All practice questions
2232 questions
A security operations team identifies active network exfiltration originating from a compromised, ephemeral container running on a live enterprise Linux host. Enterprise auto-scaling rules are triggered, which will automatically terminate and delete the container instance within minutes. To preserve forensic evidence for legal proceedings while strictly adhering to the order of volatility, which of the following actions should the incident responder take FIRST?
A Security Operations Center (SOC) analyst is investigating an automated SIEM alert triggered during incident response telemetry collection. The analyst reviews the following correlated chronological log snippet collected from an internal host (`host-app01`), a perimeter Web Application Firewall (`WAF-EDGE01`), and a backend database server (`db-prod01`):
[2026-07-27T14:10:02Z] host-app01 sshd[14201]: Failed password for root from 10.0.4.88 port 49152 ssh2
[2026-07-27T14:10:04Z] host-app01 sshd[14205]: Accepted password for svc_deploy from 10.0.4.88 port 49154 ssh2
[2026-07-27T14:12:30Z] WAF-EDGE01 action="ALERT_ONLY" src="10.0.4.88" uri="/db_admin.php?user=admin' OR '1'='1" signature="SQLi_Generic_Clause"
[2026-07-27T14:13:01Z] db-prod01 mariadb[882]: [Access Granted] User 'svc_deploy'@'10.0.4.88' executed query: "SELECT * FROM customer_pii;"
Based on the log telemetry above, which of the following security findings and incident conclusions are correct? (Select TWO.)
Select all that apply
A security operations team is configuring an automated threat intelligence pipeline to enrich SIEM alerts and dynamically update perimeter firewall defense rules with real-time indicators of compromise and vulnerability data. Which of the following sources or protocols should the team integrate to achieve structured, machine-readable threat sharing and standardized vulnerability context? (Select TWO.)
Select all that apply
During a security audit of an enterprise network management tool, an analyst reviews source code responsible for diagnostic ping tests. The function constructs shell commands using unvalidated user input:
c
char command[256];
sprintf(command, "ping -c 3 %s", user_input);
system(command);
An attacker submits the payload `127.0.0.1 && cat /etc/passwd` into the input field. Which of the following vulnerabilities is present in this application code, and what is the most effective remediation?
A Security Operations Center (SOC) analyst is investigating a high-priority alert in a SIEM platform. The following log snippet was captured from a Linux server's authentication system:
Jul 27 14:02:11 host01 sshd[14201]: Failed password for invalid user admin from 198.51.100.45 port 49152 ssh2
Jul 27 14:02:13 host01 sshd[14205]: Failed password for invalid user root from 198.51.100.45 port 49154 ssh2
Jul 27 14:02:15 host01 sshd[14209]: Failed password for valid user jsmith from 198.51.100.45 port 49156 ssh2
Jul 27 14:02:18 host01 sshd[14212]: Accepted password for valid user jsmith from 198.51.100.45 port 49160 ssh2
Jul 27 14:02:22 host01 sudo: jsmith : TTY=pts/1 ; PWD=/home/jsmith ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow
Based on the log sequence provided, which of the following best describes the nature of the security incident?
A security analyst is investigating internal credential harvesting alerts resulting from unauthorized network traffic interception. The investigation reveals that attackers on the local subnet are capturing user authentication hashes by spoofing responses to unresolvable broadcast requests for local network resources. Which of the following enterprise hardening practices should the security team implement to BEST mitigate this vulnerability?
An enterprise security architecture team is designing an automated identity mechanism to allow microservices running on an Amazon Web Services (AWS) Kubernetes cluster to securely request data from resources hosted on Google Cloud Platform (GCP). The solution must eliminate static, long-lived service account access keys, provide automated credential rotation, and cryptographically establish workload identity trust across cloud providers. Which of the following Identity and Access Management (IAM) architectural solutions best meets these requirements?
A cloud-native software enterprise is implementing Zero Trust Architecture (ZTA) principles across its microservices platform to prevent lateral movement following a potential system compromise. Which of the following implementation strategies best adheres to Zero Trust principles for service-to-service communication within the internal cluster?
A security analyst is investigating a service disruption on a C-based legacy network daemon. Examination of the stack memory dump reveals that an incoming request sent a payload exceeding the allocated array bounds, overwriting the adjacent memory locations and altering the function return address to execute injected instructions. Which of the following application vulnerabilities is demonstrated in this scenario?
A security audit of an organization's internal infrastructure reveals two major compliance failures: administrative credentials and configuration data are being transmitted in cleartext across management subnets, and active administrative sessions on management consoles remain authenticated indefinitely without user activity. Which of the following enterprise hardening practices should the security team implement to directly address these findings? (Select TWO.)
Select all that apply
A Security Operations Center (SOC) analyst detects anomalous outbound network traffic originating from an automated CI/CD build worker node. Telemetry confirms that a compromised runner script exfiltrated temporary cloud provider authentication tokens to an external command-and-control server and is currently reading production database credentials stored in secret memory. According to the NIST incident response lifecycle guidelines (SP 800-61), which of the following actions should the analyst execute FIRST?
An organization is updating its network architecture to securely integrate legacy point-of-sale (POS) terminals with a cloud-based inventory system while maintaining PCI DSS compliance. The legacy POS terminals run older operating systems that cannot support endpoint agent installations or host firewalls. Which of the following network segmentation controls should the security team implement to isolate these legacy devices and restrict unnecessary lateral traffic? (Select TWO.)
Select all that apply
An incident response investigator is tasked with preserving forensic evidence from a live high-frequency trading server that was compromised during an active cyber intrusion. The server is currently powered on and running critical processes in memory. To ensure that digital evidence is collected without destroying highly transient artifact state in compliance with RFC 3227 guidelines, in what sequence should the investigator acquire the artifacts from most volatile to least volatile?
Drag items to arrange them in the correct order
During operational security monitoring, a SOC analyst receives an automated alert indicating that an administrative workstation has established unauthorized command-and-control (C2) communications following the execution of a malicious macro from a spear-phishing email. According to standard incident response playbooks for initial containment and evidence preservation, which of the following immediate steps should the analyst perform? (Select TWO.)
Select all that apply
An incident responder is dispatched to preserve evidence from a powered-on corporate database server involved in an ongoing security breach. To ensure evidence integrity and adhere to forensic best practices, which of the following actions should the responder take? (Select TWO.)
Select all that apply
A Security Operations Center (SOC) analyst receives an alert showing that a user workstation is executing a suspicious PowerShell script attempting lateral movement across the network. Which of the following capabilities provided by an Endpoint Detection and Response (EDR) solution should the analyst execute immediately to contain the threat while preserving management access?
Following the detection and initial triage of an active web shell exploit on an enterprise web server, a Security Operations Center (SOC) analyst must execute the incident response playbook. Arrange the following operational response procedures in the correct chronological sequence according to standard NIST incident response lifecycle guidelines, from the earliest action to the final action.
Drag items to arrange them in the correct order
A network engineer is investigating security alerts after several host systems on an enterprise subnet unexpectedly autoconfigured IPv6 address interfaces and began routing outbound network traffic through an unknown link-local address. Which of the following technical indicators directly confirm that a Rogue IPv6 Router Advertisement (RA) attack is taking place? (Select TWO).
Select all that apply
An enterprise infrastructure team is redesigning the storage connectivity for a mission-critical database host attached to a Storage Area Network (SAN). The primary goal is to eliminate single points of failure in the physical and logical communication paths between the host server and the storage array, ensuring continuous throughput even if a cable or adapter fails. Which of the following technical controls should the team implement to meet these criteria? (Select TWO).
Select all that apply
A security analyst receives an alert regarding an obfuscated command executing on a workstation assigned to an executive assistant. Traditional signature-based antivirus software on the host reported no malicious findings because the command payload was executed directly in memory without writing a file to the disk. However, the Endpoint Detection and Response (EDR) agent flagged the activity and blocked execution based on the anomalous process relationship where a word processing application spawned an encoded shell interpreter. Which EDR capability enabled the detection and intervention in this scenario?