Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1001Question →

During a security review of a modern banking web application API, an analyst examines backend request logs and identifies two distinct malicious activity patterns:

1. Requests sent to `/api/v1/profile/upload` include multipart form payload parameters containing filename strings structured as `../../../../etc/passwd`.
2. Requests sent to `/api/v1/statements?account_id=1042` allow authenticated user `1042` to retrieve financial statements belonging to user `1043` simply by changing the `account_id` value in the URL query string.

Which of the following application and software vulnerabilities are directly demonstrated by these log findings? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Directory traversal; Insecure Direct Object Reference (IDOR)

Answer

The correct vulnerabilities demonstrated in the logs are Directory traversal and Insecure Direct Object Reference (IDOR).
The upload payload utilizes relative directory paths (`../`) to escape restricted directories and read host file paths, confirming a Directory Traversal flaw. The account statement request allows an authenticated user to access another user's records simply by changing an unvalidated URL parameter, confirming an Insecure Direct Object Reference (IDOR) flaw.

Step-by-Step Solution

1
Analyze finding 1 (`../../../../etc/passwd`)
Identified path manipulation designed to escape the web root directory and read arbitrary system files.
The use of dot-dot-slash sequence payloads indicates a classic Directory Traversal vulnerability.
2
Analyze finding 2 (`account_id=1042` modified to `account_id=1043`)
Identified parameter tampering where an user manipulates a direct record identifier to view unauthorized resource data.
Exposing internal record keys in request parameters without enforcing server-side authorization checks is an Insecure Direct Object Reference (IDOR) flaw.

Key Concept

Application and Software Vulnerabilities (Directory Traversal & IDOR)
Estimated Time:1m 30s
Question 1002Question →

An analyst is defining an automated incident response playbook within an Endpoint Detection and Response (EDR) system to handle high-severity malware execution alerts on enterprise workstations. Place the following steps of the automated containment, analysis, and recovery workflow in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the EDR response workflow begins with isolating the endpoint from the network, followed by terminating the malicious processes, gathering volatile memory telemetry for forensic analysis, and finally lifting network isolation after remediation.
The correct response order follows standard incident handling best practices in EDR environments: immediate network containment to prevent lateral movement, termination of malicious processes to stop active damage, acquisition of telemetry and forensics to analyze attack vectors, and host network restoration after remediation is confirmed.

Step-by-Step Solution

1
Perform immediate host isolation via EDR capabilities.
The endpoint is blocked from communicating with local network resources and external command-and-control servers while retaining EDR management connectivity.
Containment is the primary initial operational priority to restrict the attack blast radius without disrupting SOC control.
2
Terminate active threat processes.
Malicious process trees and memory-injected code execution are halted on the local host.
Stopping active malicious code prevents ongoing unauthorized actions, such as ransomware encryption or local credential harvesting.
3
Gather forensic telemetry and volatile memory artifacts.
Detailed process lineages, network sockets, and memory dumps are collected for SOC investigation.
Investigating telemetry determines the attack vector and identifies persistence mechanisms established prior to host isolation.
4
Lift host isolation and restore connectivity.
The host resumes standard enterprise network communications.
Network access should only be restored after confirming the host is completely remediated and secure.

Key Concept

EDR Automated Containment and Remediation Workflow
Question 1003Question →

A biomedical research firm is implementing Zero Trust Architecture (ZTA) principles to secure sensitive genomic research data stored in a hybrid environment. An analyst attempts to access a restricted database from a corporate laptop while connected from a remote partner facility. Which of the following describes how access is evaluated under Zero Trust principles?

Show answer & explanation

Answer: Access is dynamically evaluated by a Policy Decision Point (PDP) using contextual telemetry such as device health, user identity, and location before instructing a Policy Enforcement Point (PEP) to grant explicit access.

Answer

Access is dynamically evaluated by a Policy Decision Point (PDP) using contextual telemetry such as device health, user identity, and location before instructing a Policy Enforcement Point (PEP) to grant explicit access.
Under Zero Trust Architecture (ZTA), no implicit trust is granted based on network location or initial login. Access requests must be explicitly verified. A Policy Decision Point (PDP) dynamically evaluates telemetry (such as user identity, device posture, and location context) against policy rules to determine access, which is then enforced by a Policy Enforcement Point (PEP).

Step-by-Step Solution

1
Identify the core tenet of Zero Trust Architecture (ZTA)
ZTA operates under the principle of explicit verification and 'never trust, always verify', requiring continuous context-aware evaluation.
Location within a network or establishment of a VPN tunnel does not grant implicit trust.
2
Analyze the roles of Zero Trust components
The Policy Decision Point (PDP) evaluates request parameters against security policies, while the Policy Enforcement Point (PEP) enforces the PDP's decision.
Decoupling decision logic from enforcement ensures dynamic, contextual control across hybrid environments.

Key Concept

Explicit Verification and PDP/PEP Decoupling in Zero Trust Architecture
Question 1004Question →

Place the following steps of an Endpoint Detection and Response (EDR) automated containment and incident investigation workflow in the correct sequential order from initial event detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard incident containment lifecycle: telemetry detection of suspicious activity, automated network isolation, analyst investigation of process lineage telemetry, and final threat remediation followed by network restoration.
The workflow begins with continuous behavioral detection by the EDR agent. Once an alert triggers, automated playbooks isolate the endpoint from the network to block lateral spread while keeping memory intact. Next, a SOC analyst reviews the rich process lineage and telemetry gathered by the sensor to determine root cause. Finally, remediation scripts eradicate the threat and host network connectivity is safely restored.

Step-by-Step Solution

1
Identify initial threat detection
The local EDR sensor flags anomalous behavior via host telemetry monitoring.
Detection must occur before any containment or investigation actions can be initiated.
2
Execute immediate automated containment
Network isolation is automatically applied to the affected endpoint.
Isolating the endpoint stops lateral movement across the enterprise network while preserving host volatility.
3
Conduct analyst telemetry investigation
The analyst examines process trees and parent-child execution paths in the central EDR console.
Investigation must take place on the isolated endpoint's collected data to understand the attack scope.
4
Perform threat remediation and host restoration
Malicious items are cleaned and full network connectivity is reinstated.
Remediation and reconnecting the system to normal operations is the final step in resolving an endpoint incident.

Key Concept

EDR Incident Containment and Response Lifecycle
Estimated Time:1m 0s
Question 1005Question →

A security administrator notices that a host security tool generated an alert for an obfuscated script running directly out of system memory using a built-in operating system utility, despite no known file hashes being flagged. Which of the following capabilities best explains why an Endpoint Detection and Response (EDR) agent can identify this suspicious activity?

Show answer & explanation

Answer: Continuous host process monitoring and behavioral telemetry analysis

Answer

Continuous host process monitoring and behavioral telemetry analysis allows EDR solutions to detect suspicious, fileless, or memory-based actions even when traditional static signature matching yields no results.
Endpoint Detection and Response (EDR) solutions monitor endpoint activities in real time, gathering telemetry on process execution, system calls, and memory usage. This allows them to spot behavioral anomalies—such as an administrative tool executing obfuscated scripts—regardless of whether a file signature exists.

Step-by-Step Solution

1
Analyze the scenario conditions
The attack involves an obfuscated script executed in memory via built-in system tools with no matching file signatures.
Identifying that no malicious file exists on disk rules out static signature-based detection mechanisms.
2
Evaluate EDR core capabilities
EDR agents continuously collect detailed process interaction, registry, and memory telemetry from the endpoint.
Behavioral analytics inspect runtime actions rather than static file attributes.
3
Select the matching security capability
Continuous host process monitoring and behavioral telemetry analysis is the primary mechanism for detecting living-off-the-land and fileless attacks.
This capability addresses host-level runtime anomalies.

Key Concept

Endpoint Detection and Response (EDR) behavioral monitoring
Estimated Time:45s
Question 1006Question →

Security operations analysts respond to an active incident involving a compromised Linux database server running on an enterprise hypervisor. Network telemetry reveals memory-injected malware executing encrypted outbound command-and-control communication. The evidence gathered must be admissible in court for potential legal prosecution. Which of the following actions MUST the forensics team take to adhere strictly to the order of volatility and maintain chain of custody integrity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Capture the system RAM and volatile state artifacts over a dedicated isolated interface before initiating any system power state change or virtual machine shutdown.; Calculate independent cryptographic hashes of the forensic images immediately post-acquisition and document every transfer and access event on a formal custodial tracking form.

Answer

The incident response team must acquire system RAM before any power state changes to honor the order of volatility, and must generate immediate post-acquisition cryptographic hashes coupled with formal chain of custody logging to ensure legal integrity and admissibility.
Capturing live system RAM prior to system shutdown preserves the most volatile evidence, adhering to the order of volatility. Simultaneously, establishing post-acquisition cryptographic hashes and maintaining explicit custodial logs guarantees evidence integrity and legal chain of custody.

Step-by-Step Solution

1
Prioritize evidence collection based on volatility.
System RAM contains transient, highly volatile data (such as memory-injected C2 malware) that will be permanently lost if the machine is powered down or restarted.
Adhering to the Order of Volatility dictates collecting memory artifacts before non-volatile disk storage.
2
Establish evidence integrity and unbroken custodial tracking.
Immediate hashing verifies data has not changed since capture, and custodial logs track exact physical/logical ownership.
Legal admissibility in court requires proving that evidence integrity was preserved from seizure through trial.

Key Concept

Forensic Order of Volatility and Chain of Custody Verification
Question 1007Question →

A security architect at a pharmaceutical enterprise is designing the network architecture for a new automated production facility. Match each network design or segmentation technique on the left to its corresponding security application requirement on the right.

Click a left item, then click its matching right item

Items

Air Gap
Microsegmentation
Jump Server
Demilitarized Zone (DMZ)

Matches

Show answer & explanation

Answer

Air Gap matches with isolating legacy PLCs by completely disconnecting them; Microsegmentation matches with restricting lateral movement between individual cloud microservices; Jump Server matches with providing a hardened administrative proxy entry point; Demilitarized Zone (DMZ) matches with exposing public web servers while isolating the internal network.
Air Gap provides absolute physical isolation for legacy PLCs. Microsegmentation enforces workload-level controls against lateral movement. Jump Server provides a hardened management proxy for database access. DMZ buffers internet-exposed services from internal networks.

Step-by-Step Solution

1
Identify the extreme isolation requirement for high-risk legacy PLCs.
Complete physical and logical disconnection maps directly to an Air Gap.
Air gapping eliminates all network-based attack vectors by removing physical and logical network connectivity.
2
Analyze the requirement for controlling East-West traffic between cloud microservices.
Granular workload-level policy enforcement maps to Microsegmentation.
Microsegmentation creates fine-grained security zones around individual application components to prevent lateral movement.
3
Evaluate administrative access into internal database segments.
A single proxy entry point for admin sessions maps to a Jump Server.
Jump servers channel, authenticate, and monitor privileged administrative management connections into sensitive internal zones.
4
Determine the perimeter control technique for public web endpoints.
Buffering external services from internal assets maps to a DMZ.
A DMZ isolates internet-facing services on a dedicated subnet separated by firewalls from internal corporate assets.

Key Concept

Network Design Archetypes and Segmentation Controls
Question 1008Question →

A security analyst monitoring enterprise systems confirms an active unauthorized access alert on an internal workstation. The compromised workstation is currently transmitting unauthorized network traffic to an external IP address. According to standard incident response lifecycle frameworks, which action should the analyst take immediately after confirming this detection?

Show answer & explanation

Answer: Isolate the compromised workstation from the network to prevent further lateral movement and data exfiltration.

Answer

Isolate the compromised workstation from the network to prevent further lateral movement and data exfiltration.
According to established incident response standards (such as NIST SP 800-61), the phase immediately following Detection & Analysis is Containment. Isolating the workstation from the network stops active malicious external communication, preventing further exfiltration and lateral movement while preserving evidence.

Step-by-Step Solution

1
Identify current incident response phase
The incident has been identified and confirmed, placing the team at the end of Detection & Analysis.
Standard frameworks (NIST SP 800-61) mandate that after confirming an active threat during Detection & Analysis, containment must immediately follow.
2
Select immediate containment action
Network isolation of the impacted workstation restricts unauthorized outbound communication.
Containment limits the scope and impact of an active incident before proceeding to eradication or recovery.

Key Concept

Incident Response Lifecycle Phase Ordering (Containment)
Question 1009Question →

During an incident response investigation into an internal identity compromise involving Kerberos ticket forgery (Pass-the-Ticket) across domain-joined assets, an analyst must act quickly. Which of the following actions represent appropriate containment measures to execute prior to moving into the eradication phase? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolate impacted host workstations from the network via endpoint controls while maintaining system power.; Reset compromised domain account passwords and purge active Kerberos ticket sessions across targeted services.

Answer

Isolating impacted workstations from the network while maintaining system power, and resetting compromised domain account passwords while purging active Kerberos ticket sessions.
Effective containment during a Kerberos ticket attack requires halting lateral movement and revoking unauthorized access while maintaining forensic evidence integrity. Isolating compromised host endpoints prevents traffic propagation without clearing volatile RAM needed for memory forensics. Additionally, resetting compromised account passwords and invalidating forged session tickets revokes the attacker's ability to authenticate to other domain services.

Step-by-Step Solution

1
Identify the primary objective during the containment phase of an identity-based attack.
The goal is to stop lateral propagation and unauthorized access without destroying volatile evidence.
Containment limits incident impact before proceeding to permanent removal of threat artifacts.
2
Evaluate host-level containment controls.
Network isolation of affected endpoints stops lateral spread, while leaving machines powered preserves volatile RAM containing Kerberos ticket caches.
Powering down hosts clears RAM, hindering digital forensics.
3
Evaluate identity and authentication containment controls.
Resetting password hashes and revoking active Kerberos tickets terminates active attacker sessions.
Identity controls stop stolen credentials from granting further access to network resources.

Key Concept

Incident Response Containment Strategies for Identity Compromise
Question 1010Question →

Match each storage security technology on the left with its corresponding enterprise functional mechanism on the right.

Click a left item, then click its matching right item

Items

Envelope Encryption Architecture
SAN LUN Masking
Database Field Tokenization
Self-Encrypting Drive (SED)

Matches

Show answer & explanation

Answer

Envelope Encryption Architecture pairs with DEK/KEK key hierarchy; SAN LUN Masking pairs with host HBA WWN array restriction; Database Field Tokenization pairs with vault-mapped surrogate replacement; Self-Encrypting Drive (SED) pairs with hardware disk encryption and cryptographic erase.
Each storage security architecture component directly addresses a distinct operational requirement across key management, storage network isolation, application data transformation, and physical drive security: Envelope Encryption manages hierarchical DEK/KEK keys; SAN LUN Masking restricts host access by WWN at the storage controller; Tokenization replaces sensitive fields with vault-mapped surrogates; and SEDs provide hardware media encryption.

Step-by-Step Solution

1
Analyze storage encryption key management structures.
Identify envelope encryption as the pattern utilizing Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs).
This decouples local file encryption performance from centralized key access control.
2
Evaluate Storage Area Network (SAN) logical separation controls.
Associate LUN masking with storage array controller ACLs filtering by host HBA World Wide Names (WWNs).
LUN masking prevents unauthorized host servers from detecting or attaching to SAN volumes.
3
Differentiate data obfuscation methods for structured databases.
Map tokenization to vault-backed surrogate replacement.
Tokenization replaces original data with non-secret lookup identifiers rather than mathematical ciphertexts.
4
Identify physical block storage media protection mechanisms.
Match Self-Encrypting Drives (SEDs) to hardware-level disk encryption and crypto-erase.
SEDs implement cryptographic processing directly on the storage device controller.

Key Concept

Data Protection and Storage Security Architecture Controls
Question 1011Question →

A forensic analyst is responding to a live incident on a Linux server suspected of executing an active data exfiltration script via open network sockets. The server is powered on and running in memory. To strictly adhere to the Order of Volatility while maintaining cryptographic chain of custody integrity, which of the following actions should the analyst perform first?

Show answer & explanation

Answer: Capture the contents of system RAM and active network connections using an established memory dump tool, immediately recording the SHA-256 hash in the evidence log.

Answer

Capture the contents of system RAM and active network connections using an established memory dump tool, immediately recording the SHA-256 hash in the evidence log.
Capturing system RAM and active network sockets first adheres strictly to the Order of Volatility, as volatile memory is erased upon system state changes or power loss. Calculating and recording a cryptographic SHA-256 hash immediately establishes data integrity and chain of custody accountability.

Step-by-Step Solution

1
Assess the system state to determine the volatility of evidence.
System RAM, CPU registers, and active network connections are identified as transient evidence at risk of immediate destruction.
The forensic Order of Volatility dictates capturing evidence from highest volatility to lowest volatility.
2
Preserve volatile memory and network session state.
A memory dump image capturing RAM and active socket data is successfully generated from the live system.
Capturing memory prior to taking persistent disk images or powering off the host ensures volatile data is preserved.
3
Compute and document evidence hash values.
A SHA-256 cryptographic hash of the memory image is generated and written into the chain of custody documentation.
Logging the hash immediately establishes proof of integrity and guarantees the evidence remains untampered throughout the legal handling process.

Key Concept

Order of Volatility and Evidence Hash Verification
Question 1012Question →

Match each observed network or wireless technical indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

Unsolicited ARP replies mapping multiple internal IP addresses to a single gateway MAC address.
High volume of EAPOL-Start frames continuously sent to an access point, exhausting RADIUS server resources.
DNS query responses returning low TTL values (TTL=1sTTL = 1s) that rapidly rotate resolved IP addresses to evasive infrastructure.
Wireless WIPS alert showing a rogue access point mimicking an enterprise SSID with a stronger signal and different BSSID.

Matches

Show answer & explanation

Answer

Unsolicited ARP replies map to ARP Poisoning; EAPOL-Start frame volume maps to Wireless EAPOL Flooding; Low TTL DNS response rotation maps to DNS Fast-Flux; Rogue AP mimicking enterprise SSID maps to Evil Twin.
Each observed technical indicator uniquely corresponds to its underlying attack vector: ARP poisoning alters Layer 2 mapping, EAPOL flooding targets 802.1X authentication state, DNS fast-flux rotates domain IP resolution with brief TTLs to evade IP blocking, and an Evil Twin spoofs wireless ESSID credentials.

Step-by-Step Solution

1
Analyze the Layer 2 traffic pattern of unsolicited ARP replies mapping multiple IPs to one MAC address.
Identified as ARP Poisoning/Spoofing.
Attacker is poisoning IP-to-MAC resolution tables on local hosts to intercept network traffic.
2
Analyze the wireless 802.1X authentication telemetry showing excessive EAPOL-Start frames.
Identified as Wireless EAPOL Flooding.
Generating constant authentication requests exhausts backend authentication resources.
3
Examine DNS resolution behavior exhibiting extremely short TTLs and constantly changing IP addresses.
Identified as DNS Fast-Flux.
Fast-flux DNS dynamically changes A records to hide malicious hosting infrastructure behind compromised proxies.
4
Evaluate the WIPS alert describing an unauthorized AP broadcasting a corporate network name with a modified BSSID and high power.
Identified as an Evil Twin attack.
Evil Twins attempt to trick wireless clients into auto-associating with an attacker-controlled access point.

Key Concept

Network and Wireless Attack Indicators
Estimated Time:1m 30s
Question 1013Question →

A Security Operations Center (SOC) engineering team is designing an enterprise SIEM processing architecture to handle unstructured log streams from hybrid cloud applications, perimeter firewalls, and endpoint agents. In what order should the log processing pipeline execute these stages from initial log retrieval to automated response handling?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the SIEM log processing pipeline is: Log Ingestion, Parsing and Normalization, Contextual Enrichment, Cross-Source Correlation, and Alerting and Orchestration.
The standard SIEM data pipeline processes incoming events sequentially: first ingesting raw log data, parsing it into a normalized schema, enriching the normalized fields with context (such as threat intelligence and asset metadata), correlating the enriched events across sources using defined rules, and finally alerting analysts or triggering SOAR automation.

Step-by-Step Solution

1
Identify the initial collection phase
Log Ingestion (item 1) receives raw telemetry from agents, syslog streams, and APIs into the central SIEM receiver.
Data must be ingested into the pipeline before any transformation or inspection can occur.
2
Structure and format the raw log payload
Parsing and Normalization (item 2) converts unstructured strings into standardized key-value pairs using a common schema.
Downstream processing requires consistent attribute naming (e.g., src_ip, user_id) across different vendor log formats.
3
Augment normalized logs with external and environmental context
Contextual Enrichment (item 3) attaches threat intelligence feeds, asset values, and IP geolocation to normalized events.
Enrichment adds necessary risk scoring and IP reputation metadata to standardized fields prior to complex rule evaluation.
4
Analyze events across multiple log sources for threat patterns
Cross-Source Correlation (item 4) compares enriched, normalized events against temporal rules and behavioral logic.
Correlation requires clean, normalized, and enriched data across disparate sources within specific time windows to detect complex attacks.
5
Take action on correlated security events
Alerting and Orchestration (item 5) dispatches incident tickets and initiates automated playbooks.
Response actions and analyst alerts are executed only after correlation rules determine a high-fidelity security incident.

Key Concept

SIEM Log Processing Pipeline Sequence
Question 1014Question →

A security analyst is investigating a sequence of correlated Windows Event logs displayed in a SIEM dashboard:

text
2026-07-27T10:14:02Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC01 SubStatus=0xC000006A
2026-07-27T10:14:03Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC02 SubStatus=0xC000006A
2026-07-27T10:14:05Z EventID=4624 TargetUser=svc_sql Workstation=DC-01 LogonType=3
2026-07-27T10:14:12Z EventID=7045 ServiceName="PSEXESVC" ImagePath="C:\Windows\PSEXESVC.exe"

Based on the log telemetry shown above, which security event is occurring on the network?

Show answer & explanation

Answer: Lateral movement using compromised service account credentials followed by remote service creation

Answer

Lateral movement using compromised service account credentials followed by remote service creation
The log sequence documents multiple failed authentication attempts (Event ID 4625), followed by a successful network authentication (Event ID 4624, LogonType 3) on DC-01, and immediate creation of the PsExec service (Event ID 7045). This correlated telemetry pattern is characteristic of credential misuse and lateral movement across systems.

Step-by-Step Solution

1
Analyze Event ID 4625 log entries
Identify password spraying or failed authentication attempts across workstations for user 'svc_sql'.
Event ID 4625 signifies a failed logon attempt, and substatus 0xC000006A indicates a bad password.
2
Analyze Event ID 4624 log entry
Confirm successful network logon (LogonType 3) to the DC-01 server using the 'svc_sql' account.
Event ID 4624 indicates successful authentication, and LogonType 3 indicates network authentication (e.g., SMB/PsExec).
3
Correlate with Event ID 7045 log entry
Recognize remote execution tool staging (PSEXESVC.exe) as a new service creation.
Event ID 7045 records the installation of a new system service, which Sysinternals PsExec uses for remote command execution.

Key Concept

Windows Event Log correlation for lateral movement detection
Estimated Time:1m 30s
Question 1015Question →

Match each threat intelligence source classification on the left with its corresponding operational security use case on the right.

Click a left item, then click its matching right item

Items

Proprietary Threat Feed
Information Sharing and Analysis Center (ISAC)
Open-Source Intelligence (OSINT)
Vulnerability Database

Matches

Show answer & explanation

Answer

Proprietary Threat Feed pairs with vendor-curated commercial indicator feeds; Information Sharing and Analysis Center (ISAC) pairs with exchanging sector-specific attack data among trusted peers; Open-Source Intelligence (OSINT) pairs with analyzing publicly available technical research blogs and repositories; Vulnerability Database pairs with reviewing standardized CVSS metrics and technical patch advisories.
Each threat intelligence source corresponds directly to its defined operational role: Proprietary feeds supply commercial, vendor-curated indicators; ISACs provide a trust network for sector-specific peer sharing; OSINT relies on freely available web information; and Vulnerability Databases offer standardized risk scores (CVSS) and patch advisories.

Step-by-Step Solution

1
Analyze the scope, access level, and governance model of each threat intelligence source.
Differentiate between commercial vendor services, sector-specific peer communities, open public platforms, and standardized vulnerability archives.
Threat intelligence sources serve distinct operational needs based on trust boundaries, access permissions, and data content.
2
Map each threat intelligence source to its primary enterprise operational application.
Match Proprietary feeds to paid C2 blocking feeds, ISACs to sector peer sharing, OSINT to open web analysis, and Vulnerability Databases to CVSS/CVE patch evaluation.
Aligning intelligence sources with appropriate operational workflows ensures efficient risk management and incident prevention.

Key Concept

Operational applications and classification of threat intelligence sources
Estimated Time:1m 30s
Question 1016Question →

During operational monitoring, a Security Operations Center (SOC) analyst identifies unusual Windows Management Instrumentation (WMI) execution on a core Domain Controller, indicating potential credential harvesting. Following the standard NIST SP 800-61 Incident Response Framework, in which chronological sequence should the security team perform the following response procedures?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct incident response sequence follows the NIST SP 800-61 lifecycle phases: 1) Detection and Analysis (analyzing SIEM logs and memory), 2) Containment (isolating the host), 3) Eradication and Recovery (purging persistence mechanisms and restoring from backup), and 4) Post-Incident Activity (conducting lessons learned and updating rules).
Standard NIST incident response lifecycle dictates progressing through Preparation (pre-established), Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Analyzing logs and volatile memory confirms the threat (Detection and Analysis). Isolating the server stops lateral spread (Containment). Removing artifacts and restoring from backup cleanses the environment (Eradication and Recovery). Finally, conducting a post-mortem review updates organizational playbooks (Post-Incident Activity).

Step-by-Step Solution

1
Perform initial investigation and scope analysis
Confirmed incident details and extent of system impact
Detection and Analysis must occur first to understand the threat prior to taking operational action.
2
Enforce network segmentation and host isolation
Prevented lateral movement across the enterprise network
Containment limits damage and prevents adversaries from spreading deeper into the infrastructure.
3
Remediate threat artifacts and restore systems
Clean system state restored and credentials rotated
Eradication and Recovery removes threat components and safely returns systems to normal operations.
4
Document findings and refine security controls
Updated playbooks and improved SOC readiness
Post-Incident Activity ensures long-term organizational learning and playbook optimization.

Key Concept

NIST Incident Response Lifecycle Phases
Question 1017Question →

During security monitoring, a enterprise Security Operations Center (SOC) team identifies unauthorized API requests executed using a compromised service account token within a production container orchestration cluster. Threat intelligence logs reveal that the attacker has already spawned rogue workload pods designed to perform network reconnaissance and attempt lateral movement toward an isolated sensitive database subnet. According to standard NIST incident response frameworks, which of the following actions should the incident response team perform FIRST?

Show answer & explanation

Answer: Revoke the compromised service account token and isolate the affected cluster worker nodes from the network.

Answer

Revoke the compromised service account token and isolate the affected cluster worker nodes from the network.
The correct response prioritizes immediate containment in accordance with standard incident response playbooks (such as NIST SP 800-61). Revoking the compromised service account credentials invalidates the attacker's active API access, while isolating affected worker nodes prevents lateral movement toward adjacent subnets. Containment must always precede eradication and recovery.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
The incident has passed initial detection/analysis and requires immediate containment to stop ongoing lateral movement.
NIST SP 800-61 dictates that containment must occur immediately after detection to limit damage and prevent vector expansion.
2
Evaluate candidate response actions against the NIST Incident Response lifecycle order.
Revoking active compromised tokens and network-isolating affected worker nodes stops threat propagation during the containment phase.
Eradication (deleting malicious pods) and Recovery (re-imaging nodes) must follow containment, while perimeter controls (WAF rules) fail to stop internal lateral movement.
3
Select the immediate next step.
Executing token revocation and node isolation guarantees containment before further remediation takes place.
Containing the blast radius is the essential prerequisite for forensic preservation and subsequent eradication.

Key Concept

Incident Response Process and Playbooks
Question 1018Question →

A financial services company recently migrated its online portal to a cloud-based containerized microservices architecture. Security telemetry indicates that an attacker successfully compromised a public-facing API gateway container and attempted lateral movement to internal microservices residing on the same Virtual Private Cloud (VPC) subnet. The security team must prevent unauthorized lateral (East-West) communication between workloads within the same subnet without changing the existing IP addressing scheme. Which of the following secure network design controls should the security architect implement?

Show answer & explanation

Answer: Implement host-based microsegmentation using software-defined network policies enforcement.

Answer

Implement host-based microsegmentation using software-defined network policies enforcement.
Microsegmentation uses software-defined policies directly on workloads or container hosts to enforce access controls granularly. This isolates individual workloads and restricts East-West traffic flows between container instances operating on the same physical or virtual subnet.

Step-by-Step Solution

1
Analyze the security requirement and constraint.
The requirement is to isolate intra-subnet (East-West) traffic between container workloads without altering IP subnet configurations.
Standard network layer segmentation (VLANs/subnets) operates at Layer 3/Layer 2 boundary, whereas microservices within the same subnet communicate laterally unless host/hypervisor policy enforcement is applied.
2
Evaluate potential control mechanisms against Zero Trust network architecture principles.
Host-based microsegmentation provides explicit workload-to-workload policy enforcement at Layer 7/application layer or hypervisor/vSwitch level.
Microsegmentation creates micro-perimeters around individual workloads, enforcing least-privilege traffic rules regardless of network physical topology.

Key Concept

Microsegmentation and East-West Traffic Isolation
Question 1019Question →

During a active security incident, a enterprise Security Operations Center (SOC) team detects that an attacker has gained persistence on an internal domain-joined SQL database server containing highly sensitive PII. Forensics logs reveal the attacker established a reverse shell via a web application vulnerability and is currently conducting live internal network scanning and attempting lateral movement via Server Message Block (SMB). According to the NIST Incident Response Framework (SP 800-61 Rev. 2), which of the following actions should the incident response team perform IMMEDIATELY as part of the Containment phase? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-based firewall rules to block inbound and outbound traffic on the affected SQL server while preserving established network connections for memory dump acquisition.; Isolate the compromised database service account by temporarily disabling it in Active Directory and revoking active Kerberos ticket granting tickets (TGTs).

Answer

The incident response team should apply host-based firewall rules to isolate network traffic while preserving memory for forensic preservation, and disable the compromised Active Directory service account while revoking active session tokens.
Isolating network traffic through host firewall rules and revoking compromised credentials directly contain the adversary's lateral movement and active sessions while protecting volatile RAM for memory forensics.

Step-by-Step Solution

1
Identify current incident phase
The incident is actively occurring; active lateral movement and C2 require immediate containment actions.
Containment limits the scope of damage and prevents further adversary access while volatile evidence is collected.
2
Select appropriate containment controls
Host isolation via firewall controls stops lateral movement, and disabling compromised credentials prevents ongoing session abuse.
These actions contain the threat without altering volatile system memory needed for forensic evaluation.
3
Evaluate and filter out-of-order phase actions
Re-imaging systems belongs to Eradication/Recovery, while post-mortem reviews belong to Post-Incident Activity.
Prematurely executing eradication or lessons learned violates NIST lifecycle sequence rules.

Key Concept

NIST Incident Response Lifecycle (Containment Strategy and Phase Sequencing)
Question 1020Question →

During a security assessment of a microservices-based web application, an analyst reviews API traffic logs for the user settings service. The logs show that an authenticated user transmitted an HTTP PATCH request to update their profile information. By adding the property "is_admin": true to the JSON request payload, the user successfully elevated their permissions on the platform because the backend automatically bound the request fields directly to the internal data model. Which of the following best identifies the root cause vulnerability and the most effective developer remediation?

Show answer & explanation

Answer: Mass assignment; restrict object parameter binding by using data transfer objects (DTOs) or field allowlists on the backend.

Answer

Mass assignment; restrict object parameter binding by using data transfer objects (DTOs) or field allowlists on the backend.
The correct answer identifies mass assignment as the root cause vulnerability and parameter allowlisting as the effective mitigation. Mass assignment (also known as auto-binding) occurs when software frameworks automatically bind incoming HTTP payload parameters to internal data structures without restricting allowable fields. Attackers exploit this by injecting unexpected properties like privilege flags. Creating explicit Data Transfer Objects (DTOs) or field allowlists restricts parameter binding exclusively to authorized attributes.

Step-by-Step Solution

1
Analyze the log entries and application behavior
The application automatically maps unvalidated request payload parameters directly to internal data models, enabling unauthorized field modification.
This auto-binding behavior allows users to manipulate parameters that should only be controlled by the server, indicating a mass assignment vulnerability.
2
Distinguish between identity verification and object attribute authorization
The threat relies on missing server-side schema boundaries rather than unauthenticated user access.
Authenticating users does not block an authenticated user from including unexpected JSON properties in an API call.
3
Identify the appropriate software remediation strategy
Enforce strict schema limits using Data Transfer Objects (DTOs) or field allowlisting on the backend.
Restricting parameter binding at the code level prevents hidden or privileged object attributes from being modified by client inputs.

Key Concept

Mass Assignment Vulnerability and Parameter Binding Defense
PreviousPage 51 / 112Next
All practice questions — CompTIA Security+ | Examkin