Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1261Question →

A security analyst is implementing an incident response playbook following a confirmed unauthorized access event on an internal code repository server. Arrange the following incident response actions in the correct chronological sequence according to standard NIST SP 800-61 guidelines, from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: (1) Analyze SIEM event logs and system artifacts, (2) Revoke compromised credentials and isolate the affected server, (3) Re-image the repository server from a clean baseline, and (4) Document the incident timeline and update policies.
According to the NIST SP 800-61 incident response framework, the lifecycle follows a strict sequence: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity (Lessons Learned). Analyzing logs identifies the breach scope first, followed by isolating the server and revoking compromised credentials to contain the threat. Once contained, the server is re-imaged and restored during eradication and recovery. Finally, root-cause documentation and policy updates are conducted during post-incident lessons learned.

Step-by-Step Solution

1
Perform Detection and Analysis
Identify the vector of unauthorized access and determine affected scopes by analyzing log sources.
Before containing an incident, analysts must confirm the nature and extent of the threat.
2
Execute Containment
Halt lateral movement and exfiltration by isolating host systems and revoking compromised credentials.
Containment limits damage while preventing the attacker from maintaining active sessions.
3
Perform Eradication and Recovery
Re-image compromised systems with verified clean media and safely restore services.
Eradication removes threat components, while recovery restores systems to operational status safely.
4
Conduct Post-Incident Activity
Conduct a lessons learned review, create documentation, and implement preventative control updates.
Post-incident review helps improve future response capabilities and fixes systemic vulnerabilities.

Key Concept

NIST Incident Response Lifecycle Sequential Phases
Question 1262Question →

A Security Operations Center (SOC) analyst receives an EDR behavioral alert indicating an unauthorized persistence script running on an internal database host. In what order should the analyst execute the following actions to effectively contain, triage, and remediate the incident using EDR capabilities?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with isolating the endpoint network traffic, stopping active malicious processes, collecting volatile forensic data, conducting root-cause process tree analysis, and deploying enterprise-wide IOC block rules.
The standard incident response containment sequence for EDR workflow mandates immediate host-level network isolation (to stop lateral spread), followed by process termination (to stop active execution), volatile evidence capture (for forensics), root-cause analysis via process lineage telemetry, and enterprise policy updating (to enforce long-term mitigation).

Step-by-Step Solution

1
Isolate the compromised endpoint from the network via EDR.
Prevents lateral movement and C2 traffic while maintaining EDR management channels.
Containment is the primary objective upon identifying active endpoint compromised activity to limit blast radius.
2
Terminate malicious process lineage.
Stops ongoing execution of payload and persistence scripts.
Halting execution prevents further system alteration or memory dumping attempts.
3
Capture live memory and volatile forensic artifacts.
Gathers live memory dump and volatile state evidence.
Preserving volatile evidence prior to analysis ensures complete forensic coverage.
4
Perform root cause analysis using EDR telemetry.
Identifies initial execution vector and compromised user context.
Tracing process lineage reveals how the threat bypassed initial controls.
5
Distribute updated EDR policy rules and block lists enterprise-wide.
Enforces enterprise hardening against identified hashes and behavioral indicators.
Prevents identical attacks across other endpoints in the organization.

Key Concept

EDR Incident Containment and Investigation Lifecycle
Estimated Time:1m 30s
Question 1263Question →

A security analyst in a Security Operations Center (SOC) receives a high-severity telemetry alert on a database server containing highly sensitive customer data. Analysis of the process execution lineage reveals that an attacker successfully loaded a vulnerable signed kernel driver (BYOVD attack) to blind local auditing tools and disable host firewall rules, subsequently initiating outbound C2 connections over non-standard encrypted ports. Which of the following actions leveraging Endpoint Detection and Response (EDR) features should the analyst execute FIRST to contain the active breach while preserving forensic evidence?

Show answer & explanation

Answer: Apply host network isolation via the EDR management console while leaving the EDR agent communication channel intact.

Answer

The analyst should apply host network isolation via the EDR management console while preserving agent communication channels.
Applying host network isolation via the EDR console immediately blocks all incoming and outgoing network traffic at the host level while leaving the EDR control plane active. This isolates the threat, prevents lateral movement and exfiltration, and maintains volatile memory intact for incident investigation.

Step-by-Step Solution

1
Identify the immediate operational objective
Contain active adversary activity and prevent lateral movement or C2 exfiltration without destroying volatile memory.
Active adversary activity must be contained immediately before eradication or detailed investigation takes place.
2
Evaluate EDR containment mechanisms
EDR network isolation drops all non-essential endpoint traffic while preserving low-level EDR agent communications to the cloud/management console.
This allows incident responders to execute remote forensic triage and live response scripts without allowing the attacker to communicate outward or move laterally.
3
Select the optimal response action
Enforce host isolation via the EDR console.
Host isolation meets both containment and evidence preservation requirements.

Key Concept

EDR Host Isolation and Telemetry Containment
Question 1264Question →

An identity and access management administrator must execute the standard offboarding workflow upon an employee's immediate departure. Arrange the operational deprovisioning steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct deprovisioning sequence begins with verifying the HR notification, immediately revoking active SSO sessions and tokens, disabling the user account in directory services, stripping entitlements and reassigning data ownership, and finally archiving logs for compliance retention.
The correct sequence aligns with IAM operational best practices for offboarding: verifying authorization (HR notice), immediately revoking active sessions/tokens to stop ongoing access, disabling directory accounts to prevent new logins, revoking group entitlements and reassigning asset ownership, and finally archiving audit records for compliance.

Step-by-Step Solution

1
Verify termination notification
HR authorization confirmed
Authorized IAM operational workflows must be triggered by verified administrative input.
2
Revoke active sessions and tokens
Ongoing access terminated
Active tokens must be revoked first to prevent a user from continuing existing application sessions.
3
Disable root directory entry
New authentications blocked
Disabling the directory entry blocks new login attempts across all integrated domain services.
4
Strip group rights and transfer assets
Permissions cleared and ownership transferred
Removing entitlements cleans up access rights while asset transfer ensures business continuity.
5
Archive identity logs and metadata
Audit history retained securely
Final archiving preserves evidence and meets regulatory requirements.

Key Concept

Account Lifecycle Management and Offboarding Operations
Question 1265Question →

A security operations engineer is investigating an access issue where a newly provisioned systems administrator can successfully log in via SAML 2.0 Single Sign-On (SSO) to an enterprise cloud portal, but receives an HTTP 403 Forbidden error whenever attempting to open the database administration dashboard. The Identity Provider (IdP) SAML assertion log contains the following snippet:

xml
<saml:AttributeStatement>
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department">
<saml:AttributeValue>Database_Admins</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>

However, the dashboard Service Provider (SP) policy configuration requires an attribute claim key named `roles` with a value of `db-admin-access` to grant rights.

Which of the following identity and access management operational issues BEST describes the root cause of this access failure?

Show answer & explanation

Answer: Authentication succeeded at the Identity Provider, but authorization failed at the Service Provider due to a claim attribute mapping mismatch.

Answer

Authentication succeeded at the Identity Provider, but authorization failed at the Service Provider due to a claim attribute mapping mismatch.
In federated identity operations using SAML 2.0, authentication (verifying identity at the Identity Provider) and authorization (granting rights at the Service Provider) are distinct operations. The user successfully authenticated via SSO, but because the SAML assertion payload sent the attribute key 'department' instead of the SP's required claim key 'roles', the Service Provider could not map the user to the required authorization role, resulting in an HTTP 403 Forbidden response.

Step-by-Step Solution

1
Analyze the authentication log snippet from the Identity Provider (IdP).
The IdP log confirms successful SAML SSO authentication and demonstrates that the user identity was issued an attribute named 'department' with value 'Database_Admins'.
Verifying IdP logs confirms whether the authentication phase of AAA was completed.
2
Compare the IdP attribute payload against the Service Provider (SP) authorization requirements.
The SP expects a claim key of 'roles' with value 'db-admin-access', but receives 'department' with value 'Database_Admins'.
Authorization decisions depend on exact match of requested and configured claims.
3
Determine the operational root cause.
Authentication succeeded (who the user is), but authorization failed (what permissions the user has) due to mismatched SAML attribute mappings.
Distinguishing authentication from authorization highlights why valid user credentials can still result in HTTP 403 access denial.

Key Concept

Separation of Authentication and Authorization in SAML SSO Attribute Mapping
Question 1266Question →

Match each telemetry log snippet to the corresponding security event or attack vector.

Click a left item, then click its matching right item

Items

192.168.1.105 - - [27/Jul/2026:14:22:01] "GET /products.php?id=1%20UNION%20SELECT%201,username,password%20FROM%20users-- HTTP/1.1" 200 4521
Jul 27 14:25:03 auth-srv sshd[4102]: Failed password for root from 198.51.100.42 port 49152 ssh2 (repeated 150 times in 30s)
EventID: 4624, LogonType: 10, TargetUserName: Admin_svc, WorkstationName: DESKTOP-7K9L2, IpAddress: 203.0.113.15
Jul 27 14:30:12 fw-edge firewall: DENY TCP src=192.168.1.50 dst=10.0.0.5 dst_port=445 flags=SYN (threshold exceeded: 5000 pkts/sec)

Matches

Show answer & explanation

Answer

Log entry 1 matches SQL injection; Log entry 2 matches SSH brute-force; Log entry 3 matches RDP remote interactive logon; Log entry 4 matches SMB traffic burst scanning.
Each log archetype displays distinct key indicators: database commands inside HTTP query strings signify SQL injection; repeated rapid SSH password failures indicate brute-force login attempts; Event ID 4624 with LogonType 10 represents RDP remote logins; and high-volume blocked TCP 445 packets represent SMB scanning.

Step-by-Step Solution

1
Analyze web access log parameters
Identify HTTP query string containing 'UNION SELECT 1,username,password FROM users--', confirming SQL injection.
Web server logs capture HTTP parameters that expose malicious payload structures.
2
Inspect authentication server syslog entries
Identify 150 failed password attempts within 30 seconds for root over SSH.
High frequency of failed SSH logons points directly to automated brute-force attacks.
3
Evaluate Windows Event ID and LogonType attributes
Confirm EventID 4624 with LogonType 10 corresponds to Remote Desktop Protocol (RDP) sessions.
LogonType 10 specifically designates RemoteInteractive access in Windows Security event logs.
4
Review firewall drop rules and destination ports
Associate DENY TCP traffic targeting port 445 in high bursts with SMB port scanning or automated lateral movement probes.
TCP port 445 is utilized for Server Message Block (SMB) services.

Key Concept

SIEM Log Pattern Recognition and Event Analysis
Estimated Time:1m 30s
Question 1267Question →

A security engineer must execute a break-glass procedure to access a critical database server during an unannounced service disruption. Place the operational steps of the Privileged Access Management (PAM) emergency account lifecycle in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for the PAM break-glass account lifecycle is: Submit an emergency checkout request referencing the incident ticket ID -> Complete out-of-band MFA approval -> Obtain temporary credentials and perform emergency maintenance -> Check in the emergency account in the PAM portal -> Execute automated credential rotation and terminate residual sessions.
The correct sequence adheres to enterprise PAM operational controls: establishing audit tracking via ticket reference, verifying identity through out-of-band MFA, executing emergency work with checked-out credentials, formally checking in the account, and executing automated credential rotation with session invalidation to guarantee single-use policy enforcement.

Step-by-Step Solution

1
Initiate the emergency checkout request with ticket authorization.
The PAM vault logs the access intent with auditing details attached.
Establishing auditability and ticketing context must precede credential disclosure.
2
Authenticate via secondary out-of-band MFA.
The identity of the requesting administrator is verified.
Strong authentication prevents unauthorized break-glass credential releases.
3
Retrieve credential and conduct emergency remediation.
System maintenance is performed using the break-glass account.
Administrative tasks are executed only after successful authentication and checkout.
4
Check in the emergency account within the PAM portal.
The administrative window closes in the PAM tracking system.
Explicit check-in signals to the PAM solution that the account lifecycle controls should be triggered.
5
Automate password rotation and residual session termination.
The break-glass credential is replaced with a new random secret and open sessions are killed.
Automatic rotation ensures credentials used in emergency checkouts cannot be reused later.

Key Concept

Privileged Access Management (PAM) Break-Glass Account Lifecycle
Question 1268Question →

Match each Identity and Access Management (IAM) architectural component to its primary role within an access evaluation control framework.

Click a left item, then click its matching right item

Items

Policy Decision Point (PDP)
Policy Enforcement Point (PEP)
Policy Information Point (PIP)
Policy Administration Point (PAP)

Matches

Show answer & explanation

Answer

Policy Decision Point (PDP) matches authorization evaluation; Policy Enforcement Point (PEP) matches traffic interception and enforcement; Policy Information Point (PIP) matches contextual attribute retrieval; Policy Administration Point (PAP) matches policy creation and management.
In modern access control and Zero Trust architectures, access evaluation is divided across specialized functional entities. The Policy Decision Point (PDP) evaluates request parameters against access policies. The Policy Enforcement Point (PEP) enforces the resulting decision at network or application boundary gates. The Policy Information Point (PIP) supplies requisite contextual attributes (such as user attributes or threat telemetry) to the PDP. The Policy Administration Point (PAP) acts as the governance interface for policy creation and maintenance.

Step-by-Step Solution

1
Identify the component that computes authorization logic.
Policy Decision Point (PDP) is paired with evaluating access requests to issue decisions.
The PDP evaluates rules against subject and resource attributes to generate a permit or deny outcome.
2
Identify the gateway component sitting inline with traffic.
Policy Enforcement Point (PEP) is paired with intercepting requests and enforcing decisions.
The PEP acts as a gatekeeper that blocks or permits user access based on the PDP's determination.
3
Identify the entity responsible for supplying external context.
Policy Information Point (PIP) is paired with retrieving contextual attributes.
The PIP feeds environmental variables, user group memberships, and device compliance context into the evaluation engine.
4
Identify the administration interface for policy lifecycle management.
Policy Administration Point (PAP) is paired with creating and storing policy rules.
The PAP is the administrative system where security policies are authored and published.

Key Concept

IAM Architecture Control Points (PDP, PEP, PIP, PAP)
Question 1269Question →

A security operations team is configuring playbooks in a Security Orchestration, Automation, and Response (SOAR) platform to streamline incident triage and containment. Which of the following operational tasks are typically automated using SOAR playbooks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enriching incoming alert data by querying threat intelligence feeds via APIs; Executing API calls to perimeter firewalls to block malicious IP addresses

Answer

Enriching incoming alert data with threat intelligence feeds and automatically issuing API commands to firewalls for IP containment are standard SOAR playbook functions.
SOAR platforms excel at orchestrating tools and automating repetitive incident response workflows. Querying external threat intelligence services via API to enrich SIEM alerts accelerates triage without human intervention. Similarly, executing pre-approved containment commands—such as calling a firewall API to block a malicious IP address—dramatically reduces mean time to respond (MTTR).

Step-by-Step Solution

1
Identify the primary purpose of SOAR playbooks in security operations
SOAR playbooks automate repeatable triage, enrichment, and containment actions to reduce response times.
Automation focuses on programmatic tasks executed through integrations and APIs.
2
Evaluate each operational task against automated playbook capabilities
API queries to threat intelligence sources and automated API calls to firewalls to block IP addresses represent programmatic automation.
Strategic governance and structural network redesign require human decision-making and planning.

Key Concept

Security Automation and Orchestration (SOAR) Playbook Capabilities
Question 1270Question →

A Security Orchestration, Automation, and Response (SOAR) platform is configured with an automated containment playbook that ingests high-severity SIEM alerts indicating Kerberoasting attacks. Upon detecting rapid requests for Service Principal Name (SPN) tickets, the playbook automatically revokes all active Kerberos tgt tokens and disables the associated Active Directory account. During a night-shift database backup, a critical core service account triggers a false-positive alert, causing automated account suspension that results in an enterprise-wide application outage. Which playbook modification best mitigates the operational risk while maintaining automated threat response capabilities?

Show answer & explanation

Answer: Insert a conditional decision node into the playbook that verifies an asset criticality allowlist and routes critical service accounts to a human-in-the-loop (HITL) approval step before disabling the account.

Answer

Insert a conditional decision node into the playbook that verifies an asset criticality allowlist and routes critical service accounts to a human-in-the-loop (HITL) approval step before disabling the account.
Automated security response actions against critical operational assets carry severe risk of collateral damage. Introducing a conditional node based on asset tagging or allowlists allows the SOAR platform to apply immediate automated containment for standard endpoints while routing high-impact accounts (such as domain controllers or core service accounts) to a Human-in-the-Loop (HITL) manual approval step.

Step-by-Step Solution

1
Analyze the operational incident root cause.
Unconditional automated suspension of critical service accounts led to a major business service outage.
Fully automated containment without asset sensitivity context creates high operational availability risk.
2
Evaluate SOAR playbook optimization strategies.
Distinguish between non-critical user accounts (fully automated containment) and mission-critical service accounts (human-in-the-loop oversight).
Conditional branching allows security teams to maintain high-speed automation where safe, while enforcing mandatory analyst verification for high-impact infrastructure assets.
3
Select the appropriate control architecture.
Integrating an allowlist check and human approval workflow balances containment speed with operational resilience.
This directly mitigates accidental service disruption during false positives or routine automated operations.

Key Concept

SOAR Playbook Design and Human-in-the-Loop (HITL) Governance
Question 1271Question →

An incident response analyst is tasked with preserving digital evidence from a compromised application server during an active incident. In what sequence should the analyst perform the following forensic acquisition and custody actions to adhere strictly to the Order of Volatility and evidence handling protocols?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with capturing the most volatile artifacts (CPU registers and RAM), followed by dump files/swap space, then imaging non-volatile local storage, calculating cryptographic SHA-256 hashes of the images, and finally documenting the chain of custody log and sealing evidence.
Forensic evidence acquisition follows RFC 3227 guidelines: preserve the most volatile data first (CPU registers and main RAM), followed by temporary virtual memory (swap/pagefiles), non-volatile local disk storage, calculating cryptographic checksums (SHA-256) to establish baseline integrity, and completing the chain of custody log and physical tamper-evident sealing last.

Step-by-Step Solution

1
Capture volatile RAM and registers
Preserves ephemeral system memory contents before power down or overwrite
Adheres to the Order of Volatility by securing the most volatile evidence first.
2
Dump swap space and pagefile memory
Preserves temporary virtual memory pages mapped to disk
Swap file data updates dynamically and ranks higher in volatility than static secondary storage.
3
Perform bit-stream imaging of local disk storage
Creates an exact bit-for-bit duplicate of non-volatile storage via write-blocker
Disk storage is non-volatile and must be captured without modifying original data.
4
Generate SHA-256 cryptographic hashes
Establishes a unique mathematical fingerprint for all forensic disk images
Enables future verification of evidence integrity and protects against tampering allegations.
5
Fill out chain of custody documentation
Records complete transfer history, custody control, and physical tamper-evident sealing
Ensures legal admissibility in court by tracking physical ownership and integrity metadata.

Key Concept

Order of Volatility and Chain of Custody Evidence Handling
Estimated Time:1m 30s
Question 1272Question →

A Security Operations Center (SOC) team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to contain endpoints exhibiting active ransomware encryption behavior. During testing, an automated containment playbook executed on a Domain Controller following a false-positive detection, causing enterprise-wide service disruptions. Which modification to the SOAR playbook logic best balances rapid automated containment with operational risk management for critical infrastructure?

Show answer & explanation

Answer: Insert a conditional decision node that routes host isolation actions for critical asset tags to an analyst manual approval step while automatically isolating non-critical endpoints.

Answer

The correct modification is to insert a conditional decision node that routes host isolation actions for critical asset tags to an analyst manual approval step while automatically isolating non-critical endpoints.
The correct choice implements asset-aware conditional logic within the SOAR playbook. By checking asset tags prior to containment actions, non-critical endpoints can be isolated immediately at machine speed, whereas high-impact assets (such as Domain Controllers or core servers) require a human-in-the-loop approval step to verify the alert before taking disruptive isolation measures.

Step-by-Step Solution

1
Analyze the operational impact of unconstrained automation on critical infrastructure.
Identified that auto-isolating critical systems like Domain Controllers based on unverified triggers introduces unacceptable business outage risks.
SOAR playbooks must balance velocity of response with the operational risk of false positives.
2
Evaluate playbook decision logic modifications.
Adding contextual asset checks (e.g., checking asset tagging or CMDB data) enables granular workflows.
Criticality-aware playbooks can enforce different actions based on host importance.
3
Establish the optimal hybrid response mechanism.
Automate isolation for standard workstations and non-critical hosts, but gate isolation actions on critical servers behind human-in-the-loop analyst approval.
This maintains automated defense speed where acceptable while safeguarding enterprise availability.

Key Concept

SOAR Playbook Triage and Safe Automated Containment Logic
Question 1273Question →

A security operations team reviews the following event logs from an enterprise Identity and Access Management (IAM) environment during an incident post-mortem:

text
[2026-07-27 14:02:11] RADIUS_AUTH: User 'j_doe' authenticated via EAP-TLS from IP 192.168.10.45. Assigned Role: Tier-1 Helpdesk.
[2026-07-27 14:05:30] PAM_VAULT: User 'j_doe' requested emergency break-glass checkout for 'sa_db_admin'. Approval: Automated (Ticket #9842).
[2026-07-27 14:05:31] TACACS_CMD: User 'j_doe' (as 'sa_db_admin') executed privileged command 'GRANT ALL PRIVILEGES ON prod_db.* TO 'j_doe'@'%''.
[2026-07-27 14:15:00] PAM_VAULT: Emergency break-glass session expired for 'sa_db_admin'. Password rotated automatically in Vault.
[2026-07-27 14:30:12] DB_AUDIT: User 'j_doe' logged into 'prod_db' directly from IP 10.200.5.12 using personal credentials with persistent global privileges.

Which of the following operational control failures allowed the user to maintain unauthorized database access after the Privileged Access Management (PAM) session expired?

Show answer & explanation

Answer: The break-glass operational policy permitted interactive command execution that altered target database access control lists directly, establishing an out-of-band persistent entitlement.

Answer

The operational control failure occurred because the break-glass policy allowed interactive command execution that modified target database access control lists directly, creating an out-of-band persistent access path.
The correct answer identifies that the primary operational weakness was allowing unrestricted administrative command execution during a PAM break-glass session. When an administrative workflow lacks command blacklisting or change management integration, an operator can alter local access control lists (ACLs) to grant their unprivileged account persistent direct access. Even though the PAM system properly rotated the shared account credential upon expiration, the out-of-band permission modification on the database persisted.

Step-by-Step Solution

1
Analyze the log timeline and user actions during the PAM session.
At 14:05:31, while using the break-glass account 'sa_db_admin', user 'j_doe' executed a SQL command granting global privileges to their personal user account ('j_doe'@'%').
Identifying what actions were taken during elevated session access reveals how persistence was created.
2
Evaluate the state of the PAM vault session termination at 14:15:00.
The PAM vault successfully terminated the break-glass session and automatically rotated the password for 'sa_db_admin'.
This confirms that the vault software functioned as designed regarding credential lifecycle management.
3
Correlate post-expiration access at 14:30:12 with the changes made in Step 1.
The user authenticated successfully using their standard personal account ('j_doe') because the database permission grant persisted independently of the vault credential status.
Without command filtering or continuous identity reconciliation (least privilege/ABAC enforcement), vault session teardowns cannot clean up out-of-band access control changes made on target resources.

Key Concept

Identity and Access Management Operations - Privileged Access Management and Lifecycle Control Governance
Estimated Time:2m 0s
Question 1274Question →

A Security Operations Center (SOC) analyst is reviewing network intrusion detection system (NIDS) alerts monitoring an enterprise web application. The system generated an alert categorized as a Cross-Site Scripting (XSS) attempt after inspecting an HTTP request containing the payload `GET /login.php?user=admin' OR '1'='1'-- HTTP/1.1`. Which of the following best describes the analyst's evaluation of this alert?

Show answer & explanation

Answer: The alert is miscategorized because the payload represents a SQL injection attack attempting database query manipulation rather than client-side script execution.

Answer

The alert is miscategorized because the payload represents a SQL injection attack attempting database query manipulation rather than client-side script execution.
The string `user=admin' OR '1'='1'--` is a signature of SQL injection, which targets backend relational database queries. Cross-Site Scripting (XSS) involves injecting client-side scripts (such as JavaScript) executed by the browser. Because the NIDS rule flagged a SQL injection vector as XSS, the analyst correctly evaluates the alert as miscategorized.

Step-by-Step Solution

1
Examine the captured HTTP payload from the NIDS alert log snippet
Identified the query parameter payload `user=admin' OR '1'='1'--`.
Analyzing the specific payload characters is required to determine the true nature of the network activity.
2
Classify the payload type against attack vector definitions
Recognized `OR '1'='1'` as a database query manipulation string used in SQL injection attacks.
SQL injection targets database query syntax, while Cross-Site Scripting (XSS) relies on client-side script tags such as JavaScript.
3
Assess the NIDS rule mapping accuracy
Concluded that the monitoring signature mislabeled a backend SQL injection attempt as an XSS alert.
Accurate alert classification ensures correct incident handling and threat reporting.

Key Concept

Network Security Monitoring Alert Interpretation and Attack Classification
Question 1275Question →

A security administrator must evaluate an operational technology (OT) network supporting critical infrastructure. The administrator needs to identify missing operating system patches and open ports without running tests that could potentially disrupt operations or crash sensitive services. Which type of vulnerability scan should the administrator perform?

Show answer & explanation

Answer: A non-intrusive scan

Answer

A non-intrusive scan should be performed because it detects potential vulnerabilities without executing active exploit payloads or sending aggressive network traffic that could interrupt sensitive services.
Non-intrusive scanning identifies potential security weaknesses by checking host responses and software versions against known vulnerability signatures without executing invasive tests that could cause system failure.

Step-by-Step Solution

1
Analyze the scenario requirements and operational constraints
The target environment contains sensitive operational technology devices where service downtime must be avoided.
Critical infrastructure systems are often sensitive to aggressive network probes and active exploitation tests.
2
Evaluate scanning methodologies against safety criteria
Select a non-intrusive scan.
Non-intrusive scans gather version information and inspect configuration parameters safely without risking system instability.

Key Concept

Non-intrusive vs. Intrusive Vulnerability Scanning
Question 1276Question →

An electrical utility provider is deploying smart grid field concentrator units to unmonitored outdoor locations. The units will transmit sensitive metering telemetry and must be protected against physical tampering, unauthorized firmware manipulation, and key extraction. Which of the following hardware security controls should the security architect require for these embedded devices? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Implementation of a hardware Root of Trust combined with a Trusted Platform Module (TPM) to perform measured boot and secure cryptographic keys.; Integration of physical tamper detection sensors connected to active zeroization circuits to purge sensitive key material if the chassis is compromised.

Answer

The device security architecture must incorporate a hardware Root of Trust with a TPM for measured boot integrity, along with physical tamper detection sensors linked to zeroization circuits to clear cryptographic key material upon physical intrusion.
Establishing a hardware Root of Trust with a TPM guarantees firmware integrity through measured boot and protects cryptographic keys within dedicated secure hardware. Combining this with physical tamper detection and zeroization ensures that physical intrusion results in the immediate destruction of sensitive key material, effectively mitigating both software manipulation and physical extraction risks.

Step-by-Step Solution

1
Analyze deployment environment and threat vectors.
Identified risks including physical access, unauthorized firmware modification, and physical cryptographic key extraction on unmonitored field hardware.
Unmanned outdoor embedded infrastructure requires hardware-anchored security controls.
2
Evaluate controls for boot integrity and key isolation.
Hardware Root of Trust and TPM validate bootloader components sequentially and isolate cryptographic processes from software-layer exploits.
A TPM and hardware Root of Trust form the foundational trust anchor for verifying system integrity before executing system code.
3
Evaluate controls for physical enclosure breach.
Physical tamper detection switches linked to zeroization logic instantly wipe cryptographic keys if the outer casing is breached.
Zeroization ensures keys cannot be recovered via hardware bus probing or physical extraction once physical boundary defenses fail.

Key Concept

Hardware Root of Trust, TPM measured boot, and physical tamper zeroization mechanisms in embedded hardware security.
Question 1277Question →

An EDR agent installed on a critical workstation flags a suspicious process spawned by a administrative command tool attempting to inject code into a system process. The threat actor is actively attempting lateral movement across the internal segment. Which of the following capabilities of the EDR system should be utilized FIRST to contain the threat while preserving telemetry for investigation?

Show answer & explanation

Answer: Initiate network isolation of the host from the EDR management console to block peer-to-peer communication while maintaining agent connection.

Answer

Initiate network isolation of the host from the EDR management console to block peer-to-peer communication while maintaining agent connection.
Host network isolation capability in an EDR platform allows security operations teams to logically segment a compromised endpoint from all internal and external network resources instantly. The EDR agent maintains a dedicated communication channel to the cloud or on-premise EDR console, permitting analysts to collect forensic artifacts and execute remediation playbooks without risking lateral spread.

Step-by-Step Solution

1
Analyze the incident context
Identified an active endpoint compromise with live lateral movement risk.
Process injection and lateral movement require immediate containment at the host level.
2
Select the appropriate EDR feature
Chose host network isolation provided directly by the EDR agent.
Host isolation disconnects host-to-host connectivity to stop lateral spread while allowing SOC analysts to maintain remote management access.

Key Concept

Endpoint Containment and Host Isolation in EDR
Estimated Time:1m 30s
Question 1278Question →

A Security Operations Center (SOC) analyst receives an active EDR behavioral alert indicating that an unauthorized process executed `vssadmin.exe delete shadows /all /quiet` on an enterprise workstation and is actively attempting to encrypt files on connected SMB shares. Place the incident response actions in the correct chronological sequence to contain the threat and perform initial triage.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: 1) Initiate host-level network isolation through the EDR console, 2) Revoke active session tokens and disable compromised user account credentials, 3) Execute an EDR agent action to kill the malicious process tree and pull a volatile memory dump, and 4) Collect endpoint telemetry logs and sample payloads via EDR remote shell.
In EDR incident response, immediate containment takes precedence over investigation steps. Isolating the host via the EDR agent instantly restricts network connectivity and prevents lateral encryption across SMB shares without severing EDR console access. Next, revoking identity tokens prevents the attacker from using compromised credentials on other network hosts. Terminating the malicious process and capturing memory stops local damage and captures volatile evidence. Finally, collecting forensic logs enables root-cause analysis.

Step-by-Step Solution

1
Isolate the host at the network layer via EDR console.
The endpoint is restricted from communicating with the broader network and network shares, halting encryption of remote assets.
Host isolation is the immediate priority during active ransomware behavior to prevent lateral movement while preserving EDR agent control.
2
Disable compromised account credentials and revoke active domain tokens.
Stolen credentials cannot be reused elsewhere in the environment.
Threat actors often pivot to other hosts using compromised account tokens if credentials are not invalidated immediately following host containment.
3
Terminate the malicious process tree and capture volatile system memory.
Ransomware file encryption stops on the local endpoint, and volatile memory is captured for analysis.
Stopping active malicious processes prevents further local damage, and capturing RAM before rebooting preserves injects and cryptographic keys.
4
Extract forensic artifacts and telemetry logs via EDR remote management capabilities.
Responders gain access to event logs, drop files, and execution timestamps.
Detailed forensic triage allows analysts to determine the initial access vector and develop enterprise-wide detection rules.

Key Concept

EDR Incident Containment and Response Workflow
Estimated Time:2m 0s
Question 1279Question →

A security analyst is reviewing identity authentication logs and observes a user account successfully logging in from a corporate office in Chicago, followed by a second successful login using the same credentials from an IP address in London five minutes later. Which of the following operational security anomalies does this scenario best represent?

Show answer & explanation

Answer: Impossible travel indicating compromised credentials

Answer

Impossible travel indicating compromised credentials
The scenario describes an impossible travel anomaly, which occurs when authentications for the same identity are recorded from two distant geographic regions within a duration shorter than the physical travel time required. This is a primary detective operational indicator that an adversary has harvested or purchased user credentials.

Step-by-Step Solution

1
Analyze the timestamps and geographic locations provided in the log context.
The log entries record two successful authentications from Chicago and London occurring only five minutes apart.
Geographic distance between these cities cannot be traversed in five minutes by physical travel.
2
Correlate the log observation with standard IAM operational threat indicators.
Concurrent or near-simultaneous authentications from distant locations signify impossible travel, pointing to stolen user credentials.
Detecting impossible travel allows analysts to quickly flag and contain compromised user accounts.

Key Concept

Impossible Travel Anomaly Detection
Estimated Time:45s
Question 1280Question →

A Security Operations Center (SOC) analyst receives a high-fidelity alert indicating that an internal workstation in the payroll department is establishing outbound DNS tunneling sessions to an unknown external IP address. Investigating the endpoint reveals active memory-resident scripts attempting to stage sensitive file archives. According to standard incident response frameworks, which of the following actions should the analyst take first?

Show answer & explanation

Answer: Disconnect the affected workstation from the network segment to isolate it.

Answer

Disconnect the affected workstation from the network segment to isolate it.
The correct immediate action upon discovering an active threat communicating with an external malicious actor is containment. Disconnecting or network-isolating the affected workstation prevents ongoing data exfiltration and lateral spread without destroying volatile evidence stored in RAM.

Step-by-Step Solution

1
Identify the current phase of the incident response lifecycle.
The incident is actively occurring with live command-and-control DNS tunneling, placing it squarely in the Containment phase.
Before performing analysis, cleanup, or restoration, active threat activity and data exfiltration must be stopped immediately.
2
Select the appropriate containment tactic.
Network isolation of the workstation prevents outbound communication and halts exfiltration while keeping volatile memory intact for forensics.
Containment limits the scope of damage without prematurely altering system state required for investigation.

Key Concept

Incident Response Lifecycle - Containment Phase
PreviousPage 64 / 112Next
All practice questions — CompTIA Security+ | Examkin