Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 81Question →

A Security Operations Center (SOC) analyst receives a high-severity alert from a Wireless Intrusion Prevention System (WIPS) indicating that an unauthorized rogue access point has been connected to an internal network switch port. Which of the following sequence of steps represents the correct order for responding to this incident according to standard incident response playbooks?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response actions is: 1) Validate the alert by analyzing switch port logs and netflow data; 2) Logically isolate the affected switch port via network management tools; 3) Physically remove the unauthorized access point and update NAC policies; 4) Restore standard switch port settings and verify network telemetry; 5) Conduct a post-incident review to document lessons learned.
Standard incident response frameworks (such as NIST SP 800-61) define a strict sequential process: Detection and Analysis (validating the WIPS alert via switch logs), Containment (logically isolating the switch port), Eradication (physically removing the rogue AP and updating NAC rules), Recovery (restoring switch port operation safely and monitoring telemetry), and Post-Incident Activity (conducting a lessons learned review).

Step-by-Step Solution

1
Perform Detection and Analysis
Confirmed rogue access point location and operational impact.
Before initiating containment or remediation, responders must analyze and validate the alert to verify an actual incident is taking place.
2
Implement Containment
Rogue access point network communication is disabled.
Isolating the switch port stops potential data exfiltration and unauthorized network access while preserving evidence.
3
Execute Eradication
Rogue hardware is physically removed and NAC controls are updated.
Eradication removes the root cause of the incident from the network architecture.
4
Perform Recovery
Switch port is securely re-enabled and monitored for clean operational status.
Recovery ensures affected infrastructure is returned to safe production operations with active monitoring.
5
Conduct Post-Incident Activity
Incident report created and physical security playbooks updated.
Lessons learned feed back into the incident response lifecycle to harden enterprise defenses against future incidents.

Key Concept

Incident Response Lifecycle Phases (NIST SP 800-61)
Estimated Time:1m 30s
Question 82Question →

An organization is establishing a secure onboarding process for system administrators to enforce least privilege and privileged access management (PAM). In what order should the administrative security operations team perform the following operational tasks during user onboarding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with identity verification via HR records, followed by provisioning a standard baseline account in the Identity Provider, then integrating the user into the Privileged Access Management solution, and concluding with enforcing Multi-Factor Authentication and conducting a final permission audit.
The correct sequence starts with identity verification against authoritative HR records to validate authorization. Next, a basic non-privileged account is created in the central Identity Provider to enforce least privilege. The account is subsequently registered in the Privileged Access Management (PAM) vault to manage temporary elevation securely. Finally, Multi-Factor Authentication (MFA) registration is completed and initial permissions are audited to finalize secure onboarding.

Step-by-Step Solution

1
Identity Validation
HR authorization baseline confirmed.
Prevents unauthorized account creation by confirming employment and role requirements before generating directory objects.
2
Baseline Provisioning
Standard non-privileged account created.
Establishes a core user identity following least privilege principles prior to assigning elevated rights.
3
PAM System Integration
Identity linked to vault for just-in-time privilege checkouts.
Ensures administrative activities are subject to credential vaulting, session recording, and automated access revocation.
4
MFA Activation & Audit
Strong authentication registered and RBAC baseline verified.
Ensures multifactor security controls are operational and access limits are verified before granting access to systems.

Key Concept

Identity Lifecycle Management and PAM Onboarding Operations
Question 83Question →

A security analyst is acquiring digital evidence from a running enterprise application server immediately after detecting an active intrusion. Place the evidence sources in sequence according to the standard order of volatility, starting with the MOST volatile evidence first and ending with the LEAST volatile evidence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of volatility from most volatile to least volatile is: CPU cache and processor registers, followed by System RAM and ARP cache, Temporary swap space and pagefiles, Local solid-state drive (SSD) storage, and finally Offsite optical and magnetic backup tapes.
Digital forensics standards dictate capturing evidence in order of decreasing volatility to prevent data loss. CPU registers and cache memory vanish almost instantaneously, followed by system RAM and dynamic network tables, virtual memory swap files on disk, non-volatile local drives, and lastly offsite backup media.

Step-by-Step Solution

1
Identify CPU hardware state as the highest priority.
CPU cache and processor registers are placed first.
Registers and processor cache are the most short-lived data structures in a computer system.
2
Prioritize main system RAM and active network cache.
System RAM and ARP cache are placed second.
Volatile memory contains running process code, cryptographic keys, and active network states that disappear on shutdown.
3
Order secondary virtual storage and local drives.
Temporary swap space and pagefiles are placed third, followed by local SSD storage fourth.
Swap files update dynamically during system runtime, while primary local disk storage retains persistent files.
4
Place long-term offline archives last.
Offsite optical and magnetic backup tapes are placed fifth.
Offline backup media is immutable and least susceptible to immediate modification or loss.

Key Concept

Order of Volatility
Estimated Time:1m 30s
Question 84Question →

An enterprise identity administrator is enforcing phishing-resistant multi-factor authentication (MFA) for privileged accounts. What is the correct sequence of events for registering a FIDO2 WebAuthn hardware security key with the Identity Provider (IdP)? Place the steps in chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct registration sequence begins with the IdP issuing a cryptographic challenge nonce to the client browser. Next, the user touches the hardware key to generate an origin-bound asymmetric key pair on the device. Then, the security key signs the challenge and returns the signature, public key, and attestation data to the IdP. Finally, the IdP validates the attestation statement and registers the public key to the user's IAM account profile.
The correct sequence follows the standard FIDO2/WebAuthn registration ceremony. First, the Identity Provider initiates the process by issuing a cryptographic challenge nonce to the browser. Second, upon user presence confirmation, the hardware token generates an origin-bound asymmetric key pair. Third, the token signs the challenge with the private key and returns the public key and attestation payload. Fourth, the Identity Provider verifies the attestation and signature before persisting the public key in the user's IAM profile.

Step-by-Step Solution

1
Identify the initial server-side trigger.
The Identity Provider generates a cryptographic challenge nonce to prevent replay attacks during WebAuthn registration.
Challenge creation must occur first so that the hardware key has fresh data to sign.
2
Determine the local hardware token response.
The user completes physical presence verification (e.g., touch sensor), prompting the security key to generate an origin-bound public/private key pair.
The key pair is created on-device in response to the browser receiving the registration challenge.
3
Trace the transmission of cryptographic proof.
The security key signs the challenge nonce using the private key and returns the signature, new public key, and attestation object to the IdP.
The IdP requires the signature and public key to verify authentic token hardware before enrollment.
4
Finalize identity binding at the Identity Provider.
The IdP authenticates the attestation metadata, verifies the signature against the issued challenge, and binds the public key to the user's IAM profile.
Saving the verified public key in the IAM user store is the final step required for future authentication.

Key Concept

FIDO2/WebAuthn Enrollment Ceremony and Cryptographic Credential Binding
Question 85Question →

A Security Operations Center (SOC) analyst is reviewing an automated response playbook triggered by an Endpoint Detection and Response (EDR) agent following a suspected credential dumping attack against a high-value server. In what chronological sequence should the EDR agent and SOC workflow execute these actions to contain the threat and preserve forensic evidence?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Detect anomalous API memory read requests targeting LSASS, 2) Enforce host-level software network isolation, 3) Capture a volatile memory dump and terminate the offending process tree, and 4) Query tenant-wide EDR telemetry to identify other impacted endpoints.
The sequence follows the core EDR lifecycle: Detection must precede response; host-level network isolation must be established immediately after detection to block lateral spread; volatile memory collection and process termination follow isolation to safely remediate the host; and tenant-wide telemetry correlation occurs last to assess broader enterprise compromise.

Step-by-Step Solution

1
Identify initial threat activity.
The EDR behavioral monitor alerts on unauthorized memory access to sensitive system processes.
Detection provides the trigger for automated playbook execution.
2
Isolate the compromised system.
Host-based firewall rules block all inbound/outbound communication except EDR management connections.
Containment limits adversary lateral movement while keeping SOC visibility intact.
3
Acquire evidence and eradicate host execution.
Physical memory artifacts are saved to disk, followed by process tree termination.
Preserving volatile RAM prior to or simultaneously with process termination ensures critical memory-resident indicators are retained.
4
Perform enterprise scope analysis.
Telemetry indicators from the alert are cross-referenced across all enterprise endpoints.
Broader threat hunting ensures full scope eradication across the enterprise domain.

Key Concept

EDR Automated Containment and Incident Response Workflow Sequence
Question 86Question →

An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, validate the initial network alert to verify whether it represents a real event or false positive; second, examine relevant packet captures and netflow logs to determine the scope; third, isolate the affected workstation from the network; fourth, document the monitoring findings and notify the incident response team.
Effective network security monitoring follows a structured workflow: alert triage and validation must happen first, followed by telemetry inspection to scope the incident, host isolation to contain risk, and finally thorough documentation and incident escalation.

Step-by-Step Solution

1
Alert Validation
Confirmed genuine alert requiring investigation.
Before acting on an alert, security analysts must rule out false positives.
2
Telemetry & Log Analysis
Identified destination IP address and traffic volume.
Reviewing packet captures and network flows helps identify the exact nature and extent of the threat.
3
Host Containment
Workstation disconnected from local subnet.
Preventing lateral movement or exfiltration is critical once suspicious activity is confirmed and scoped.
4
Documentation & Escalation
Alert ticket updated and escalated to tier-2 incident response.
Proper documentation ensures complete chain-of-custody and smooth operational handoff.

Key Concept

Network Security Monitoring Triage & Incident Workflow
Question 87Question →

A security operations center (SOC) detects an active compromise of an administrative account with elevated privileges across hybrid cloud infrastructure. To contain the incident and restore secure identity operations according to privileged access management (PAM) best practices, place the mitigation and lifecycle remediation steps in the correct chronological sequence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for containing and remediating a compromised privileged account is: First, terminate active sessions and invalidate tokens at the IdP; second, trigger an automated SCIM push to revoke downstream federated SaaS access; third, rotate vaulted credentials within the PAM solution; fourth, perform an IGA entitlement recertification audit.
In security operations, incident containment prioritizes immediate threat suppression: active session termination and token invalidation at the IdP stop ongoing adversary actions. Once centralized sessions are severed, automated SCIM provisioning pushes account disablement to downstream federated services. Next, secrets stored in the PAM vault are rotated to prevent credential reuse. Finally, IGA recertification cleanses unauthorized entitlement changes made by the threat actor.

Step-by-Step Solution

1
Perform immediate active session containment
Active adversary connections are terminated and access tokens are invalidated at the centralized Identity Provider.
Containment must occur at the root IdP level before attackers can pivot or establish additional persistence mechanisms.
2
Synchronize account disablement across federated environments
SCIM protocol updates disable state across external Service Providers (SPs).
Relying solely on central IdP disablement without SCIM or continuous access evaluation (CAE) can leave active SaaS sessions functional until refresh tokens expire.
3
Rotate administrative secrets and vault baseline credentials
All static and dynamic passwords, API keys, and certificates associated with the compromised account are refreshed in the PAM vault.
Vault rotation ensures that harvested credentials cannot be reused to re-authenticate after sessions are killed.
4
Execute post-incident Identity Governance and Administration (IGA) recertification
All granted entitlements, group memberships, and role assignments are audited and reconciled against authorization baseline policies.
IGA recertification verifies that persistence mechanisms, such as unauthorized role assignments created during the incident, are completely removed.

Key Concept

Identity Lifecycle and Incident Response Containment in IAM Operations
Question 88Question →

Place the typical steps of an automated Security Orchestration, Automation, and Response (SOAR) incident playbook in the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for an automated SOAR playbook is: 1) Ingest the alert payload automatically from a SIEM or EDR integration, 2) Enrich the alert data by querying external threat intelligence feeds for IP and domain reputation, 3) Execute active containment measures, such as applying a firewall block rule or isolating the affected endpoint, and 4) Update the incident ticket in the ITSM platform with execution logs and notify the security analyst.
An automated SOAR incident response playbook follows a logical operational flow: alert ingestion occurs first upon event detection, followed immediately by automated threat intelligence enrichment. After validating indicators, the playbook executes active containment integrations (such as network blocks or host isolation), and concludes by updating the ticketing system with full execution logs.

Step-by-Step Solution

1
Trigger workflow upon alert reception
Alert data is passed into the SOAR engine.
An automated playbook requires a triggered event payload to initiate execution.
2
Perform contextual threat enrichment
Indicators of compromise are checked against threat intelligence.
Gathering context ensures containment decisions are based on verified threat reputation.
3
Invoke automated containment integrations
Network perimeter or endpoint controls block the threat.
Containment API calls execute after conditions and enrichment checks pass.
4
Complete ticketing and analyst notification
The incident tracking system records all automated actions.
Final documentation and audit trail updates occur after containment actions finish.

Key Concept

SOAR Playbook Execution Lifecycle
Question 89Question →

A security analyst is implementing an incident response playbook following a confirmed unauthorized access event on an internal code repository server. Arrange the following incident response actions in the correct chronological sequence according to standard NIST SP 800-61 guidelines, from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: (1) Analyze SIEM event logs and system artifacts, (2) Revoke compromised credentials and isolate the affected server, (3) Re-image the repository server from a clean baseline, and (4) Document the incident timeline and update policies.
According to the NIST SP 800-61 incident response framework, the lifecycle follows a strict sequence: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity (Lessons Learned). Analyzing logs identifies the breach scope first, followed by isolating the server and revoking compromised credentials to contain the threat. Once contained, the server is re-imaged and restored during eradication and recovery. Finally, root-cause documentation and policy updates are conducted during post-incident lessons learned.

Step-by-Step Solution

1
Perform Detection and Analysis
Identify the vector of unauthorized access and determine affected scopes by analyzing log sources.
Before containing an incident, analysts must confirm the nature and extent of the threat.
2
Execute Containment
Halt lateral movement and exfiltration by isolating host systems and revoking compromised credentials.
Containment limits damage while preventing the attacker from maintaining active sessions.
3
Perform Eradication and Recovery
Re-image compromised systems with verified clean media and safely restore services.
Eradication removes threat components, while recovery restores systems to operational status safely.
4
Conduct Post-Incident Activity
Conduct a lessons learned review, create documentation, and implement preventative control updates.
Post-incident review helps improve future response capabilities and fixes systemic vulnerabilities.

Key Concept

NIST Incident Response Lifecycle Sequential Phases
Question 90Question →

A Security Operations Center (SOC) analyst receives an EDR behavioral alert indicating an unauthorized persistence script running on an internal database host. In what order should the analyst execute the following actions to effectively contain, triage, and remediate the incident using EDR capabilities?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with isolating the endpoint network traffic, stopping active malicious processes, collecting volatile forensic data, conducting root-cause process tree analysis, and deploying enterprise-wide IOC block rules.
The standard incident response containment sequence for EDR workflow mandates immediate host-level network isolation (to stop lateral spread), followed by process termination (to stop active execution), volatile evidence capture (for forensics), root-cause analysis via process lineage telemetry, and enterprise policy updating (to enforce long-term mitigation).

Step-by-Step Solution

1
Isolate the compromised endpoint from the network via EDR.
Prevents lateral movement and C2 traffic while maintaining EDR management channels.
Containment is the primary objective upon identifying active endpoint compromised activity to limit blast radius.
2
Terminate malicious process lineage.
Stops ongoing execution of payload and persistence scripts.
Halting execution prevents further system alteration or memory dumping attempts.
3
Capture live memory and volatile forensic artifacts.
Gathers live memory dump and volatile state evidence.
Preserving volatile evidence prior to analysis ensures complete forensic coverage.
4
Perform root cause analysis using EDR telemetry.
Identifies initial execution vector and compromised user context.
Tracing process lineage reveals how the threat bypassed initial controls.
5
Distribute updated EDR policy rules and block lists enterprise-wide.
Enforces enterprise hardening against identified hashes and behavioral indicators.
Prevents identical attacks across other endpoints in the organization.

Key Concept

EDR Incident Containment and Investigation Lifecycle
Estimated Time:1m 30s
Question 91Question →

An identity and access management administrator must execute the standard offboarding workflow upon an employee's immediate departure. Arrange the operational deprovisioning steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct deprovisioning sequence begins with verifying the HR notification, immediately revoking active SSO sessions and tokens, disabling the user account in directory services, stripping entitlements and reassigning data ownership, and finally archiving logs for compliance retention.
The correct sequence aligns with IAM operational best practices for offboarding: verifying authorization (HR notice), immediately revoking active sessions/tokens to stop ongoing access, disabling directory accounts to prevent new logins, revoking group entitlements and reassigning asset ownership, and finally archiving audit records for compliance.

Step-by-Step Solution

1
Verify termination notification
HR authorization confirmed
Authorized IAM operational workflows must be triggered by verified administrative input.
2
Revoke active sessions and tokens
Ongoing access terminated
Active tokens must be revoked first to prevent a user from continuing existing application sessions.
3
Disable root directory entry
New authentications blocked
Disabling the directory entry blocks new login attempts across all integrated domain services.
4
Strip group rights and transfer assets
Permissions cleared and ownership transferred
Removing entitlements cleans up access rights while asset transfer ensures business continuity.
5
Archive identity logs and metadata
Audit history retained securely
Final archiving preserves evidence and meets regulatory requirements.

Key Concept

Account Lifecycle Management and Offboarding Operations
Question 92Question →

A security engineer must execute a break-glass procedure to access a critical database server during an unannounced service disruption. Place the operational steps of the Privileged Access Management (PAM) emergency account lifecycle in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for the PAM break-glass account lifecycle is: Submit an emergency checkout request referencing the incident ticket ID -> Complete out-of-band MFA approval -> Obtain temporary credentials and perform emergency maintenance -> Check in the emergency account in the PAM portal -> Execute automated credential rotation and terminate residual sessions.
The correct sequence adheres to enterprise PAM operational controls: establishing audit tracking via ticket reference, verifying identity through out-of-band MFA, executing emergency work with checked-out credentials, formally checking in the account, and executing automated credential rotation with session invalidation to guarantee single-use policy enforcement.

Step-by-Step Solution

1
Initiate the emergency checkout request with ticket authorization.
The PAM vault logs the access intent with auditing details attached.
Establishing auditability and ticketing context must precede credential disclosure.
2
Authenticate via secondary out-of-band MFA.
The identity of the requesting administrator is verified.
Strong authentication prevents unauthorized break-glass credential releases.
3
Retrieve credential and conduct emergency remediation.
System maintenance is performed using the break-glass account.
Administrative tasks are executed only after successful authentication and checkout.
4
Check in the emergency account within the PAM portal.
The administrative window closes in the PAM tracking system.
Explicit check-in signals to the PAM solution that the account lifecycle controls should be triggered.
5
Automate password rotation and residual session termination.
The break-glass credential is replaced with a new random secret and open sessions are killed.
Automatic rotation ensures credentials used in emergency checkouts cannot be reused later.

Key Concept

Privileged Access Management (PAM) Break-Glass Account Lifecycle
Question 93Question →

An incident response analyst is tasked with preserving digital evidence from a compromised application server during an active incident. In what sequence should the analyst perform the following forensic acquisition and custody actions to adhere strictly to the Order of Volatility and evidence handling protocols?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with capturing the most volatile artifacts (CPU registers and RAM), followed by dump files/swap space, then imaging non-volatile local storage, calculating cryptographic SHA-256 hashes of the images, and finally documenting the chain of custody log and sealing evidence.
Forensic evidence acquisition follows RFC 3227 guidelines: preserve the most volatile data first (CPU registers and main RAM), followed by temporary virtual memory (swap/pagefiles), non-volatile local disk storage, calculating cryptographic checksums (SHA-256) to establish baseline integrity, and completing the chain of custody log and physical tamper-evident sealing last.

Step-by-Step Solution

1
Capture volatile RAM and registers
Preserves ephemeral system memory contents before power down or overwrite
Adheres to the Order of Volatility by securing the most volatile evidence first.
2
Dump swap space and pagefile memory
Preserves temporary virtual memory pages mapped to disk
Swap file data updates dynamically and ranks higher in volatility than static secondary storage.
3
Perform bit-stream imaging of local disk storage
Creates an exact bit-for-bit duplicate of non-volatile storage via write-blocker
Disk storage is non-volatile and must be captured without modifying original data.
4
Generate SHA-256 cryptographic hashes
Establishes a unique mathematical fingerprint for all forensic disk images
Enables future verification of evidence integrity and protects against tampering allegations.
5
Fill out chain of custody documentation
Records complete transfer history, custody control, and physical tamper-evident sealing
Ensures legal admissibility in court by tracking physical ownership and integrity metadata.

Key Concept

Order of Volatility and Chain of Custody Evidence Handling
Estimated Time:1m 30s
Question 94Question →

A Security Operations Center (SOC) analyst receives an active EDR behavioral alert indicating that an unauthorized process executed `vssadmin.exe delete shadows /all /quiet` on an enterprise workstation and is actively attempting to encrypt files on connected SMB shares. Place the incident response actions in the correct chronological sequence to contain the threat and perform initial triage.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: 1) Initiate host-level network isolation through the EDR console, 2) Revoke active session tokens and disable compromised user account credentials, 3) Execute an EDR agent action to kill the malicious process tree and pull a volatile memory dump, and 4) Collect endpoint telemetry logs and sample payloads via EDR remote shell.
In EDR incident response, immediate containment takes precedence over investigation steps. Isolating the host via the EDR agent instantly restricts network connectivity and prevents lateral encryption across SMB shares without severing EDR console access. Next, revoking identity tokens prevents the attacker from using compromised credentials on other network hosts. Terminating the malicious process and capturing memory stops local damage and captures volatile evidence. Finally, collecting forensic logs enables root-cause analysis.

Step-by-Step Solution

1
Isolate the host at the network layer via EDR console.
The endpoint is restricted from communicating with the broader network and network shares, halting encryption of remote assets.
Host isolation is the immediate priority during active ransomware behavior to prevent lateral movement while preserving EDR agent control.
2
Disable compromised account credentials and revoke active domain tokens.
Stolen credentials cannot be reused elsewhere in the environment.
Threat actors often pivot to other hosts using compromised account tokens if credentials are not invalidated immediately following host containment.
3
Terminate the malicious process tree and capture volatile system memory.
Ransomware file encryption stops on the local endpoint, and volatile memory is captured for analysis.
Stopping active malicious processes prevents further local damage, and capturing RAM before rebooting preserves injects and cryptographic keys.
4
Extract forensic artifacts and telemetry logs via EDR remote management capabilities.
Responders gain access to event logs, drop files, and execution timestamps.
Detailed forensic triage allows analysts to determine the initial access vector and develop enterprise-wide detection rules.

Key Concept

EDR Incident Containment and Response Workflow
Estimated Time:2m 0s
Question 95Question →

A security technician receives an automated network intrusion detection system (NIDS) alert indicating potential unauthorized data exfiltration from an internal database server to an unknown external IP address. Place the following initial incident response steps in the correct chronological order, starting from initial alert verification to post-incident tuning.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert using raw packet captures, followed by assessing the scope across network endpoints, isolating the compromised server to halt exfiltration, and concluding with signature updates and documentation.
The standard incident triage lifecycle starts with validating the telemetry alert to confirm malicious activity. Next, scoping is conducted to identify all impacted systems. Once scope is established, network containment (isolating the server) stops active data movement. Finally, post-incident activities such as signature updates and documentation ensure long-term mitigation.

Step-by-Step Solution

1
Validate the alert telemetry.
Confirmed whether the NIDS alert is a true positive threat or a false alarm.
Initial triage requires validating event data before taking action to avoid unnecessary operational downtime.
2
Assess incident scope.
Identified all internal hosts participating in suspicious outbound connections.
Scoping ensures that containment efforts address all impacted endpoints rather than just the initial server.
3
Perform network containment.
Isolated the server from the network to block active exfiltration.
Immediate containment stops data loss while preserving the system for forensics.
4
Execute post-incident tuning and documentation.
Updated monitoring rules and logged lessons learned.
Refining NIDS rules strengthens future monitoring and prevents similar attack techniques.

Key Concept

Network Incident Response and Alert Triage Sequencing
Question 96Question →

A network security administrator is deploying 802.1X EAP-TLS network access control across enterprise switches to enforce mutual authentication and dynamic VLAN authorization. Place the operational stages of the EAP-TLS authentication and authorization sequence in the correct chronological order from session initiation to final access enforcement.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with identity encapsulation via RADIUS Access-Request, followed by EAP-TLS mutual certificate validation, directory policy authorization evaluation, RADIUS Access-Accept with VSAs return, and final port enforcement by the switch.
In 802.1X network access control, the sequence strictly follows: (1) Identity initiation where EAPoL responses are encapsulated into RADIUS Access-Request messages; (2) EAP-TLS mutual authentication via X.509 certificates; (3) Directory lookup to determine identity privileges; (4) RADIUS Access-Accept transmission containing dynamic authorization parameters (VSAs); and (5) Local port authorization and VLAN/ACL enforcement by the switch.

Step-by-Step Solution

1
Identify the initial protocol exchange between Supplicant, Authenticator, and AAA Server.
The supplicant responds to EAP-Request/Identity with an EAP-Response/Identity, which the switch encapsulates into a RADIUS Access-Request packet.
802.1X uses EAP encapsulation over LAN (EAPoL) between endpoint and switch, converted to RADIUS between switch and AAA server.
2
Determine the authentication mechanism step.
EAP-TLS mutual authentication completes via X.509 certificate validation over a TLS handshake.
EAP-TLS requires both server certificate validation by the client and client certificate validation by the AAA server before granting access.
3
Determine the authorization lookup phase.
The AAA server evaluates identity group memberships and directory policies.
Authentication (verifying who the user/device is) must succeed before authorization policy (determining allowed access level) can be evaluated.
4
Identify the return authorization payload.
The AAA server issues a RADIUS Access-Accept containing VSAs (e.g., RFC 2868 VLAN attributes).
The AAA server communicates policy enforcement parameters back to the network access device using RADIUS attributes.
5
Identify final enforcement at the network layer.
The switch transitions the port state to authorized and applies dynamic VLAN/ACL rules.
The authenticator network switch is responsible for enforcing physical/logical port controls based on the AAA server's directive.

Key Concept

802.1X EAP-TLS AAA Operation and Dynamic Enforcement
Question 97Question →

A Security Operations Center (SOC) configures an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-severity data exfiltration alerts originating from enterprise database servers. Place the operational playbook steps in the correct execution sequence from initial trigger to incident documentation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: 1) Ingest and parse sensor telemetry, 2) Query CMDB/IAM for asset criticality enrichment, 3) Perform threat intelligence and sandbox validation, 4) Execute conditional EDR host isolation, and 5) Generate the ITSM incident ticket with team escalation.
A SOAR incident response playbook follows a structured lifecycle: Alert Ingestion & Parsing -> Context Enrichment (CMDB/IAM) -> Threat Intelligence Validation -> Conditional Containment (EDR Isolation) -> Ticket Generation & Notification. This sequence minimizes false-positive impact and ensures containment occurs prior to manual analyst handoff.

Step-by-Step Solution

1
Ingest and parse the raw alert telemetry.
Extracted indicators of compromise (IPs, domains, process handles) ready for downstream API calls.
Automation workflows cannot run query functions without extracted parameters from the initial alert trigger.
2
Enrich the event with asset and identity context.
Established server business impact score and assigned owner.
Knowing asset criticality is required before evaluating automated isolation risk logic.
3
Query threat intelligence and submit binaries for sandbox analysis.
Confirmed malicious reputation score for outbound connection targets.
Validation ensures containment triggers only on verified threat indicators rather than false positives.
4
Perform conditional safety check and execute isolation.
Affected database host isolated from network segment via EDR API.
Rapid containment prevents data loss while abiding by predefined high-availability safety checks.
5
Document and escalate in ITSM.
Ticket populated with enriched telemetry logs and on-call analyst notified.
Saves analyst time by delivering fully triaged context and containment status for manual investigation.

Key Concept

SOAR Playbook Execution Sequencing
Question 98Question →

A security analyst is documenting the hardware-based multi-factor authentication (MFA) process using WebAuthn/FIDO2 for corporate cloud applications. Place the operational steps of a successful WebAuthn authentication sequence in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with the Relying Party generating a unique cryptographic challenge upon user login initiation, sending that challenge to the client browser, performing local user verification on the hardware key to sign the challenge, forwarding the signed assertion payload back to the Relying Party server, and finally verifying the signature using the stored public key to issue an authenticated session.
The WebAuthn authentication flow follows a strict challenge-response protocol sequence: First, the Relying Party (RP) generates a cryptographic challenge upon login attempt. Second, the RP sends this challenge and session parameters to the client browser. Third, the user authenticates locally on the hardware key (via PIN or biometric), which allows the private key to sign the challenge. Fourth, the signed assertion is sent back to the client browser and submitted to the RP server. Finally, the RP server verifies the signature using the stored public key to validate identity.

Step-by-Step Solution

1
Identify the initial trigger and challenge generation.
The Relying Party server generates a random cryptographic challenge when authentication is requested.
WebAuthn authentication is challenge-response based to protect against replay attacks.
2
Trace the challenge delivery to the client.
The server transmits the challenge and RP identity parameters to the browser WebAuthn API.
The client browser acts as the intermediary between the server and the hardware authenticator.
3
Determine the hardware key user verification step.
The user completes biometric or PIN verification on the physical security key, allowing it to sign the challenge with the private key.
Local user interaction is mandatory for FIDO2 token activation.
4
Trace the transmission of the signed response.
The signed assertion is returned to the browser and forwarded to the Relying Party server.
The authenticator does not communicate directly with the server; responses pass through the web browser client.
5
Confirm final server verification and authorization.
The server verifies the cryptographic signature with the user's public key.
Server validation completes the challenge-response cycle and confirms authentic user identity.

Key Concept

FIDO2 / WebAuthn Challenge-Response Authentication Sequence
Question 99Question →

A security team creates an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle alerts generated when a suspicious email attachment is reported. Place the following automated playbook steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the SOAR playbook steps is: 1) Ingest alert payload from email security gateway via webhook, 2) Query external threat intelligence service to analyze file hash, 3) Send API command to EDR agents to quarantine malicious file, and 4) Update ITSM ticket with findings and resolve case.
Standard SOAR playbooks follow a structured sequence: initial ingestion of alert data triggers the playbook, threat intelligence enrichment evaluates indicators of compromise, automated containment tools neutralize confirmed threats, and ticketing integrations record final documentation.

Step-by-Step Solution

1
Ingest the alert trigger
The SOAR engine receives event data from the email security gateway.
Playbooks require initial alert data ingestion before any actions or analysis can be performed.
2
Perform threat enrichment
File hashes are evaluated against external threat intelligence sources.
Enrichment provides the verification needed to determine if response actions are required.
3
Execute automated response
The EDR platform isolates and quarantines the file across endpoints.
Mitigation steps are executed automatically based on the confirmed threat intelligence verdict.
4
Document and close case
The ITSM ticketing platform receives full incident details and case resolution status.
Final audit logging and ticket updates occur after all operational containment tasks are complete.

Key Concept

SOAR Playbook Lifecycle (Ingest -> Enrich -> Contain -> Document)
Question 100Question →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating potential encrypted command-and-control (C2) beaconing originating from a domain controller. In what order should the analyst perform the following network security monitoring and triage steps to properly validate, investigate, and contain the incident?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert against NetFlow and DNS records, followed by identifying the specific process via endpoint telemetry, isolating the host to prevent lateral movement, and finally enforcing perimeter blocking and DNS sinkholing.
The incident handling lifecycle requires starting with verification (correlating NIDS, NetFlow, and DNS logs), followed by context gathering (EDR process mapping), local containment (host network isolation to halt lateral spread while keeping power on), and global containment (perimeter firewall blocks and DNS sinkholing).

Step-by-Step Solution

1
Correlate network telemetry (NIDS, NetFlow, DNS).
Validates the alert authenticity and confirms persistent beaconing behavior.
Security monitoring protocols mandate verifying alerts against baseline NetFlow and DNS logs to eliminate false positives before taking invasive actions.
2
Inspect host endpoint logs (EDR process correlation).
Identifies the malicious process ID and executable tied to the network connection.
Network alerts identify IP/port pairings, but pinpointing the malicious actor on the system requires matching sockets to host processes.
3
Execute targeted host containment (network isolation).
Prevents lateral movement while keeping the system powered for forensic memory capture.
Isolating the compromised domain controller prevents adversaries from moving laterally to other critical assets.
4
Implement enterprise perimeter indicators of compromise (IoC) block rules.
Shields all other enterprise hosts from communicating with the external C2 infrastructure.
Broad perimeter blocking and DNS sinkholing ensure enterprise-wide containment after host-level containment is established.

Key Concept

Incident Response Lifecycle for Network Security Monitoring
Estimated Time:3m 0s
PreviousPage 5 / 9Next
All practice questions — CompTIA Security+ | Examkin