Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1101Question →

A security analyst receives a high-fidelity Endpoint Detection and Response (EDR) alert indicating that a web service process on a critical Linux server is executing unauthorized shell commands and attempting outbound command-and-control communications. The analyst must contain the threat immediately to prevent lateral movement while preserving volatile memory and maintaining an administrative management channel to the host. Which of the following is the most appropriate action to take using the EDR console?

Show answer & explanation

Answer: Execute host isolation to restrict network traffic while maintaining the EDR management agent connection.

Answer

Execute host isolation to restrict network traffic while maintaining the EDR management agent connection.
Executing host isolation via the EDR platform selectively blocks network traffic at the endpoint level while keeping the secure agent-to-console communications channel open. This isolates the compromised system from internal and external network assets to prevent lateral movement, while preserving volatile memory (RAM) and allowing security analysts to conduct remote containment and investigation actions.

Step-by-Step Solution

1
Identify the primary operational requirement based on the incident scenario.
The requirement is immediate active containment of malicious C2 communication and lateral movement on an endpoint without destroying volatile memory or losing analyst control.
Incident response containment actions must prioritize stopping attack spread while preserving forensic evidence.
2
Evaluate the native containment capabilities of Endpoint Detection and Response (EDR) platforms.
EDR host isolation segregates the endpoint software network stack at the kernel/agent level, allowing only EDR agent telemetry and control traffic to pass back to the management platform.
Host network isolation immediately cuts off attacker C2 channels and lateral probing without powering down the host or altering volatile memory state.
3
Compare host network isolation against alternative actions such as perimeter blocking, rebooting, or signature scanning.
Perimeter firewalls do not stop internal lateral movement, rebooting destroys volatile RAM evidence, and legacy AV scans do not actively isolate the compromised network socket.
Host isolation via the EDR console is the only action that fulfills all scenario requirements.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Question 1102Question →

During a security review of a cloud-hosted feedback portal, an analyst discovers that user comments submitted to the support forum are stored in the application database without sanitization. When an administrator views the support dashboard, script tags embedded inside user comments execute within the administrator's browser session, attempting to transmit session tokens to an external host.

Which of the following correctly identifies the vulnerability type demonstrated in this incident and the most effective code-level remediation?

Show answer & explanation

Answer: Cross-Site Scripting (XSS); implement context-aware output encoding and input validation.

Answer

Cross-Site Scripting (XSS); implement context-aware output encoding and input validation.
The correct option correctly identifies the flaw as Stored Cross-Site Scripting (XSS) and selects context-aware output encoding as the effective remediation. When untrusted input stored in a backend system is sent to a client browser without proper HTML/JS entity encoding, the browser interprets the input as executable code.

Step-by-Step Solution

1
Analyze the attack mechanism described in the scenario.
The injected payload consists of script tags stored in a database and executed in an administrator's browser upon rendering.
Execution of script code in the browser context of a viewing user indicates client-side code injection.
2
Identify the specific vulnerability class.
Stored (Persistent) Cross-Site Scripting (XSS).
Because the payload is persisted in the database before being rendered to other users, it fits the definition of Stored XSS.
3
Determine the proper code-level mitigation strategy.
Apply context-aware output encoding and validate input.
Encoding ensures that special characters like script tags are treated as text data rather than executable code by the browser parser.

Key Concept

Stored Cross-Site Scripting (XSS) Remediation
Estimated Time:1m 30s
Question 1103Question →

A security analyst is hardening an enterprise domain environment after an internal audit revealed two critical weaknesses: unauthenticated network hosts can execute anonymous directory queries to enumerate domain user accounts, and internal authentication traffic is susceptible to credential relay attacks. Which of the following mitigation strategies should the analyst implement to address these specific vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enforce LDAP server signing and channel binding requirements across domain controllers.; Disable NTLM authentication protocols in favor of Kerberos with enforced SMB signing.

Answer

The correct mitigations are enforcing LDAP server signing and channel binding to prevent anonymous account enumeration, and disabling legacy NTLM protocols in favor of Kerberos with SMB signing to prevent credential relay attacks.
Enforcing LDAP server signing and channel binding ensures directory queries require authentication and integrity checks, directly preventing anonymous account enumeration. Disabling legacy NTLM in favor of Kerberos with SMB signing secures authentication traffic against replay and relay attacks across internal subnets.

Step-by-Step Solution

1
Analyze the reported vulnerability regarding anonymous user enumeration.
Identified unencrypted, unsigned LDAP queries (TCP/UDP 389) permitting anonymous binding.
Requiring LDAP signing and channel binding forces client authentication and encryption, neutralizing anonymous directory enumeration.
2
Analyze the reported vulnerability regarding credential relay attacks.
Identified legacy challenge-response authentication (NTLM) being intercepted and relayed.
Migrating to Kerberos authentication and enforcing SMB signing ensures session integrity and prevents authentication relay tactics.
3
Evaluate and rule out inappropriate control selections.
Deception devices and perimeter firewalls do not solve internal directory and authentication protocol hardening requirements.
Honeypots are not inline filtering controls, and perimeter firewalls cannot prevent internal lateral relay attacks.

Key Concept

Directory Service Hardening and Secure Authentication Protocol Enforcement
Question 1104Question →

A healthcare organization is updating its enterprise Identity and Access Management (IAM) architecture to support dynamic, fine-grained access control across decoupled microservices. The security team requires a centralized component that evaluates contextual attributes—such as user role, device posture, time of day, and resource sensitivity—against security policies to issue an authorization decision for each access request. Which architectural component directly performs this policy evaluation to determine whether access should be granted?

Show answer & explanation

Answer: Policy Decision Point (PDP)

Answer

Policy Decision Point (PDP)
The Policy Decision Point (PDP) is the architectural entity in Attribute-Based Access Control (ABAC) and Zero Trust architectures responsible for receiving authorization requests, evaluating them against configured access policies and environmental attributes, and issuing a definitive permit or deny decision.

Step-by-Step Solution

1
Analyze the architectural requirements stated in the scenario.
The requirement calls for a component that evaluates access policies against context attributes to issue an authorization decision.
Decoupling policy evaluation from enforcement allows centralized management of fine-grained authorization rules.
2
Differentiate between XACML/ABAC architecture roles (PDP vs. PEP vs. IdP).
The Policy Decision Point (PDP) performs logic processing and rule evaluation, while the Policy Enforcement Point (PEP) intercepts and enforces the decision.
The question specifically asks for the component that evaluates policies and issues the decision.

Key Concept

Attribute-Based Access Control (ABAC) and Policy Decision Point (PDP) Architecture
Question 1105Question →

A digital forensics investigator is preparing to capture a bit-stream copy of a seized hard drive recovered from an employee's computer during an insider threat investigation. To ensure that the physical drive's original data remains unmodified and that the acquired evidence is legally admissible, which of the following procedures must the investigator implement prior to starting the imaging process?

Show answer & explanation

Answer: Connect the target hard drive through a hardware write-blocker and calculate an initial cryptographic hash value.

Answer

Connect the target hard drive through a hardware write-blocker and calculate an initial cryptographic hash value.
Connecting the evidence drive through a hardware write-blocker guarantees that no write commands reach the physical disk during acquisition. Computing an initial cryptographic hash (such as SHA-256) before and immediately after imaging proves that the image is a bit-for-bit identical duplicate of the original drive without modification.

Step-by-Step Solution

1
Isolate the evidence disk
Prevents unauthorized access or network interaction.
Ensures the drive is handled in a controlled forensic environment.
2
Attach a hardware write-blocker to the drive controller interface
Blocks write signals from the forensic workstation controller.
Protects the evidence from accidental modifications, timestamp updates, or operating system writes.
3
Generate an initial cryptographic hash (e.g., SHA-256) of the original drive
Creates a baseline hash digest value.
Establishes a verifiable integrity baseline to compare against forensic disk images.

Key Concept

Digital Forensics Evidence Acquisition Integrity and Write Protection
Question 1106Question →

A Security Operations Center (SOC) team receives an automated alert generated by their Security Information and Event Management (SIEM) system regarding suspicious outbound traffic from host IP 10.10.4.15. The team pulls the following correlated telemetry logs:

[Sysmon Event ID 22 - DNS Query]
ProcessImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
QueryName: aW50ZXJuYWwtZGF0YS0wMQ.exfil.attacker-domain.com
QueryStatus: 0 (SUCCESS)

[Perimeter Firewall Egress Log]
SrcIP: 10.10.4.15 | DstIP: 198.51.100.45 | DstPort: 53 | Protocol: UDP | Action: ALLOWED | BytesSent: 1420

[SIEM Correlation Engine Alert]
Rule_ID: RULE_DNS_HIGH_ENTROPY_SUBDOMAINS
Condition: Count(DNS_Query) > 500 per 60 seconds targeting unique high-entropy subdomains of a single domain.

Based on the log telemetry and correlation rule output, which of the following best identifies the active attack vector and the underlying operational reason it bypassed initial perimeter controls?

Show answer & explanation

Answer: DNS tunneling data exfiltration, which exploited uninspected outbound UDP port 53 traffic permitted for domain name resolution.

Answer

DNS tunneling data exfiltration, which exploited uninspected outbound UDP port 53 traffic permitted for domain name resolution.
The correct answer identifies DNS tunneling data exfiltration. The telemetry clearly demonstrates a script (PowerShell) emitting high-frequency DNS queries featuring encoded strings in the subdomain section to an external attacker-controlled domain. Outbound UDP port 53 is commonly left open for host name resolution, which allowed the exfiltration channel to operate until flagged by the SIEM's entropy-based correlation rule.

Step-by-Step Solution

1
Analyze the process and query parameters in the Sysmon Event ID 22 log entry.
Identified PowerShell executing DNS lookups against encoded strings embedded as subdomains (e.g., 'aW50ZXJuYWwtZGF0YS0wMQ.exfil.attacker-domain.com').
Attackers encode stolen binary or text data into DNS queries to bypass standard payload inspection.
2
Examine the firewall log and SIEM correlation rule trigger.
Confirmed that outbound UDP port 53 traffic from host 10.10.4.15 was allowed, and the SIEM recorded >500 high-entropy subdomain requests per minute.
Firewalls often allow outbound DNS traffic (port 53 UDP) implicitly for operational lookup capability, enabling DNS tunneling exfiltration if outbound queries are not restricted to internal recursive resolvers.
3
Synthesize the indicators to confirm the threat vector.
Matched high-frequency encoded subdomain queries over UDP port 53 with DNS tunneling for exfiltration.
The payload pattern and network path match DNS protocol misuse rather than web application attacks or authentication failures.

Key Concept

DNS Tunneling and Log Correlation
Question 1107Question →

A logistics company is deploying telemetry edge devices on freight vehicles. To protect against unauthorized firmware tampering, the systems engineer must guarantee that the microcontroller only executes cryptographically signed boot code during power-on. Which hardware security control serves as the immutable foundation to perform this initial integrity verification?

Show answer & explanation

Answer: A hardware Root of Trust (RoT) embedded within read-only memory (ROM) on the system-on-chip

Answer

A hardware Root of Trust (RoT) embedded within read-only memory (ROM) on the system-on-chip
A hardware Root of Trust (RoT) stored in immutable ROM on the system-on-chip provides the essential cryptographic anchor. Because code stored in ROM cannot be altered after manufacture, it reliably verifies the digital signature of the initial bootloader before execution, establishing a secure chain of trust.

Step-by-Step Solution

1
Identify the primary requirement
The scenario requires an immutable hardware-based anchor to verify cryptographic signatures of boot code at power-on.
Preventing unauthorized firmware execution requires an unalterable trust foundation prior to running any soft code.
2
Evaluate hardware vs software security controls
Software-based storage in flash memory or network filtering can be bypassed or overwritten, whereas hardware ROM cannot be modified after manufacturing.
An immutable foundation must exist in read-only hardware to validate subsequent stages in the secure boot chain.

Key Concept

Hardware Root of Trust and Secure Boot
Question 1108Question →

Match each core Zero Trust Architecture (ZTA) functional component to its primary operational responsibility within an enterprise security infrastructure.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Continuous Diagnostics and Mitigation (CDM)

Matches

Show answer & explanation

Answer

Policy Engine pairs with evaluating security policies and context to render access decisions. Policy Administrator pairs with issuing control commands and managing session tokens. Policy Enforcement Point pairs with intercepting traffic and enforcing data plane connections. Continuous Diagnostics and Mitigation pairs with gathering asset posture and vulnerability telemetry.
Zero Trust Architecture explicitly separates control plane operations from data plane execution. The Policy Engine determines access authorization, the Policy Administrator handles control signaling and session token distribution, the Policy Enforcement Point gates data plane traffic, and Continuous Diagnostics and Mitigation feeds real-time posture intelligence to inform ongoing access evaluations.

Step-by-Step Solution

1
Differentiate between policy decision logic and control plane session management.
Identify that the Policy Engine evaluates policy rules to make the access decision, while the Policy Administrator acts on that decision to manage session controls.
Decoupling decision logic (PE) from execution signals (PA) ensures strict separation of duties within the control plane.
2
Identify the operational boundary component handling active user traffic.
Associate the Policy Enforcement Point with direct data plane traffic inspection, gating, and session termination.
The PEP acts as the perimeter-less gatekeeper directly between the requester and enterprise workload.
3
Identify the supporting telemetry system providing contextual state data.
Associate Continuous Diagnostics and Mitigation with tracking endpoint compliance, patch levels, and device integrity.
Zero Trust demands explicit, continuous verification supported by ongoing threat and posture monitoring systems.

Key Concept

Zero Trust Architecture Functional Component Roles (NIST SP 800-207)
Estimated Time:1m 30s
Question 1109Question →

During an ongoing incident investigation, a security analyst detects that an unauthorized rogue laptop is actively transmitting encrypted data across an internal enterprise network. According to standard incident response frameworks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Disconnect the rogue laptop from the network to contain the incident.

Answer

Disconnect the rogue laptop from the network to contain the incident.
Disconnecting the rogue laptop immediately contains the threat by severing active network communication, preventing further unauthorized data exfiltration in accordance with standard incident response lifecycle guidelines.

Step-by-Step Solution

1
Identify the current phase of the incident response process based on the scenario.
An active threat (rogue device transmitting data) has been detected, requiring immediate containment.
Containment limits the damage of an ongoing incident and prevents further unauthorized data transmission.
2
Select the action that corresponds to the containment phase.
Disconnecting or isolating the unauthorized device stops active communication immediately.
Containment must occur prior to performing eradication, recovery, or post-incident review.

Key Concept

Incident Response Lifecycle - Containment Phase
Question 1110Question →

A cloud security architect is evaluating a high-availability strategy for a critical online payment application. The application requires near-zero Recovery Time Objective (RTO) and real-time transaction consistency across two distinct cloud regions. A system administrator proposes using asynchronous database replication paired with automated failover via DNS routing, but without implementing a third-site witness or quorum node. Which of the following risks is MOST likely to occur if a network partition isolates the primary region while servers in both regions remain fully operational?

Show answer & explanation

Answer: A split-brain scenario where database nodes in both regions assume the primary role and accept writes concurrently, causing severe data inconsistency.

Answer

A split-brain scenario where database nodes in both regions assume the primary role and accept writes concurrently, causing severe data inconsistency.
In high-availability multi-region cluster design, a split-brain condition occurs when a network partition breaks communication between nodes while both remain powered on. Without a third-site witness or odd-numbered quorum cluster to establish majority consensus, both nodes believe the other has failed and simultaneously assume the active role, accepting conflicting data writes.

Step-by-Step Solution

1
Analyze the architecture components and failure condition.
Two cloud regions are connected via asynchronous replication without a quorum/witness server, and a network partition breaks inter-region communication while both sites stay online.
When the heartbeat/replication link between two isolated sites drops, each site must determine whether the other site is down or simply unreachable.
2
Evaluate how active-passive high availability systems behave without a quorum mechanism.
Because neither site can communicate with the other and there is no third-party witness to break the tie, both nodes assume the peer is dead.
Without quorum or majority voting, both nodes promote themselves to active status.
3
Determine the impact of dual active nodes accepting concurrent writes.
Both instances accept user transactions independently, creating divergent database states that lead to data corruption when connectivity is restored (split-brain condition).
Split-brain is the primary high-availability failure mode when heartbeats fail across isolated active-passive nodes without quorum.

Key Concept

High Availability Quorum and Split-Brain Conditions
Estimated Time:1m 30s
Question 1111Question →

A security engineer is conducting vulnerability scans across an enterprise hybrid cloud environment. During network-based authenticated scans of Linux server instances, the scanner continuously reports multiple critical vulnerabilities for outdated software packages. However, system administrators confirm that vendor-specific security patches were already installed via package management backporting, which updates internal code without changing upstream major version strings. Furthermore, the network scans consistently fail to capture vulnerabilities on ephemeral, short-lived container instances deployed during peak auto-scaling events. Which of the following vulnerability assessment approaches should the security engineer implement to eliminate these false positives and ensure continuous visibility into short-lived instances?

Show answer & explanation

Answer: Deploy agent-based vulnerability scanning software directly onto the host images.

Answer

Deploying agent-based vulnerability scanning software directly onto host images.
Deploying local scanning agents on host images ensures direct access to system package databases (such as RPM or DPKG), allowing the scanner to verify backported security fixes accurately without relying on misleading network version banners. Agents also initialize automatically when auto-scaled or ephemeral containers boot up, guaranteeing visibility during short lifespans.

Step-by-Step Solution

1
Analyze the core limitations of the current network-based vulnerability scanning methodology.
Network-based scanners often rely on version banners retrieved via remote services, leading to false positives when enterprise Linux distributions backport security fixes without changing version numbers. Network scans also miss ephemeral hosts that terminate before scheduled scan windows.
Identifying why false positives occur and why short-lived assets are missed is necessary to select the proper scanning architecture.
2
Evaluate how agent-based scanning addresses local software inventory and ephemeral infrastructure.
Local agents query local package management databases directly, recognizing backported fixes accurately. Additionally, agents register immediately upon instance launch, providing instant visibility into short-lived workloads.
Agent-based deployment solves both the backporting false-positive issue and the ephemeral asset tracking challenge.

Key Concept

Agent-based vs. Network-based Vulnerability Scanning
Estimated Time:2m 0s
Question 1112Question →

A security analyst notices suspicious process execution on a financial department workstation during an active malware outbreak. To immediately block the workstation's network communication with other internal systems while preserving the security team's remote telemetry and control channel, which of the following is the most appropriate action to take?

Show answer & explanation

Answer: Perform a network host isolation action through the EDR console

Answer

Perform a network host isolation action through the EDR console
Executing a host isolation feature via an EDR platform severs all network traffic to and from the targeted workstation except for the encrypted connection between the EDR agent and its management console. This effectively stops lateral movement while enabling continuous incident investigation.

Step-by-Step Solution

1
Identify the primary operational requirement during containment
The goal is to stop lateral movement across internal systems while keeping host telemetry and remote management functional.
Containment must block malicious network traffic without losing control over the compromised endpoint.
2
Evaluate Endpoint Detection and Response (EDR) host isolation capabilities
EDR agents can isolate the endpoint software-wise, restricting network adapters to communicate only with the EDR management console.
This prevents lateral spread while allowing analysts to inspect memory, terminate processes, and gather telemetry.

Key Concept

Endpoint Network Isolation
Question 1113Question →

A Security Operations Center (SOC) analyst is reviewing raw telemetry in a SIEM console containing the following event logs from an internal DNS resolver and perimeter firewall:

2026-07-27T14:10:02Z dns-resolver named[2104]: query: 61646d696e2d70617373776f7264.exfil.external-badactor.net IN TXT + (10.0.4.15)
2026-07-27T14:10:05Z dns-resolver named[2104]: query: 636f6e666964656e7469616c3132.exfil.external-badactor.net IN TXT + (10.0.4.15)
2026-07-27T14:10:08Z perimeter-fw kernel: [DENY] SRC=10.0.4.15 DST=203.0.113.50 PROTO=TCP SPT=49210 DPT=443 SIG=DIRECT_OUTBOUND_RESTRICTED

Based on these correlated log entries, which of the following security findings are accurate? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Host 10.0.4.15 is using DNS tunneling via hex-encoded subdomains in TXT record queries to exfiltrate data.; Direct outbound TCP traffic on port 443 from host 10.0.4.15 to IP address 203.0.113.50 was explicitly dropped by the perimeter firewall.

Answer

Host 10.0.4.15 is using DNS tunneling via hex-encoded subdomains in TXT record queries to exfiltrate data, and direct outbound TCP traffic on port 443 from host 10.0.4.15 to IP address 203.0.113.50 was explicitly dropped by the perimeter firewall.
The correct findings identify DNS tunneling via hex-encoded subdomain queries for TXT records originating from host 10.0.4.15, as well as the perimeter firewall explicitly blocking direct outbound TCP port 443 traffic from that same host to IP 203.0.113.50.

Step-by-Step Solution

1
Analyze the DNS resolver log entries.
Identified high-entropy hex strings ('61646d696e...' and '636f6e6669...') prepended to query requests sent to 'exfil.external-badactor.net' via TXT records from source host 10.0.4.15.
Attackers frequently encode stolen data into DNS subdomain requests (DNS tunneling) to bypass standard perimeter inspection.
2
Analyze the perimeter firewall log entry.
Identified a '[DENY]' event for TCP traffic sourced from 10.0.4.15 trying to reach external IP 203.0.113.50 on port 443.
Firewall logs explicitly report packet filtering decisions (ALLOW/DENY/DROP) along with layer 3/4 headers.
3
Synthesize the correlated findings.
Confirmed DNS tunneling exfiltration attempts and verified that direct HTTPS connections from the internal host to the external IP address were blocked by firewall policy.
Correlating telemetry across network controls confirms both successful protocol abuse (DNS) and blocked direct channel attempts.

Key Concept

DNS Tunneling Detection and Firewall Telemetry Analysis
Question 1114Question →

A security analyst reviews network traffic captures following reports of credential leakage on an internal subnet. The analyst observes frequent UDP port 5355 multicast traffic where an unauthenticated endpoint rapidly responds to failed host name resolution requests from legitimate clients, prompting those clients to attempt NTLMv2 authentication against the endpoint. Which of the following attack types is most directly indicated by this activity?

Show answer & explanation

Answer: Link-Local Multicast Name Resolution (LLMNR) poisoning

Answer

The network activity indicates Link-Local Multicast Name Resolution (LLMNR) poisoning, where an attacker responds to fallback local hostname resolution requests over UDP port 5355 to capture user authentication hashes.
The correct answer identifies Link-Local Multicast Name Resolution (LLMNR) poisoning. LLMNR uses UDP port 5355 to resolve hostnames on the local subnet when primary DNS resolution fails. Attackers run tools to listen for these multicast requests and spoof replies, convincing victim machines to attempt NTLMv2 authentication against the attacker's machine, thereby capturing authentication hashes.

Step-by-Step Solution

1
Analyze the network protocol and port observed in the traffic captures
The traffic relies on UDP port 5355, which is the standard port for Link-Local Multicast Name Resolution (LLMNR).
Identifying the transport protocol and port establishes the target service mechanism being exploited.
2
Examine the client-server interaction behavior and payload handling
The endpoint responds to failed hostname queries, causing clients to transmit NTLMv2 authentication credentials to the attacker.
LLMNR fallback occurs when DNS fails, allowing an attacker to spoof the destination identity and harvest authentication hashes.
3
Differentiate LLMNR poisoning from other layer 2/3 redirection attacks
Unlike ARP or DNS poisoning, LLMNR poisoning explicitly exploits local fallback multicast queries when primary name resolution fails.
Distinguishing the specific indicator (UDP 5355 + hostname fallback + NTLMv2 capture) confirms LLMNR poisoning as the correct diagnosis.

Key Concept

LLMNR/NBT-NS Poisoning Indicators
Question 1115Question →

A security analyst receives a high-severity EDR alert indicating a fileless process injection attack targeting a critical server. To mitigate lateral movement, preserve evidence, and remediate the incident, the analyst must follow a structured EDR incident response workflow. In what order should the analyst perform the following response actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of EDR response actions is: 1) Apply host-level network isolation via the EDR agent while preserving console communication channels, 2) Acquire volatile memory artifacts and process dumps from the endpoint, 3) Run automated remediation playbooks to terminate malicious process trees and remove persistence mechanisms, and 4) Distribute newly extracted Indicators of Compromise (IoCs) to global EDR detection rules.
The proper EDR response workflow prioritizes immediate containment (host network isolation) to stop lateral movement, followed by volatile evidence acquisition (RAM/process dumps) before evidence is destroyed. Once evidence is preserved, active remediation (killing process trees and persistence) is executed. Finally, threat intelligence gained from the incident (IoCs) is deployed globally across all endpoint policies to prevent broader exploitation.

Step-by-Step Solution

1
Isolate the compromised endpoint from the network.
Lateral movement vectors are immediately severed while EDR agent communication remains online.
Containing the threat prevents lateral propagation and reduces enterprise risk before further investigation.
2
Capture volatile RAM and endpoint process telemetry.
Transient forensic artifacts (e.g., injected code in memory) are preserved for analysis.
Terminating processes prior to memory capture destroys critical fileless forensic evidence.
3
Execute remediation playbooks to kill malicious processes and clean persistence.
The active threat components on the host are stopped and eradicated.
Host remediation ensures the attacker can no longer execute commands or maintain access on the system.
4
Update central EDR detection policies with extracted IoCs.
The entire fleet is protected against identical attack vectors across the enterprise.
Post-incident hardening ensures enterprise-wide protection using newly gathered threat intelligence.

Key Concept

EDR Incident Containment, Forensic Acquisition, and Remediation Workflow
Question 1116Question →

An incident response team is performing live evidence collection on an enterprise web application server following a detected code injection attack. To preserve forensic integrity, in what sequence should the analyst collect the following data sources, ordered from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU cache and register contents, System RAM and ARP cache, Swap file and pagefile data, Local solid-state drive (SSD) image, and Offsite backup tapes and archival media.
Digital evidence acquisition must adhere strictly to the Order of Volatility (RFC 3227). Data must be collected starting with the most short-lived and fragile sources: CPU registers/cache first, followed by RAM/routing tables, swap files, local persistent disks, and lastly offline archival media.

Step-by-Step Solution

1
Identify the standard forensic Order of Volatility principles (RFC 3227).
Recognized that evidence acquisition must prioritize data sources based on how quickly they can be lost or altered.
Capturing highly perishable data first prevents essential evidence from being overwritten during operational steps.
2
Rank CPU registers and cache as the top priority.
Placed CPU cache and register contents in position 1.
CPU cache registers operate at nanosecond speeds and clear or overwrite continuously.
3
Rank System RAM and network routing/ARP tables as second priority.
Placed System RAM and ARP cache in position 2.
RAM contains live system memory and active connection states lost as soon as power is cut.
4
Rank temporary virtual memory and swap/pagefile data as third priority.
Placed Swap file and pagefile data in position 3.
Although written to storage media, swap files change rapidly as operating system virtual memory pages.
5
Rank persistent local storage and offsite archives in the remaining final positions.
Placed local SSD image in position 4 and offsite backup tapes in position 5.
Non-volatile disk drives and offline archives maintain persistence over extended time frames.

Key Concept

Order of Volatility
Question 1117Question →

A security analyst monitoring session logs observes multiple concurrent active sessions originating from different geographic regions for a single administrative account on an enterprise cloud portal, indicating active session hijacking. According to standard incident response playbooks, which of the following actions should the team perform immediately as part of the containment phase? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke all active session tokens and force a credential reset for the compromised account across the identity provider.; Apply network egress filters to block communication between internal systems and the adversary's IP address.

Answer

The containment phase requires immediately invalidating compromised active session tokens via the identity provider and enforcing perimeter IP blocking against the adversary's infrastructure.
Invalidating hijacked session tokens and placing block rules against adversary IP addresses directly stop active unauthorized access, fulfilling the primary goal of the containment phase.

Step-by-Step Solution

1
Identify the primary objectives of the containment phase in incident response.
The main objective of containment is to stop the spread of the attack and prevent the threat actor from maintaining active access without altering persistent server configurations prematurely.
Containment limits damage to enterprise systems while preserving system state for investigative analysis.
2
Evaluate the immediate containment measures for session hijacking.
Revoking active session tokens terminates the attacker's unauthorized session, and blocking adversary IP addresses prevents immediate re-entry.
These actions directly neutralize the active vector of exploitation without skipping ahead to eradication or recovery phases.

Key Concept

Incident Response Containment Phase Actions
Estimated Time:1m 30s
Question 1118Question →

A security analyst detects suspicious fileless PowerShell execution on an enterprise workstation. The analyst needs to use Endpoint Detection and Response (EDR) capabilities to respond to the incident effectively while maintaining investigation capability. Which of the following response actions are primary capabilities provided directly by an EDR platform in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolating the host from the network logically while maintaining an active agent management channel for remote investigation; Capturing real-time host telemetry including process lineage trees, parent-child relationships, and command-line arguments

Answer

The primary EDR capabilities in this scenario are isolating the host from the network while maintaining an administrative agent channel, and collecting continuous host telemetry including process lineage trees and command-line arguments.
Endpoint Detection and Response (EDR) provides granular host isolation to contain suspicious activity without severing the security team's remote management channel. Additionally, EDR continuously collects behavioral telemetry, such as process execution trees and command-line arguments, which allows security analysts to reconstruct attack chains during fileless execution scenarios.

Step-by-Step Solution

1
Evaluate containment actions available at the endpoint level.
Host network isolation severs lateral network access without killing the EDR agent connection.
This prevents threat propagation while allowing ongoing remote forensic investigation.
2
Evaluate threat detection and analytical capabilities of EDR.
Process lineage tree tracking records execution arguments and parent process origins.
This telemetry exposes malicious activity that circumvents traditional static file signatures.

Key Concept

Endpoint Detection and Response (EDR) Core Capabilities
Question 1119Question →

An Endpoint Detection and Response (EDR) agent detects an active ransomware process attempting to encrypt files on a enterprise workstation. Place the following incident response workflow steps in the correct chronological order from first action to last action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps in the EDR incident response workflow is: 1) Isolate the host from the network, 2) Terminate the malicious process tree, 3) Perform memory analysis and process tree inspection, 4) Execute remediation and remove persistence artifacts.
In standard EDR operational playbooks, the immediate priority upon detecting active malware is containment (host isolation), followed by terminating the active process execution, conducting forensic memory analysis, and finally executing remediation commands to remove persistence.

Step-by-Step Solution

1
Network Host Isolation
The host is isolated from the enterprise network to block lateral movement.
Immediate containment minimizes the threat radius before taking further investigative actions.
2
Malicious Process Termination
The execution of ransomware process threads is stopped.
Terminating the process halts active file encryption on the endpoint.
3
Telemetry & Memory Forensics
Process lineage and memory artifacts are collected for analysis.
Forensic inspection identifies how the attack occurred and what persistence mechanisms were dropped.
4
Remediation & Cleanup
Registry keys are cleaned up and infected files are restored from shadow copies.
Host state is returned to a clean baseline after full analysis and containment.

Key Concept

EDR Automated Containment and Incident Response Workflow
Question 1120Question →

A systems engineer is hardening enterprise endpoints, embedded controllers, and server infrastructure. Match each hardware security feature on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Trusted Platform Module (TPM)
Hardware Security Module (HSM)
Physically Unclonable Function (PUF)
eFuse

Matches

Show answer & explanation

Answer

Trusted Platform Module (TPM) pairs with local endpoint integrity measurements and host key storage. Hardware Security Module (HSM) pairs with centralized high-volume cryptographic processing. Physically Unclonable Function (PUF) pairs with deriving unique device keys from silicon manufacturing variations. eFuse pairs with permanently locking hardware configurations via one-time programmable physical blown traces.
Each hardware security feature corresponds strictly to its targeted operational profile: TPM provides endpoint host boot measurement; HSM handles centralized server cryptographic acceleration; PUF generates unique chip keys based on physical silicon variations; and eFuse permanently alters chip capabilities by burning physical internal fuses.

Step-by-Step Solution

1
Differentiate endpoint-focused hardware roots of trust from server-centric cryptographic appliances.
TPM is identified as an endpoint-level crypto microcontroller for boot integrity, whereas HSM is identified as an enterprise device for server key management.
TPMs are deployed locally on client systems, while HSMs serve high-availability, multi-tenant server infrastructure.
2
Distinguish between silicon fingerprint generation and permanent circuit path modification.
PUF relies on intrinsic silicon variations to derive secret keys, whereas eFuse physically alters internal micro-wiring to permanently set configurations.
PUF yields dynamic identity evaluation without stored keys, while eFuses act as irreversible state controls.

Key Concept

Hardware-based security controls and roots of trust
PreviousPage 56 / 112Next
All practice questions — CompTIA Security+ | Examkin