Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 101Question →

An enterprise organization operating an immutable containerized infrastructure discovers a critical zero-day vulnerability in its base operating system image across multiple microservices. What is the correct chronological sequence of steps the security operations team must perform to remediate this vulnerability while maintaining configuration integrity and change control compliance?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with identifying affected container repositories using SBOM telemetry, updating base image directives in source manifests, executing automated regression testing in a staging environment, obtaining formal Change Advisory Board authorization backed by test metrics and rollback plans, and concluding with a canary deployment to production accompanied by continuous configuration baseline auditing.
The sequence correctly reflects standard enterprise patch management for immutable environments: initial asset scoping using Software Bill of Materials (SBOM) data occurs first; updates are committed to Infrastructure-as-Code manifests; pre-deployment automated regression testing in staging provides the mandatory verification evidence needed for Change Advisory Board (CAB) approval; and production deployment proceeds via canary release paired with ongoing configuration drift auditing.

Step-by-Step Solution

1
Inventory and scope analysis
Identification of all vulnerable container image dependencies across microservices
Scoping via SBOM data ensures accurate mapping of all affected artifacts before initiating code alterations.
2
Infrastructure-as-Code (IaC) configuration update
Updated base image version committed to source repository development branch
Immutable infrastructure dictates that patches are declared in source code manifests rather than applied to active workloads.
3
Pre-deployment validation in staging
Empirical confirmation of patch stability and security control effectiveness
Staging verification prevents broken builds or incompatible patches from impacting live enterprise operations.
4
Change control governance
Formal approval granted by the Change Advisory Board (CAB)
Enterprise governance requires empirical test documentation and risk mitigation plans prior to production release.
5
Production rollout and baseline auditing
Controlled canary rollout and ongoing detection of configuration drift
Gradual rollout mitigates deployment blast radius, while ongoing auditing ensures production containers match the approved baseline.

Key Concept

Enterprise Patch and Configuration Management Lifecycle for Immutable Infrastructure
Question 102Question →

A security administrator is establishing a high-availability disaster recovery plan for a mission-critical web application. During an unrecoverable primary data center outage, administrative staff must execute a site failover to the secondary site. Place the following failover operational steps in the correct chronological sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Detect primary site failure and initiate failover, 2) Isolate the primary site to prevent split-brain condition, 3) Promote the secondary database to primary active read-write mode, and 4) Update GSLB DNS records to direct user traffic to the secondary site.
In high-availability and disaster recovery architectures, site failover must follow a strict dependencies-first operational sequence. Detecting failure precedes all administrative actions. Fencing the primary node must occur next to prevent split-brain data corruption caused by simultaneous active nodes. Subsequently, backend state stores (databases) must be promoted to read-write mode before front-end services can handle transactions. Finally, GSLB/DNS redirection is updated to send live client traffic to the secondary location.

Step-by-Step Solution

1
Identify system status
Automated monitoring flags primary site unavailability and triggers the failover routine.
Monitoring and detection must precede any operational state changes.
2
Enforce fencing and isolation
Primary nodes are isolated to ensure they do not attempt to process writes concurrently.
Fencing prevents split-brain scenarios where both data centers attempt to write to shared or replicated databases simultaneously.
3
Promote secondary data tier
Secondary standby database is converted to primary read-write status.
Application services cannot function correctly until the backend data layer is capable of processing state modifications.
4
Redirect traffic ingress
GSLB endpoints update DNS records to point to the secondary site IP infrastructure.
Traffic routing is updated last to ensure users land on fully configured and operational services.

Key Concept

Disaster Recovery Failover Sequencing and Split-Brain Prevention
Question 103Question →

A security administrator needs to apply a critical security update to enterprise web servers. What is the correct sequence of steps the administrator should follow to complete the patch management workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the patch management process is: 1) Identify and acquire the security patch, 2) Validate and test the patch in a non-production staging environment, 3) Submit a change request for approval by the Change Advisory Board, and 4) Deploy the patch to production servers.
The standard enterprise patch management lifecycle progresses logically from patch discovery and acquisition, to non-production staging validation, followed by formal governance approval from the Change Advisory Board, and concluding with scheduled deployment to production systems.

Step-by-Step Solution

1
Identify and acquire the security patch from a verified vendor source.
The authentic security update is retrieved and verified.
You must obtain and verify the update before testing or scheduling deployment.
2
Validate and test the security patch in a non-production staging environment.
Patch stability, performance impact, and compatibility are verified.
Staging validation detects software conflicts without jeopardizing live production services.
3
Submit a change request for review and approval by the Change Advisory Board (CAB).
Formal authorization and back-out plans are officially documented and approved.
Enterprise change governance requires technical test evidence before approving live modifications.
4
Deploy the patch to production servers during an authorized maintenance window.
Production systems are updated with minimal disruption to users.
Deployment occurs only after validation and governance requirements are fully satisfied.

Key Concept

Standard Enterprise Patch Management Lifecycle
Question 104Question →

A security analyst is configuring a Security Orchestration, Automation, and Response (SOAR) playbook to automatically handle alerts triggered when a cloud IAM access key is exposed in a public repository. Arrange the automated response workflow steps into the correct chronological sequence from first step to final step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution sequence begins with event ingestion and log enrichment, followed by automated identity containment (session revocation and policy denial), automated credential remediation (key rotation in secrets manager), and concludes with stakeholder notification and incident documentation.
The standard SOAR playbook lifecycle dictates that alerts must first be enriched with contextual log data. Once scope is established, automated containment actions (revoking sessions and denying API actions) are applied to stop active exposure. Following successful isolation, remediation actions rotate credentials in secret stores, and finally, notification tasks update human analysts and close the automated ticket workflow.

Step-by-Step Solution

1
Perform initial ingestion and automated context enrichment.
Alert data is parsed and CloudTrail/audit logs are collected to quantify the scope of use of the leaked API key.
Enrichment provides necessary context on key usage before modifying permissions or terminating sessions.
2
Execute identity containment controls.
Active sessions created using the key are revoked and an inline explicit deny policy is bound to the identity.
Containment limits damage by ensuring an attacker cannot continue making authorized API calls.
3
Perform secret rotation and remediation.
A new API key pair is generated and securely injected into the enterprise secrets management vault.
Automated remediation restores operational functionality safely with fresh, secure credentials.
4
Notify stakeholders and close the automation workflow.
The application owner receives summary metrics and audit logs for final verification.
Documentation and communication complete the incident lifecycle within the SOAR framework.

Key Concept

SOAR Automated Incident Response Lifecycle
Question 105Question →

An incident response team is responding to a confirmed security incident involving unauthorized API key usage and data exfiltration from an enterprise cloud storage bucket. Place the following incident response actions in the correct sequential order from first step to last step according to standard incident response playbooks.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the standard NIST incident response framework: Detection & Analysis (analyzing audit logs to scope the incident), Containment (revoking access keys and locking down storage access), Eradication & Recovery (deleting backdoor IAM roles and restoring secure baseline permissions), and Post-Incident Activity (holding a lessons-learned retrospective and updating playbooks).
The standard incident response process flows sequentially through four main phases: Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. First, analyzing audit logs establishes incident scope (Detection & Analysis). Second, revoking compromised access keys halts ongoing exfiltration (Containment). Third, deleting unauthorized backdoor roles and restoring baseline permissions removes threat persistence and restores secure operations (Eradication & Recovery). Finally, conducting a post-incident retrospective documents lessons learned (Post-Incident Activity).

Step-by-Step Solution

1
Perform Detection & Analysis
Validate the security event and establish the full scope of compromised cloud resources using audit log analysis.
Before executing containment, responder actions must be guided by verified scope and threat intelligence.
2
Execute Containment strategy
Disable compromised access credentials and restrict bucket access policies to prevent further data loss.
Containment limits damage and prevents the adversary from continuing unauthorized data exfiltration.
3
Perform Eradication & Recovery
Purge any secondary backdoor roles installed by the attacker and return cloud environment permissions to a verified clean state.
Eradication removes all mechanisms of adversary persistence, while recovery restores systems to normal production status.
4
Conduct Post-Incident Activity
Document timeline, evaluate incident response performance, and update playbooks to improve future defense capabilities.
Lessons learned activities occur post-remediation to prevent recurrence and enhance operational readiness.

Key Concept

NIST Incident Response Lifecycle Phases
Question 106Question →

A Security Operations Center (SOC) analyst receives an Endpoint Detection and Response (EDR) telemetry alert indicating a malicious DLL side-loading attempt on an enterprise domain controller. Arrange the standard EDR incident response steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: 1) Detect and flag the behavioral anomaly via EDR telemetry, 2) Apply host-level network isolation, 3) Collect volatile memory snapshots and execution logs, and 4) Terminate malicious processes, remove persistence keys, and restore network connectivity.
The correct order follows the standard incident containment life cycle: telemetry detection identifies the threat, host isolation immediately contains lateral movement while maintaining EDR management channels, forensic collection gathers volatile evidence safely, and remediation cleans the system before network restoration.

Step-by-Step Solution

1
Identify threat activity using EDR behavioral monitoring telemetry
Alert generated for unauthorized process execution and side-loading
Detection provides the necessary diagnostic context to initiate incident response.
2
Isolate the endpoint using host-level network containment
Host is logically disconnected from the network while preserving EDR control
Containing the host mitigates lateral spread and C2 communication immediately.
3
Gather forensic artifacts and volatile memory captures via EDR console
Volatile evidence is preserved without risking network exposure
Collecting triage data while isolated ensures evidence is captured prior to system modification.
4
Remediate threat artifacts and lift host network isolation
Rogue processes killed, persistence removed, and endpoint restored to normal operations
Remediation and un-isolation conclude the active containment and response lifecycle.

Key Concept

EDR automated containment and forensic investigation workflow
Estimated Time:1m 30s
Question 107Question →

An enterprise security team is configuring a Just-In-Time (JIT) Privileged Access Management (PAM) workflow with short-lived ephemeral credentials for database administrators. Place the operational lifecycle steps in the correct chronological order from the initial access request through session termination.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The operational sequence begins with administrator authentication and request submission, followed by automated policy validation and ephemeral credential generation, session initiation through the PAM proxy gateway, real-time command monitoring and session recording during operation, and concludes with automated credential revocation and session termination upon time window expiry.
The correct operational lifecycle follows the principle of least privilege and Just-In-Time access controls. It starts with the administrator requesting access with justification. Next, authorization policies are checked and ephemeral credentials with short TTLs are issued. The administrator then logs into the target through a PAM proxy gateway, which maintains active session monitoring and command logging throughout the connection. Finally, once the access time window lapses, the PAM system automatically revokes credentials and terminates open connections.

Step-by-Step Solution

1
Identify the request phase
The administrator submits an access request with ticket justification via the PAM portal.
JIT workflows require explicit administrative intent and justification prior to provisioning privileges.
2
Determine the provisioning phase
The PAM controller evaluates the rule baseline and generates an ephemeral, short-lived credential.
Credentials must be dynamically created with strict Time-to-Live (TTL) attributes before access can be granted.
3
Identify the session entry phase
The administrator establishes a database session routed through the PAM proxy gateway using the ephemeral credential.
Routing connections through a proxy ensures direct database access is blocked and session telemetry is captured.
4
Determine the operational monitoring phase
The proxy gateway performs active session recording and real-time command monitoring.
Active monitoring must happen concurrently with session execution to maintain auditability and prevent unauthorized command execution.
5
Identify the teardown phase
The PAM system automatically invalidates the short-lived credential and terminates active proxy sessions upon window expiration.
Automated revocation enforces zero lingering privileges and minimizes standing access risks.

Key Concept

Just-In-Time (JIT) Privileged Access Management (PAM) Lifecycle
Question 108Question →

A digital forensics examiner is performing evidence collection on a powered-on enterprise server following a suspected breach. To ensure maximum preservation of transient evidence, the examiner must adhere strictly to the forensic Order of Volatility. Sequence the following evidence sources from most volatile (highest priority for acquisition) to least volatile (lowest priority for acquisition).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition sequence from most volatile to least volatile is: Processor cache and CPU registers, followed by Physical system RAM and running process tables, followed by Swap files and pagefile space on local disk storage, and ending with Offline archival backup tapes.
Standard digital forensics practices (RFC 3227) require collecting evidence in order of volatility to prevent losing perishable data. CPU registers and cache change at instruction-level speeds and are most volatile. Physical RAM loses contents upon reboot or power-off. Swap and pagefiles reside on disk but hold temporary, frequently modified memory blocks. Offline archival tapes are static physical media stored offsite, making them the least volatile.

Step-by-Step Solution

1
Identify the data source with the shortest lifetime that changes during hardware execution.
Processor cache and CPU registers are placed first.
Registers and CPU caches alter state with every clock cycle and cannot be preserved once execution progresses or power changes.
2
Identify volatile system memory retained only while power is maintained.
Physical system RAM and running process tables are placed second.
System memory holds dynamic network connections, process structures, and unencrypted keys that disappear if the machine powers down.
3
Identify temporary disk-backed virtual memory structures.
Swap files and pagefile space on local disk storage are placed third.
Pagefiles reside on non-volatile physical disks, but their data blocks are temporary and actively overwritten by operating system memory management.
4
Identify long-term static offline storage media.
Offline archival backup tapes are placed last.
Archival media is offline, unpowered, and structurally static, making it the most durable and least volatile evidence source.

Key Concept

Order of Volatility in Digital Forensics
Question 109Question →

A security engineer is configuring a SIEM collector to process raw syslog feeds from perimeter devices. Place the stages of SIEM log processing in the correct order from initial ingestion to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages is Log Collection & Ingestion, Parsing & Field Extraction, Data Normalization, Event Correlation, and Alert Generation.
The SIEM log processing pipeline must proceed sequentially from raw data capture to actionable intelligence. First, Log Collection & Ingestion gathers raw logs from network sources. Second, Parsing & Field Extraction breaks unstructured strings into distinct field variables. Third, Data Normalization maps vendor-specific variables into a unified schema. Fourth, Event Correlation analyzes normalized fields against detection rules and threat feeds. Finally, Alert Generation dispatches notifications to analysts when correlated events breach security thresholds.

Step-by-Step Solution

1
Identify the initial entry point of telemetry into the SIEM pipeline.
Log Collection & Ingestion is placed first because raw logs must be received before any processing can occur.
Raw data must be gathered from source endpoints or network appliances first.
2
Identify how raw unstructured strings are structured.
Parsing & Field Extraction is placed second to break raw text strings into discrete data variables.
Extracting key-value pairs is necessary before data can be categorized or standardized.
3
Identify how disparate vendor fields are unified.
Data Normalization is placed third to map extracted variables to a standard schema.
Standardizing field names allows the SIEM to analyze logs from different manufacturers consistently.
4
Determine how security context is established across normalized telemetry.
Event Correlation is placed fourth to evaluate normalized data against rules and threat intelligence.
Correlation logic requires structured, normalized data to accurately detect multi-source threats.
5
Determine the operational output resulting from correlation matches.
Alert Generation is placed fifth to notify security analysts of actionable security events.
Alert dispatches occur as the end result of matched correlation criteria.

Key Concept

SIEM Log Processing Pipeline
Question 110Question →

A Security Operations Center (SOC) analyst receives an automated alert from a network intrusion detection system (NIDS) flagging potential command-and-control (C2) beaconing activity from an internal workstation. Place the following incident triage and response steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert using raw packet captures and flow logs, followed by isolating the compromised workstation, deploying custom firewall block rules for the C2 IP, and concluding with incident documentation and updating network monitoring baselines.
The standard network security monitoring triage flow requires validating the security alert with raw telemetry first to confirm true positive status. Once validated, containment actions such as host isolation are performed immediately to block active command-and-control communication. Following containment, preventive controls like firewall block rules are updated across the network perimeter. Finally, the analyst completes post-incident procedures by documenting findings and updating monitoring baselines.

Step-by-Step Solution

1
Validate the NIDS alert using raw network telemetry
Confirmed true positive C2 beaconing activity
Triage validation prevents taking intrusive containment measures on false alarms.
2
Isolate the host machine from the network
C2 communication severed and host network access contained
Immediate containment limits damage and prevents adversary lateral movement.
3
Apply firewall block rules based on extracted indicators
Perimeter network defenses updated with threat indicators
Prevents other internal hosts from communicating with the same external threat infrastructure.
4
Perform post-incident documentation and update detection rules
Network security monitoring baselines and detection logic refined
Ensures lessons learned are incorporated to prevent similar incidents and improve future response speed.

Key Concept

Incident triage and containment workflow for network security alerts
Question 111Question →

A Security Operations Center (SOC) team is deploying an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-risk suspicious email reports. To prevent accidental disruption to critical business communications while ensuring rapid response, the automated response workflow must follow strict SOC governance standards spanning ingest, threat intelligence enrichment, analyst review, containment, and post-incident cleanup. In what sequence should the SOAR playbook execute these operational steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order begins with alert payload ingestion and IOC parsing, followed by automated threat intelligence enrichment, triggering a Human-in-the-Loop (HITL) approval gate, executing automated host isolation and token revocation upon authorization, and concluding with perimeter blocklist updates and case closure.
In SOAR playbook architecture, incident response follows a structured sequence: initial data ingestion and IOC extraction, automated threat intelligence lookup, decision governance via Human-in-the-Loop (HITL) verification for high-impact remediations, automated execution of containment scripts, and final documentation with blocklist propagation.

Step-by-Step Solution

1
Parse input payload
Extracted URLs, domain names, and email headers ready for automated processing.
Automation workflows require structured data inputs before external API integrations can be invoked.
2
Enrich indicators using threat intelligence tools
Aggregated threat scores and reputation analysis metrics.
Enrichment provides the necessary contextual data to evaluate severity before decision-making.
3
Execute Human-in-the-Loop (HITL) authorization step
Analyst confirmation or rejection of the proposed mitigation actions.
High-impact containment actions require human oversight to prevent operational downtime on critical enterprise accounts.
4
Enforce endpoint containment and credential revocation
Host network isolation and invalidated active authentication tokens.
Approved remediation tasks stop active session abuse and lateral movement across the network.
5
Finalize incident documentation and feed defensive perimeter controls
Updated SIEM entries, synchronized firewall blocklists, and resolved SOAR tickets.
Final documentation ensures audit compliance and prevents repeat attacks across the enterprise edge.

Key Concept

SOAR Playbook Execution Lifecycle and Governance
Question 112Question →

A Security Operations Center (SOC) analyst receives an automated high-severity SIEM alert indicating suspicious outbound traffic from an internal database server containing sensitive customer records to an unknown external IP address over port 443. The analyst must follow network security monitoring and initial incident response procedures. In what chronological sequence should the analyst execute the following triage and containment actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of actions begins with analyzing NetFlow records and SIEM log correlations, followed by inspecting NIDS alerts and full packet captures (PCAP), then applying network isolation controls to the database host, and finally updating perimeter firewall rules to block the external destination IP address.
The triage process follows a logical sequence from high-level flow verification to payload inspection, host isolation, and perimeter defense. Flow telemetry (NetFlow/SIEM) is evaluated first to confirm the alert boundaries. NIDS alerts and PCAP files are then examined to identify IoCs and malicious payloads. Next, host containment stops active data exfiltration while preserving volatile evidence. Finally, blocking the external malicious IP at the perimeter safeguards the broader enterprise architecture.

Step-by-Step Solution

1
Analyze NetFlow records and SIEM log correlations
Establishes baseline traffic metrics and verifies anomalous session characteristics.
Initial triage requires confirming session duration, flow volume, and endpoints before launching detailed analysis.
2
Inspect NIDS alerts and full packet captures (PCAP)
Extracts protocol payload details, certificate info, and threat signatures.
Detailed packet inspection provides context on the attack payload and identifies actionable indicators of compromise.
3
Apply network isolation controls to the affected database host
Halts ongoing exfiltration from the compromised system while preserving forensic artifacts in memory.
Host containment must occur immediately once a compromise is confirmed to prevent further unauthorized data access.
4
Update perimeter firewall rules to block the external destination IP address
Prevents potential lateral exfiltration attempts from other enterprise hosts to the malicious destination.
System-wide perimeter blocking ensures enterprise defense after containing the immediate host threat.

Key Concept

Incident Response and Triage Workflow in Network Security Monitoring
Question 113Question →

A security operations team is deploying a enterprise cloud application integrated with an internal Identity Provider (IdP) using SAML 2.0. Arrange the operational steps of a Service Provider-initiated (SP-initiated) Single Sign-On (SSO) authentication sequence in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for SP-initiated SAML 2.0 SSO is: 1) Initial resource request to the SP, 2) Redirection with SAML AuthnRequest to the IdP, 3) User authentication at the IdP, 4) Redirection with signed SAML Assertion back to SP's ACS, and 5) Signature validation and session creation by the SP.
In SAML 2.0 SP-initiated Single Sign-On, the sequence begins with an unauthenticated request to the Service Provider. The SP redirects the user's browser with a SAML AuthnRequest to the Identity Provider. Next, the user authenticates directly at the IdP. Upon successful authentication, the IdP redirects the user back to the SP's Assertion Consumer Service (ACS) endpoint with a signed SAML Assertion containing identity attributes. Finally, the SP verifies the assertion signature and establishes the user session.

Step-by-Step Solution

1
Identify the entry point of the SP-initiated authentication workflow.
The user initiates contact by requesting access directly at the Service Provider application.
In SP-initiated SSO, the flow starts at the resource provider, unlike IdP-initiated SSO where the user visits the IdP portal first.
2
Determine how the Service Provider directs the user to the authentication authority.
The SP issues an HTTP redirect containing a SAML AuthnRequest targeted at the IdP SSO URL.
The SP cannot authenticate the user locally, so it delegates identity verification by redirecting the client browser.
3
Trace the primary authentication event at the Identity Provider.
The user supplies primary credentials and completes mandatory MFA challenges at the IdP portal.
Authentication occurs strictly between the user browser and the IdP, ensuring credentials are never exposed to the SP.
4
Trace the return path of identity claims to the Service Provider.
The IdP redirects the browser to the SP's Assertion Consumer Service (ACS) with a signed SAML Response assertion.
The SAML assertion serves as cryptographically verifiable proof that the user successfully authenticated at the IdP.
5
Finalize session establishment and access authorization.
The SP validates the digital signature using the IdP's public key certificate and logs the user into the local application context.
Verifying the signature ensures the assertion came from a trusted IdP and was not altered during transit by a man-in-the-middle.

Key Concept

SAML 2.0 SP-Initiated Authentication Flow
Question 114Question →

A security technician is documenting the standard patch deployment workflow for enterprise operating systems. Place the following stages of the patch management lifecycle in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the patch management lifecycle is: 1. Identify and assess newly released vendor patches -> 2. Test the patch in a staging environment -> 3. Submit the patch deployment plan to the Change Advisory Board (CAB) -> 4. Deploy the patch to production systems -> 5. Perform post-installation auditing.
The standard patch management process follows a structured lifecycle: identification of updates, non-production testing, change management authorization, controlled production deployment, and post-deployment validation auditing.

Step-by-Step Solution

1
Identify available patches
Discovers vendor updates requiring evaluation.
Security operations must monitor vendor advisories and assess patch severity before taking operational action.
2
Perform staging and testing
Confirms patch compatibility without affecting live systems.
Testing ensures updates do not cause system crashes or application conflicts.
3
Request change authorization
Obtains formal CAB review and approval.
Change management governance mandates documentation and risk review prior to production modification.
4
Execute production deployment
Installs patches on production assets.
Deployment must occur during scheduled maintenance windows to minimize business impact.
5
Conduct post-patch verification and auditing
Confirms compliance and closure of vulnerability.
Auditing verifies that installation succeeded and configuration baselines remain secure.

Key Concept

Standard Patch Management Lifecycle Workflow
Question 115Question →

An enterprise Endpoint Detection and Response (EDR) agent detects an unauthorized process attempting to read sensitive memory structures from the Local Security Authority Subsystem Service (LSASS) on a finance system host. In what sequence should the automated EDR response workflow process this security event from initial containment to post-incident analysis?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with detecting anomalous process behavior, followed by isolating the host via the EDR agent, terminating malicious processes and quarantining artifacts, and concludes with gathering forensic telemetry for fleet-wide IoC threat hunting.
The workflow follows standard EDR incident response methodology: first detect the malicious behavioral attempt on the endpoint, isolate the host to restrict lateral movement, kill malicious processes and quarantine binary components, and finally gather forensic telemetry to hunt for Indicators of Compromise (IoCs) enterprise-wide.

Step-by-Step Solution

1
Behavioral Alert Triggering
The EDR agent flags the LSASS memory access attempt as a high-severity alert.
Detection forms the entry point for automated incident playbooks.
2
Host Containment & Isolation
Network traffic to and from the host is restricted except for the security agent control server.
Isolating the endpoint prevents the attacker from utilizing dumped credentials laterally while investigation proceeds.
3
Active Mitigation & Artifact Quarantine
The rogue process handle is killed and file modifications are moved to secure quarantine.
Terminating process handles halts local code execution after network propagation risk is mitigated.
4
Forensic Telemetry & Fleet Hunting
Memory state telemetry is collected and IOC hashes are searched across all endpoints.
Broad threat hunting ensures the adversary has not established duplicate persistence on adjacent hosts.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Remediation Workflow
Question 116Question →

An enterprise Security Operations Center (SOC) detects unauthorized execution of encryption software across several internal host systems. Place the following incident response playbook actions in the correct chronological order according to NIST SP 800-61 guidelines, starting from initial detection.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response lifecycle steps is: 1) Validate initial alert and scope, 2) Isolate affected network subnet, 3) Terminate processes and purge artifacts, 4) Restore hosts from clean backups, and 5) Hold a post-incident review meeting.
According to standard NIST SP 800-61 guidelines, incident response follows a strict linear sequence: Detection and Analysis (scoping the incident), Containment (isolating affected network segments), Eradication (purging malicious binaries and persistence hooks), Recovery (restoring systems from clean backups), and Post-Incident Activity (documenting lessons learned).

Step-by-Step Solution

1
Analyze telemetry and validate the incident.
Confirm indicators of compromise and scope of affected host systems.
Accurate scope identification ensures containment measures target all affected systems without prematurely interrupting unaffected services.
2
Implement network containment controls.
Prevent active encryption threats from spreading laterally.
Stopping lateral movement and C2 communication limits potential operational damage.
3
Execute eradication actions.
Eliminate malware binaries, malicious persistence hooks, and unauthorized access.
Systems cannot be restored safely until threat actor access mechanisms and malware are completely removed.
4
Perform system recovery.
Rebuild or restore endpoints from verified, uncompromised backups.
Restoring validated clean states ensures business continuity without reintroducing hidden compromise.
5
Conduct post-incident review.
Document lessons learned and update Incident Response playbooks.
Analyzing response performance identifies procedural gaps and prevents recurrence of similar incidents.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 117Question →

A Security Operations Center (SOC) team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle suspicious email attachments reported by end users. Place the following playbook execution steps in the correct operational sequence from initial alert ingestion to final incident closure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Parse the email artifact to extract IOCs, 2) Query threat intelligence feeds via APIs for reputation data, 3) Evaluate conditional branching logic against policy thresholds, 4) Execute automated response actions (email quarantine and host isolation), and 5) Update the ticketing system and notify the SOC team.
Automated incident response playbooks follow a structured lifecycle: Ingestion/Parsing → Enrichment → Decision Evaluation → Remediation → Documentation. The playbook must first parse the reported email to identify specific indicators of compromise. It then enriches those indicators using threat intelligence APIs. Next, it evaluates conditional logic to confirm threat thresholds. Once confirmed, automated containment (such as mailbox quarantine and endpoint isolation) takes place. Finally, the playbook logs all actions in the ticketing system and notifies analysts.

Step-by-Step Solution

1
Parse and Extract Indicators
Raw file hashes, domain names, and IP addresses are extracted from the raw email header and payload.
SOAR automation cannot query threat intelligence tools or execute targeted actions without specific extracted artifacts.
2
Perform Threat Intelligence Enrichment
Reputation scores and threat categories are added to the incident context via API integrations.
Contextual intelligence provides the factual basis needed for automated decision-making.
3
Evaluate Playbook Decision Rules
The workflow determines whether risk criteria match automated containment conditions or require human analyst intervention.
Policy rules prevent accidental execution of intrusive containment actions on benign or unverified alerts.
4
Run Automated Mitigation Actions
The malicious email is purged/quarantined across all mailboxes, and impacted endpoints are logically isolated.
Neutralizing active threats prevents lateral movement and protects the enterprise footprint.
5
Document Findings and Notify Analysts
The incident ticket is updated with execution logs and alerted to security analysts for review.
Proper documentation ensures compliance, tracking, and seamless handoff to human analysts if further investigation is needed.

Key Concept

SOAR Playbook Workflow Sequencing
Estimated Time:1m 30s
Question 118Question →

A incident response analyst is performing evidence collection on a live enterprise server following an intrusion alert. According to the Order of Volatility standard, in what sequence should the analyst acquire the evidence sources, ordered from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and L1/L2 cache memory, followed by System RAM and active ARP routing tables, then Local solid-state persistent disk storage, and lastly Off-site archival backup tapes.
Forensic evidence acquisition follows RFC 3227 Order of Volatility: CPU registers and cache (most volatile) -> System RAM and network cache -> Local persistent disk storage -> Off-site archival backup tapes (least volatile).

Step-by-Step Solution

1
Assess the volatility of processor-level data structures.
CPU registers and caches change at nanosecond speeds and clear immediately upon CPU halt.
Processor memory represents the highest volatility tier in digital forensics.
2
Assess the volatility of main memory and active state information.
System RAM and ARP/routing caches hold volatile dynamic runtime data.
This data remains intact only while power is continuously supplied to the host.
3
Assess the volatility of local secondary storage media.
Local SSD and magnetic drives hold non-volatile data files.
Disk contents persist on physical media even after host power is removed.
4
Assess the volatility of offline long-term archives.
Archival backup tapes contain static snapshot data.
Offline backup media changes least frequently and retains data indefinitely.

Key Concept

Order of Volatility (RFC 3227)
Question 119Question →

A security analyst is implementing an out-of-band security patch for a critical database cluster following the discovery of an actively exploited zero-day vulnerability. Arrange the following steps of the emergency patch management process in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for emergency patch deployment is: 1) Validate patch authenticity and execute sandbox testing in staging, 2) Submit an Emergency Change Request with a rollback plan, 3) Deploy the patch to the production database cluster, 4) Perform post-implementation vulnerability scanning and health checks, and 5) Update the CMDB and system security baseline image.
The standard emergency patch management lifecycle follows a strict sequence to balance urgent vulnerability mitigation with operational risk management. First, validating and testing the patch in an isolated sandbox ensures it does not destabilize the software ecosystem. Second, submitting an Emergency Change Request (ECR) with a rollback strategy maintains change control governance. Third, the patch is deployed to production systems once approved. Fourth, post-implementation vulnerability scans and service health checks confirm the flaw is resolved without side effects. Finally, updating the CMDB records and baseline images preserves configuration integrity and prevents drift during future node provisioning.

Step-by-Step Solution

1
Perform initial pre-deployment testing and signature verification in a non-production environment.
The patch is verified as genuine and free from breaking application dependencies.
Applying unverified patches directly to production risks outage or malware injection.
2
Obtain formal emergency authorization via Emergency Change Advisory Board (ECAB).
Authorized emergency change ticket with mandatory fallback/rollback procedures established.
Change control governance prevents unauthorized alterations and ensures back-out plans exist.
3
Execute the patch deployment across production nodes.
Production servers receive and install the patch binaries.
Implementation executes the authorized changes on live production systems.
4
Conduct post-deployment validation scans and monitoring.
Confirmation that the target flaw is remediated and no regression issues exist.
Integrity checks confirm successful threat mitigation before closing the incident ticket.
5
Reconcile configuration management records and baseline artifacts.
CMDB and golden image templates reflect the new version compliance standard.
Updating baselines prevents future automated provisioning from reverting systems to an unpatched state.

Key Concept

Emergency Patch and Configuration Management Lifecycle
Question 120Question →

An enterprise systems administrator is troubleshooting a Kerberos authentication issue in an Active Directory environment. Place the steps of the Kerberos ticket exchange process in the correct order from initial user login to final resource access.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with the client sending an AS-REQ with pre-authentication data to the KDC, followed by the KDC returning an AS-REP with the Ticket Granting Ticket (TGT). Next, the client submits a TGS-REQ containing the TGT and target SPN to the TGS, which responds with a TGS-REP containing the Service Ticket. Finally, the client presents the Service Ticket to the target application server.
Kerberos follows a strict authentication flow: First, the client initiates authentication with the Authentication Server via AS-REQ and receives a TGT via AS-REP. Next, the client uses the TGT to request a service-specific ticket from the TGS via TGS-REQ and receives the Service Ticket via TGS-REP. Finally, the client presents the Service Ticket directly to the target application server for resource access.

Step-by-Step Solution

1
Initiate Authentication (AS-REQ)
Client contacts the KDC's Authentication Server with encrypted timestamp data.
Initial proof of identity is required before any tickets can be issued.
2
Obtain TGT (AS-REP)
Client receives the Ticket Granting Ticket and session key.
The TGT proves authentication status for subsequent service requests.
3
Request Service Ticket (TGS-REQ)
Client sends the TGT and target SPN to the TGS.
The client requests permissions for a specific service using its existing TGT.
4
Receive Service Ticket (TGS-REP)
Client receives a ticket encrypted with the service account's secret key.
The TGS validates the client's authority and grants a ticket tailored to the destination service.
5
Authenticate to Application Server (AP-REQ)
Client presents the Service Ticket to the target application server.
The application server verifies the ticket and authorizes access without contacting the KDC directly.

Key Concept

Kerberos Authentication Exchange Process
PreviousPage 6 / 9Next
All practice questions — CompTIA Security+ | Examkin