remediation can begin.
2
Execute Containment
Blocked outbound tunneling traffic and network-isolated the workstation.
Prevents additional data leakage while preservation and eradication efforts are conducted.
3
Conduct Eradication & Recovery
Removed malicious exfiltration scripts and restored clean host operations.
Ensures the threat vector is completely eliminated before returning the host to normal production.
4
Complete Post-Incident Activity
Updated monitoring rules and documented lessons learned.
Improves security posture and operational playbooks against future DNS tunneling attempts.

Key Concept

Incident Response Lifecycle Phases (NIST SP 800-61)
Question 68Question →

An incident response team is conducting live digital evidence acquisition on a compromised enterprise gateway server suspected of hosting an active in-memory exploit. Based on the RFC 3227 standard Order of Volatility, in what sequence should the forensic investigator capture the following digital evidence components, starting from the most volatile to the least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition sequence from most volatile to least volatile is: Processor cache memory and CPU registers → System RAM → Temporary swap files and virtual memory paging files → Local NVMe solid-state drive partitions and event logs → Remote offsite archival tapes and cloud backup repositories.
Digital forensics follows RFC 3227 guidelines for the Order of Volatility, prioritizing data collection from the most perishable sources to the most stable. CPU registers and cache are updated continuously within nanoseconds and must be gathered first if live CPU state is required. Physical RAM comes next, containing active processes and network sockets that evaporate upon loss of power. Temporary swap files and pagefiles reside on disk but fluctuate frequently with virtual memory management, placing them third. Local NVMe non-volatile disk partitions persist across reboots and are collected fourth. Finally, remote offsite backups and archival tapes are long-term offline media, representing the least volatile evidence source.

Step-by-Step Solution

1
Identify the volatility level of CPU-bound data
Processor registers and cache are identified as operating at nanosecond speeds, making them the most perishable data on the target host.
Any execution change or system halt immediately alters CPU register states.
2
Assess volatile main system memory
System RAM is placed second because power loss or reboot flushes all in-memory structures and active connections.
RAM retains state only while continuous power is supplied to memory modules.
3
Evaluate disk-backed temporary storage
Temporary swap space and pagefiles are sequenced third.
While stored on secondary media, swap contents are continually updated by the OS virtual memory manager and can be overwritten quickly.
4
Sequence fixed persistent local storage
Local NVMe drive partitions are placed fourth.
Non-volatile storage persists data after power down and requires active deletion or wiping to alter contents.
5
Identify offline or remote archival media
Remote offsite archival tapes and cloud backups are placed last as the least volatile data.
Archival media and offsite backups are immutable or detached from live host operations, remaining stable over long periods.

Key Concept

Order of Volatility in Digital Forensics
Question 69Question →

An incident response team is performing live digital evidence acquisition on a compromised enterprise application server following a detected in-memory code injection attack. To ensure dynamic evidence is captured before it is lost or modified, the forensic investigator must collect data strictly according to the standard Order of Volatility. Place the following digital evidence sources in the correct order of acquisition, from MOST volatile (acquired first) to LEAST volatile (acquired last).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition sequence from most volatile to least volatile is: CPU registers and processor cache memory contents -> System RAM, active kernel process tables, and live ARP routing caches -> Temporary file system directories and virtual memory page/swap files -> Local persistent solid-state drive (SSD) system partitions -> Off-site optical backup media and long-term archival tape storage.
The standard Order of Volatility established by RFC 3227 and CompTIA Security+ requires capturing evidence in sequence from shortest lifespan to longest lifespan: 1) CPU registers and cache, 2) Main memory (RAM) and network caches, 3) Temporary file systems and virtual memory/swap space, 4) Non-volatile local disk partitions, and 5) Remote/offline archival backups.

Step-by-Step Solution

1
Identify the primary principle of live evidence acquisition.
Digital evidence must be acquired starting with data that disappears fastest (highest volatility) to preserve transient indicators of compromise.
The Order of Volatility (RFC 3227) dictates that dynamic hardware memory components take precedence over persistent block storage.
2
Evaluate hardware memory volatility.
CPU registers and cache update continuously at CPU clock speeds, followed by system RAM and live kernel network caches.
CPU states are lost instantaneously upon context switching or power loss, while RAM retains dynamic operational data only while powered.
3
Evaluate disk-backed temporary storage vs. persistent block storage.
Swap files and temp directories are prioritized before physical OS disk partitions.
Swap/page files act as extended volatile memory on disk and are rapidly overwritten during continuous system operation compared to static file structures on primary drive partitions.
4
Order long-term and offline storage media.
Local persistent SSD partitions precede offline optical media and backup tapes.
Offline backup media and archival tapes are disconnected, static, and immutable, giving them the lowest volatility of all evidence types.

Key Concept

Order of Volatility (RFC 3227)
Question 70Question →

A security analyst receives a high-severity EDR alert indicating a fileless process injection attack targeting a critical server. To mitigate lateral movement, preserve evidence, and remediate the incident, the analyst must follow a structured EDR incident response workflow. In what order should the analyst perform the following response actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of EDR response actions is: 1) Apply host-level network isolation via the EDR agent while preserving console communication channels, 2) Acquire volatile memory artifacts and process dumps from the endpoint, 3) Run automated remediation playbooks to terminate malicious process trees and remove persistence mechanisms, and 4) Distribute newly extracted Indicators of Compromise (IoCs) to global EDR detection rules.
The proper EDR response workflow prioritizes immediate containment (host network isolation) to stop lateral movement, followed by volatile evidence acquisition (RAM/process dumps) before evidence is destroyed. Once evidence is preserved, active remediation (killing process trees and persistence) is executed. Finally, threat intelligence gained from the incident (IoCs) is deployed globally across all endpoint policies to prevent broader exploitation.

Step-by-Step Solution

1
Isolate the compromised endpoint from the network.
Lateral movement vectors are immediately severed while EDR agent communication remains online.
Containing the threat prevents lateral propagation and reduces enterprise risk before further investigation.
2
Capture volatile RAM and endpoint process telemetry.
Transient forensic artifacts (e.g., injected code in memory) are preserved for analysis.
Terminating processes prior to memory capture destroys critical fileless forensic evidence.
3
Execute remediation playbooks to kill malicious processes and clean persistence.
The active threat components on the host are stopped and eradicated.
Host remediation ensures the attacker can no longer execute commands or maintain access on the system.
4
Update central EDR detection policies with extracted IoCs.
The entire fleet is protected against identical attack vectors across the enterprise.
Post-incident hardening ensures enterprise-wide protection using newly gathered threat intelligence.

Key Concept

EDR Incident Containment, Forensic Acquisition, and Remediation Workflow
Question 71Question →

An incident response team is performing live evidence collection on an enterprise web application server following a detected code injection attack. To preserve forensic integrity, in what sequence should the analyst collect the following data sources, ordered from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU cache and register contents, System RAM and ARP cache, Swap file and pagefile data, Local solid-state drive (SSD) image, and Offsite backup tapes and archival media.
Digital evidence acquisition must adhere strictly to the Order of Volatility (RFC 3227). Data must be collected starting with the most short-lived and fragile sources: CPU registers/cache first, followed by RAM/routing tables, swap files, local persistent disks, and lastly offline archival media.

Step-by-Step Solution

1
Identify the standard forensic Order of Volatility principles (RFC 3227).
Recognized that evidence acquisition must prioritize data sources based on how quickly they can be lost or altered.
Capturing highly perishable data first prevents essential evidence from being overwritten during operational steps.
2
Rank CPU registers and cache as the top priority.
Placed CPU cache and register contents in position 1.
CPU cache registers operate at nanosecond speeds and clear or overwrite continuously.
3
Rank System RAM and network routing/ARP tables as second priority.
Placed System RAM and ARP cache in position 2.
RAM contains live system memory and active connection states lost as soon as power is cut.
4
Rank temporary virtual memory and swap/pagefile data as third priority.
Placed Swap file and pagefile data in position 3.
Although written to storage media, swap files change rapidly as operating system virtual memory pages.
5
Rank persistent local storage and offsite archives in the remaining final positions.
Placed local SSD image in position 4 and offsite backup tapes in position 5.
Non-volatile disk drives and offline archives maintain persistence over extended time frames.

Key Concept

Order of Volatility
Question 72Question →

An Endpoint Detection and Response (EDR) agent detects an active ransomware process attempting to encrypt files on a enterprise workstation. Place the following incident response workflow steps in the correct chronological order from first action to last action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps in the EDR incident response workflow is: 1) Isolate the host from the network, 2) Terminate the malicious process tree, 3) Perform memory analysis and process tree inspection, 4) Execute remediation and remove persistence artifacts.
In standard EDR operational playbooks, the immediate priority upon detecting active malware is containment (host isolation), followed by terminating the active process execution, conducting forensic memory analysis, and finally executing remediation commands to remove persistence.

Step-by-Step Solution

1
Network Host Isolation
The host is isolated from the enterprise network to block lateral movement.
Immediate containment minimizes the threat radius before taking further investigative actions.
2
Malicious Process Termination
The execution of ransomware process threads is stopped.
Terminating the process halts active file encryption on the endpoint.
3
Telemetry & Memory Forensics
Process lineage and memory artifacts are collected for analysis.
Forensic inspection identifies how the attack occurred and what persistence mechanisms were dropped.
4
Remediation & Cleanup
Registry keys are cleaned up and infected files are restored from shadow copies.
Host state is returned to a clean baseline after full analysis and containment.

Key Concept

EDR Automated Containment and Incident Response Workflow
Question 73Question →

An enterprise Security Information and Event Management (SIEM) pipeline is being configured to ingest, analyze, and respond to authentication anomalies across a hybrid environment. Place the following stages of the SIEM log processing pipeline in the correct sequential order from initial endpoint activity to final incident response.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of stages in a SIEM log processing pipeline is: (1) Telemetry Collection, (2) Parsing and Extraction, (3) Data Normalization, (4) Event Correlation, and (5) Alerting and Orchestration.
The correct sequence mirrors the standard data lifecycle within a SIEM pipeline: Telemetry Collection gathers raw logs; Parsing extracts specific variables from text; Normalization standardizes field names across multi-vendor log sources; Correlation applies stateful detection logic across normalized events; and Alerting/Orchestration triggers notifications and automated response playbooks.

Step-by-Step Solution

1
Identify the entry point of event data into the log management pipeline.
Telemetry Collection is established as the initial stage where raw events are emitted and received.
Data must be gathered from endpoints, firewalls, and application servers before any processing can begin.
2
Determine how unstructured log payloads are converted into usable data fields.
Parsing and Extraction follows Collection.
Raw string messages (e.g., Syslog headers or Windows XML) must be broken down into discrete attributes such as IP addresses and event IDs.
3
Standardize variable attributes across multiple vendor platforms.
Data Normalization occurs after Parsing.
Mapping diverse vendor keys (e.g., 'src_ip' vs 'SourceAddress') to a unified schema is required so correlation rules can evaluate events uniformly.
4
Analyze structured, uniform data against security rule logic.
Event Correlation takes place post-normalization.
Correlation engines compare normalized telemetry against detection rules across time windows to detect multi-stage attacks.
5
Identify the response and notification phase resulting from correlation matches.
Alerting and Orchestration is the final stage.
Notifications, ticketing, and automated mitigation actions via SOAR occur only after rule logic identifies a verified threat condition.

Key Concept

SIEM Log Processing Pipeline
Question 74Question →

An organization discovers that an exposed API key associated with a cloud storage container was leaked on a public repository, allowing unauthorized external downloading of sensitive customer backups. Place the following incident response workflow steps in the correct chronological order according to standard incident handling frameworks.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the incident response workflow is: (1) Analyze cloud audit logs to confirm scope, (2) Revoke the exposed API key and restrict storage access, (3) Rotate service accounts and purge unauthorized persistence, (4) Restore normal bucket operations and monitor access, and (5) Conduct an after-action review to update playbooks.
According to NIST SP 800-61 incident response guidelines, response follows a defined sequence: Detection & Analysis (analyzing cloud logs to determine scope), Containment (revoking the leaked key and restricting bucket permissions), Eradication (rotating service accounts and remediating access vulnerabilities), Recovery (restoring production access with monitoring), and Post-Incident Activity (conducting an after-action review).

Step-by-Step Solution

1
Detection & Analysis
Confirm leak details, identify compromised credentials, and establish incident scope.
Accurate scope assessment is necessary prior to implementing targeted containment measures.
2
Containment
Revoke leaked access keys and block further unauthorized data downloads.
Immediate containment stops ongoing exfiltration and mitigates risk to enterprise assets.
3
Eradication
Remove invalid credentials and remediate security posture weaknesses.
Eradication eliminates root threat components from the environment.
4
Recovery
Return systems to clean operational state under heightened monitoring.
Recovery ensures secure operational continuity.
5
Post-Incident Activity
Document lessons learned and update operational security playbooks.
Post-incident review improves future incident response capabilities and controls.

Key Concept

NIST Incident Response Lifecycle Phases (Detection/Analysis -> Containment -> Eradication -> Recovery -> Post-Incident Activity)
Question 75Question →

A security administrator is establishing a SIEM log handling pipeline for enterprise endpoint and network telemetry. Place the following stages of SIEM log processing in the correct sequential order, starting from the initial arrival of raw security telemetry to final analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages from ingestion to response is: Log Data Collection, Parsing and Field Normalization, Data Indexing and Storage, Event Correlation Engine Processing, and Alert Generation and Incident Dispatch.
The standard SIEM data pipeline follows a strict logical workflow: raw telemetry is collected from endpoints and network devices (Log Data Collection), converted into a unified structure (Parsing and Field Normalization), stored with fast retrieval keys (Data Indexing and Storage), evaluated across sources against security logic (Event Correlation Engine Processing), and finally escalated to analysts when malicious conditions are matched (Alert Generation and Incident Dispatch).

Step-by-Step Solution

1
Identify the ingress stage of raw log telemetry.
Log Data Collection occurs first as telemetry is gathered from diverse source devices.
Raw logs cannot be processed, searched, or analyzed before they are gathered by SIEM agents or collectors.
2
Determine how diverse log formats are converted into standardized fields.
Parsing and Field Normalization immediately follows log collection.
Different operating systems and applications format logs differently; normalization translates raw strings into common fields like source IP, destination IP, and event ID.
3
Identify how processed logs are prepared for rapid search and retention.
Data Indexing and Storage is applied to normalized log records.
Indexing creates fast lookup structures so complex queries and correlation algorithms can run efficiently over high-volume data.
4
Analyze how pattern detection occurs across stored events.
Event Correlation Engine Processing evaluates indexed data against defined logic.
Correlation requires access to structured, indexed events to match multi-event patterns across disparate log sources.
5
Determine the final output stage triggering analyst workflow.
Alert Generation and Incident Dispatch occurs after correlation logic flags suspicious behavior.
Alerts are generated only after correlation logic successfully detects a policy violation or threat indicator.

Key Concept

SIEM Log Processing Pipeline
Question 76Question →

A security analyst is establishing the standard administrative workflow for user onboarding and offboarding within an enterprise Identity and Access Management (IAM) system. Place the following identity lifecycle steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for identity and access management operations begins with identity verification, followed by account provisioning with role-based access, MFA token enrollment, and finally access recertification and deprovisioning.
The correct operational order follows the standard Identity and Access Management (IAM) lifecycle: first verify the person's identity, then provision the account with appropriate rights, enroll the user in MFA for secure access, and continuously perform access recertification and eventual account deprovisioning.

Step-by-Step Solution

1
Identify initial identity validation
Identity verification and identity proofing must occur first.
Organizations must confirm the identity of an individual before creating user accounts or granting enterprise resource access.
2
Establish digital credentials
Account provisioning and role assignment occur next.
An active account object in the domain directory is required before secondary security configurations can take place.
3
Apply strong authentication controls
Multi-Factor Authentication (MFA) enrollment follows credential provisioning.
The user binds their hardware token or authenticator app to their newly created user account.
4
Manage ongoing operations and termination
Access recertification and deprovisioning represent the operational audit and end-of-lifecycle phase.
Privilege recertification audits entitlement drift over time, and deprovisioning revokes rights when employment ends.

Key Concept

Identity Lifecycle Management
Question 77Question →

A Security Operations Center (SOC) analyst receives an active EDR telemetry alert indicating that a Windows workstation is executing malicious code via a Living-off-the-Land (LotL) binary. Place the following Endpoint Detection and Response (EDR) containment and incident handling actions in the correct chronological order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: 1) Apply software-based host network isolation through the EDR console, 2) Terminate the malicious process and its associated child process tree via the EDR process lineage view, 3) Gather volatile system telemetry, including process memory dumps and EDR sensor logs, for analysis, and 4) Remove persistence artifacts, such as malicious scheduled tasks or registry keys, and lift host isolation.
In standard EDR incident response workflows, immediate containment (network isolation via the software agent) takes precedence to stop C2 traffic and lateral movement. Next, active malicious process trees are terminated to freeze payload execution. Once contained, volatile forensic artifacts (RAM/process dumps) are collected for root-cause analysis. Finally, persistence mechanisms are eradicated and system integrity is verified before removing isolation.

Step-by-Step Solution

1
Isolate the endpoint on the network using the EDR agent.
Network communication to external adversary C2 servers and adjacent internal hosts is halted immediately.
Preventing lateral movement and outbound data exfiltration is the top priority during active endpoint compromise.
2
Terminate active malicious processes identified by EDR process lineage tracking.
The execution of malicious payloads on the local machine stops.
Stopping active memory execution prevents further host degradation or local encryption after the network perimeter of the host is locked down.
3
Trigger remote volatile telemetry collection via EDR forensic capabilities.
Memory dumps and sensor logs are preserved for root-cause investigation.
Forensic telemetry provides necessary IoCs to determine the initial breach vector without interrupting critical containment steps.
4
Perform system remediation and remove persistent startup entries before restoring full network connectivity.
The endpoint is clean and safe to rejoin normal production operations.
Restoring network connectivity prior to removing persistence mechanisms allows the adversary to regain access immediately upon reconnection.

Key Concept

EDR Incident Containment and Response Lifecycle
Estimated Time:1m 30s
Question 78Question →

A security operations team is implementing Just-In-Time (JIT) access controls within a Privileged Access Management (PAM) framework to reduce standing administrative privileges. Place the operational steps of a JIT privileged access session lifecycle in the correct sequential order from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for a Just-In-Time (JIT) privileged access lifecycle is: 1) Request submission with justification, 2) Policy evaluation and approval routing, 3) Issuance of ephemeral or temporary credentials, 4) Brokered session execution with recording, and 5) Automatic session revocation and credential rotation.
Just-In-Time (JIT) access management operates on a strict sequence to prevent standing privileges. First, an administrator requests elevated rights with valid justification. Next, the PAM platform validates contextual policies and obtains necessary approvals. Third, short-lived credentials or certificates are provisioned. Fourth, the user connects via a proxied gateway that logs all actions. Finally, upon expiration of the session timer, access is revoked and credentials are automatically rotated.

Step-by-Step Solution

1
Identify the request phase
The administrator submits an access request specifying the target system and justification.
JIT workflows require explicit user initiation with business context before elevated permissions are granted.
2
Identify the authorization and policy check phase
The PAM platform evaluates contextual policies and routes the request for approval.
Access policy checks and approvals ensure zero trust principles are enforced before issuing access.
3
Identify credential provision
The PAM service issues short-lived ephemeral credentials or checks out a temporary account.
Credentials must be generated or checked out dynamically only after successful request approval.
4
Identify active session monitoring
The user connects via a brokered PAM gateway with keystroke and session logging.
Privileged sessions require real-time proxying and auditing to maintain security compliance.
5
Identify lifecycle termination
The PAM system revokes permissions and rotates account credentials when the window expires.
Automatic revocation and rotation eliminate standing privileges and secure the target resource.

Key Concept

Just-In-Time (JIT) Privileged Access Management Lifecycle
Question 79Question →

A Security Operations Center (SOC) analyst detects an unauthorized third-party integration added to an enterprise cloud tenant, followed by bulk exfiltration of sensitive email records via an exposed OAuth 2.0 token. According to standard incident response frameworks, in what sequence should the IR team execute the following response and recovery steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response steps is: 1) Revoke the malicious OAuth 2.0 token and isolate compromised user accounts to stop ongoing exfiltration (Containment); 2) Remove the rogue third-party app integration from the cloud tenant and audit application permissions (Eradication); 3) Restore compromised account configurations, issue new credentials, and re-enable monitored email services (Recovery); 4) Conduct a post-incident review to document the timeline and update consent policies (Lessons Learned).
NIST SP 800-61 Rev 2 incident response playbooks require executing steps sequentially: Containment (revoking tokens/isolating accounts to stop damage), Eradication (deleting rogue applications to remove persistence), Recovery (restoring account configurations and services safely), and Lessons Learned (post-incident reviews to refine policy and controls).

Step-by-Step Solution

1
Identify initial Containment actions
Revoking the active OAuth token and isolating affected accounts immediately halts unauthorized data exfiltration.
Containment is the priority operational phase immediately following detection to minimize blast radius.
2
Identify Eradication actions
Deleting the rogue OAuth application integration removes the threat actor's persistence mechanism.
Eradication eliminates root-cause vulnerabilities and malicious artifacts once active threats are contained.
3
Identify Recovery actions
Resetting credentials and re-enabling email services returns the business environment to normal baseline operation.
Recovery validates that systems are clean and monitored before restoring them to full production.
4
Identify Post-Incident / Lessons Learned actions
Documenting metrics and updating cloud consent policies hardens governance against similar attack vectors.
Lessons learned activities synthesize incident metrics to strengthen controls and update playbooks post-remediation.

Key Concept

Incident Response Lifecycle Phases (NIST SP 800-61 Rev 2 / CompTIA IR Framework)
Question 80Question →

During a security event, an Endpoint Detection and Response (EDR) agent deployed on a critical file server detects suspicious rapid file modification patterns consistent with ransomware activity. Arrange the following EDR incident containment and response steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct response sequence begins with ingesting and triaging the initial EDR alert, followed immediately by initiating agent-based network isolation to prevent lateral movement. Next, volatile memory is captured and active malicious processes are killed. Following host containment, malicious files are quarantined and modified files are remediated. Finally, a complete system integrity scan is completed before restoring network connectivity.
The standard EDR containment workflow prioritizes rapid threat isolation to prevent lateral movement, followed by volatile evidence preservation, malicious process termination, file quarantine/remediation, and finally health verification prior to restoring network access.

Step-by-Step Solution

1
Identify and validate threat telemetry
Alert triage confirms active ransomware behavior on the endpoint.
Detection and triage must precede any intervention to verify the scope of the alert.
2
Enforce host isolation via EDR agent
The host is logically isolated from the network while preserving EDR agent management channels.
Immediate containment stops command-and-control (C2) communication and prevents lateral movement across the enterprise.
3
Dump volatile memory and terminate malicious processes
RAM artifacts are saved for forensic examination and execution of the attack payload is halted.
Capturing memory prior to process termination ensures critical volatile evidence is preserved.
4
Quarantine binaries and execute rollback remediation
Malicious code is removed and modified system files are restored from clean snapshots.
Eradication eliminates host artifacts and restores compromised assets to a known good state.
5
Validate endpoint health and un-isolate host
System cleanliness is verified and full network access is safely re-established.
Reconnection to the network should only occur after verified remediation.

Key Concept

Endpoint Detection and Response (EDR) Incident Containment Workflow
PreviousPage 4 / 9Next
All practice questions — CompTIA Security+ | Examkin