Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 161Question →

A security analyst is setting up a Security Information and Event Management (SIEM) pipeline to process incoming telemetry from enterprise web application firewalls. Arrange the stages of the SIEM log processing workflow in the correct operational sequence, from initial data receipt to incident notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the SIEM log processing workflow is Log Collection, Parsing, Data Normalization, Event Correlation, and Alerting and Incident Generation.
The standard SIEM data pipeline follows a strict dependency hierarchy: Data must first be gathered (Collection), converted from raw text into structured attributes (Parsing), mapped to a single standard schema (Normalization), evaluated for multi-source indicators of compromise (Correlation), and finally communicated to security analysts when thresholds are breached (Alerting).

Step-by-Step Solution

1
Identify the initial ingestion mechanism
Log Collection is identified as position 1
Data must be transmitted from source devices and received by the SIEM before processing can begin.
2
Extract meaningful fields from the raw string payload
Parsing is identified as position 2
Unstructured log text must be split into readable key-value fields.
3
Standardize variable names and formats across heterogeneous sources
Data Normalization is identified as position 3
Different vendors use varying field labels; normalization creates a unified schema across all logs.
4
Compare normalized events across rule criteria and baselines
Event Correlation is identified as position 4
Correlation logic requires normalized data to associate events across multiple logs and devices.
5
Trigger SOC notification upon threat identification
Alerting and Incident Generation is identified as position 5
Alerting is the resulting action when correlation engine conditions are met.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Estimated Time:1m 30s
Question 162Question →

A Security Operations Center (SOC) analyst detects an active exfiltration attempt where an unauthorized external IP address is utilizing a compromised cloud API key to download sensitive data. Place the following incident response playbook actions in the correct sequential order from FIRST to LAST.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, revoke the compromised API key and block the malicious external IP address (Containment). Second, perform a forensic analysis of cloud audit logs to identify accessed resources (Analysis). Third, eliminate residual attacker access mechanisms and restore secure configurations (Eradication & Recovery). Fourth, conduct a post-incident lessons learned session (Post-Incident Activity).
The correct order follows the standard incident response process: initial Containment (revoking keys/blocking IPs to stop active loss), followed by Analysis (scoping exfiltrated files and attack footprint), Eradication & Recovery (removing persistence mechanisms and restoring secure configurations), and concluding with Post-Incident Activity (lessons learned and playbook updates).

Step-by-Step Solution

1
Implement Containment Controls
Ongoing data exfiltration is immediately halted, preventing additional loss.
Containment must occur first during an active exfiltration event to limit organizational damage.
2
Conduct Forensic Investigation and Analysis
The full scope of exfiltrated data and affected cloud infrastructure is identified.
Analyzing logs immediately post-containment ensures all compromised assets are accounted for.
3
Execute Eradication and System Recovery
Attacker persistence is removed and systems are safely restored to a baseline operational state.
Eradication removes root causes while recovery validates secure operational resumption.
4
Complete Post-Incident Review (Lessons Learned)
Documentation is finalized and IR playbooks/SOC detection logic are updated.
Lessons learned occur after operational restoration to ensure continuous security enhancement.

Key Concept

Incident Response Lifecycle Sequencing (NIST SP 800-61 / ISO 27035)
Estimated Time:1m 30s
Question 163Question →

A security analyst receives a high-priority alert from a perimeter Network Intrusion Detection System (NIDS) indicating anomalous, high-frequency outbound HTTPS connections from an internal host to an unrated external IP address. Place the operational monitoring and initial response steps in the correct chronological order from alert reception to formal escalation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order begins with validating raw network telemetry and packet captures to rule out false positives, followed by correlating network activity with host-level SIEM logs to verify compromise. Once verified, network isolation controls are applied to contain the threat, and finally, gathered IoCs are documented and escalated to the Incident Response team.
The triage workflow follows a logical progression: packet validation (confirming the network anomaly), host correlation (verifying execution and impact), endpoint containment (mitigating active threat risk), and incident escalation (handing over complete IoC artifacts).

Step-by-Step Solution

1
Inspect packet captures and NIDS telemetry associated with the alert.
Alert authenticity is confirmed and false positive possibilities are eliminated.
Initial triage must always verify that an alert reflects genuine anomalous behavior before initiating invasive containment actions.
2
Correlate network alerts with host process logs and EDR events in the SIEM.
Scope of host execution and impact is determined.
Network monitoring alerts provide transport-layer visibility, but host correlation is required to assess whether malicious execution took place.
3
Initiate network containment by isolating the endpoint.
Active outbound C2 sessions and potential lateral movement vectors are severed.
Containment limits damage once threat activity or active compromise is verified.
4
Compile forensic findings and escalate the incident ticket.
Incident response personnel receive complete contextual data for remediation.
Escalation occurs after immediate containment and initial documentation are finalized.

Key Concept

Network Security Monitoring Triage and Incident Containment Lifecycle
Question 164Question →

An enterprise security team plans to modify central authentication controls to enforce hardware-based multi-factor authentication across production subnets. To ensure operational continuity and minimize security risks, the team must follow the organization's formal change management process. Place the following change management steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with submitting a formal change request and security impact assessment, obtaining Change Advisory Board approval, conducting staging tests and rollback verification, executing the change during an authorized maintenance window, and concluding with post-implementation verification and CMDB updating.
Standard change management follows a structured lifecycle to control risk: documentation and impact assessment, formal approval by the Change Advisory Board, non-production staging and backout plan testing, scheduled production execution, and post-implementation auditing with baseline configuration updates.

Step-by-Step Solution

1
Identify the initial phase of formal change governance.
The change request and security impact assessment are drafted and submitted first.
A formal proposal detailing the scope, potential security vulnerabilities, and affected systems is mandatory before governance bodies can evaluate the risk.
2
Determine the required governance review and approval stage.
The change request is submitted to the Change Advisory Board (CAB) for approval.
The CAB must evaluate organizational impact, resource availability, and scheduling conflicts prior to technical execution.
3
Determine the pre-implementation risk mitigation stage.
The policy change is validated in a staging environment and the rollback procedure is tested.
Testing in non-production validates functionality and ensures a safe fallback mechanism exists before modifying production systems.
4
Identify the production implementation step.
The deployment is executed during the scheduled maintenance window.
Implementing changes during designated low-impact windows minimizes disruption to live operational business services.
5
Identify the final closure and baseline updating phase.
Post-implementation security testing is conducted and the CMDB baseline is updated.
Verifying production stability ensures security requirements are met, while updating the CMDB records the new operational baseline for compliance and auditing.

Key Concept

Change Management Lifecycle and Security Control Implementation
Question 165Question →

A network security analyst receives a SIEM alert indicating suspicious encrypted outbound traffic from an internal host to an untrusted external IP address. Place the following incident triage and network monitoring response actions in the correct chronological order, from initial alert confirmation to threat containment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for triage begins with broad NetFlow analysis to validate traffic volume, followed by inspecting detailed TLS session metadata, correlating extracted domain and IP indicators against threat intelligence, and finally executing host isolation and firewall containment.
The standard network security monitoring triage flow moves systematically from high-level flow anomaly verification to granular metadata extraction, intelligence correlation, and targeted active containment.

Step-by-Step Solution

1
Perform initial flow telemetry verification using NetFlow logs.
Confirms the existence of an anomalous connection and establishes baseline metric deviations (e.g., unusual port, long duration, high byte count).
Flow data provides rapid, low-overhead confirmation of network activity before performing deep inspection.
2
Analyze session-level proxy and TLS metadata.
Extracts contextual protocol artifacts such as SNI, TLS version, cipher suites, and destination domain names.
Granular session logs reveal specific protocol behaviors and identifying attributes embedded within the connection.
3
Correlate collected indicators with threat intelligence databases.
Determines whether the destination IP or domain is associated with known command-and-control (C2) infrastructure.
Threat intelligence matching provides context and verification regarding the intent and severity of the suspicious activity.
4
Apply containment and mitigation controls.
Blocks communication to the external address and prevents lateral movement by isolating the compromised internal device.
Remediation prevents data exfiltration and active C2 operations once threat maliciousness is confirmed.

Key Concept

Network Security Monitoring Triage Lifecycle
Question 166Question →

A security operations center (SOC) team is deploying a Security Orchestration, Automation, and Response (SOAR) playbook to handle automated containment when secret-scanning tools detect exposed API keys in public code repositories. In what sequence should the SOAR engine execute the following playbook steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution sequence is: 1) Ingest the alert payload from the secret-scanning API, 2) Query internal IAM and Asset Management APIs for enrichment, 3) Evaluate conditional decision logic for environment context, 4) Invoke the Cloud IAM API to invalidate the compromised key, and 5) Generate an ITSM ticket and dispatch notifications.
A standard SOAR playbook follows a structured workflow starting with event ingestion, followed by threat intelligence and identity enrichment to establish context. After enrichment, conditional logic determines the appropriate response path. Once conditions are satisfied, automated containment APIs execute to mitigate the threat immediately, followed by post-containment ticketing and team notifications.

Step-by-Step Solution

1
Trigger and Ingestion
The SOAR platform receives the alert payload containing the exposed credential metadata from the external repository monitor.
Execution cannot begin until the raw alert event and initial parameters are ingested by the orchestration tool.
2
Context Enrichment
The playbook queries internal systems to correlate the token string with internal identity records, environment tags, and privilege levels.
Raw alert tokens lack necessary business and technical context needed for safe, effective automated decision-making.
3
Conditional Evaluation
The playbook branch logic evaluates whether automated containment rules apply to the specific account and system environment.
Decision gates must evaluate enriched data before taking disruptive containment steps on live cloud infrastructure.
4
Automated Containment
The SOAR engine executes API integration scripts to revoke the exposed key and kill associated active sessions.
Neutralizing the active vector is the key containment objective once conditions and identity scope are validated.
5
Notification and Record Keeping
An incident record is created in the ticketing system and notifications are routed to the asset owner for manual key re-issuance.
Administrative documentation and human-in-the-loop follow-up tasks occur after successful automated threat containment.

Key Concept

SOAR Playbook Execution Lifecycle (Trigger -> Enrich -> Evaluate -> Contain -> Notify)
Question 167Question →

A network security monitoring (NSM) system triggers an automated alert indicating anomalous outbound TLS traffic from an enterprise host to an unrated external IP address. In what sequence should a network analyst execute the technical triage and mitigation workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with correlating NetFlow and SIEM logs to confirm host identity, followed by deploying firewall containment rules to halt active connections. Next, packet capture analysis is performed on the sensor data, and finally, custom NIPS signature rules are updated to prevent recurrence.
The standard network security monitoring operational workflow dictates starting with alert validation via NetFlow/SIEM correlation to confirm affected assets, applying immediate firewall containment to stop exfiltration, conducting deep PCAP analysis to extract threat indicators, and updating inline NIPS signatures for long-term prevention.

Step-by-Step Solution

1
Correlate NetFlow telemetry with SIEM logs.
Confirmed the alert validity and identified the specific source IP address involved.
Initial scoping establishes whether an alert represents a true positive and pinpoints affected assets.
2
Enforce network containment using perimeter firewall filtering.
Outbound sessions between the source host and suspicious IP are terminated.
Prompt containment minimizes security impact and stops potential exfiltration channels.
3
Perform full packet capture (PCAP) inspection.
Identified anomalous payload headers and session metadata.
Detailed protocol analysis uncovers threat details required for long-term defensive tuning.
4
Deploy updated NIPS signature definitions across sensor nodes.
Automated blocking capabilities are activated for the specific threat profile.
Converting payload indicators into detection signatures protects the enterprise against repeated attempts.

Key Concept

Network Security Monitoring Triage and Response Workflow
Estimated Time:2m 0s
Question 168Question →

An organization relies on end-user reporting to reduce human risk and mitigate phishing attacks. Place the following steps in the correct sequential order from initial end-user reporting to security awareness program escalation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with employee reporting, followed by automated threat verification, enterprise inbox purging, and updating security awareness training.
The correct sequence follows logical security lifecycle operations: end-user detection and reporting, technical analysis and verification, enterprise-wide technical containment, and continuous feedback into the security awareness training program.

Step-by-Step Solution

1
Identify the initial reporting action.
The employee recognizes suspicious email indicators and reports the email.
Reporting procedures start with end-user recognition and submission.
2
Determine the technical analysis stage.
Automated tools analyze and verify the reported payload.
Technical analysis must immediately validate the report before broader incident containment actions occur.
3
Identify the technical containment response.
Security operations purges matching messages from all user inboxes.
Containment prevents other employees from interacting with the active threat.
4
Identify the program improvement feedback loop.
The security awareness team updates ongoing training based on the real-world attack vector.
Continuous feedback closes the loop by improving future human risk resilience against real-world tactics.

Key Concept

Incident Reporting and Security Awareness Feedback Loop
Question 169Question →

A network security administrator is commissioning a new internal web application server that requires a trusted SSL/TLS certificate signed by the enterprise internal Certificate Authority (CA). Which of the following sequences represents the correct chronological order of steps the administrator must perform to obtain and deploy this certificate?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with generating the private/public key pair locally on the server, followed by creating the Certificate Signing Request (CSR) with identity details, submitting the CSR to the CA for verification and signing, and finally installing the signed certificate along with the intermediate CA trust chain on the server.
The proper PKI enrollment workflow begins by locally generating the asymmetric key pair on the web server to ensure private key protection. Next, a Certificate Signing Request (CSR) containing the public key and identity specifications (like SAN extensions) is created. This CSR is then submitted to the Certificate Authority (CA) for verification and signing. Finally, once signed, the certificate along with the intermediate CA certificates are installed on the server to enable valid TLS connections.

Step-by-Step Solution

1
Generate local key pair
Private key stays secret on the server while the public key is ready for submission
Security best practices dictate that private keys must be generated locally and never transmitted across the network.
2
Formulate the CSR
A CSR file formatted with public key data and Subject Alternative Name (SAN) extensions
The CSR provides the CA with the required server identity attributes and public key to be bound into the certificate.
3
Submit CSR to CA for signing
The CA validates request parameters and generates a signed public certificate
The CA asserts trust by appending its cryptographic signature using its private key.
4
Deploy certificate and intermediate chain
Web server is fully configured for TLS trust and handshakes
Installing both the server certificate and intermediate certificates ensures client browsers can validate the entire trust path to the root CA.

Key Concept

Public Key Infrastructure Certificate Lifecycle and Request Workflow
Question 170Question →

A network security analyst receives a high-severity alert from a Network Traffic Analysis (NTA) system regarding anomalous outbound encrypted communications originating from an internal workstation. Place the following incident triage and response steps in the correct sequential order from initial alert verification to containment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for triaging the network monitoring alert is: 1) Examine NetFlow data to confirm baseline deviation; 2) Inspect packet capture (PCAP) data to extract protocol metadata and destination IPs; 3) Query threat intelligence databases using extracted IP addresses to verify malicious activity; 4) Update firewall egress rules and place the host into a quarantine VLAN.
The standard security monitoring workflow dictates starting with broad alert validation (NetFlow baseline analysis), progressing to specific artifact extraction (PCAP inspection), contextualizing artifacts (threat intelligence correlation), and concluding with active mitigation (firewall blocking and VLAN quarantine).

Step-by-Step Solution

1
Verify initial alert validity using flow logs.
Confirmed baseline anomaly in traffic volume and session length.
Ensures the event is a true positive before dedicating technical resources to forensic capture analysis.
2
Perform full packet analysis on the flagged network stream.
Extracted destination IPs, port numbers, and TLS metadata artifacts.
Retrieves essential technical indicators required for threat identification.
3
Correlate collected indicators with reputational threat intelligence.
Confirmed destination IP belongs to known adversary Command and Control infrastructure.
Establishes threat severity and confirms the need for isolation controls.
4
Execute containment and isolation policies.
Blocked outbound connection attempts and isolated host from the internal network.
Prevents potential data exfiltration and halts lateral network movement.

Key Concept

Network Security Incident Triage and Response Workflow
Question 171Question →

A DevOps engineer is setting up a secure internal web endpoint for a microservice and needs to enroll it into the organization's Public Key Infrastructure (PKI). Which of the following represents the correct sequential order of operational steps required to successfully obtain and deploy an X.509 certificate, from initial key creation to final service binding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with local private key generation and CSR creation, followed by submitting the CSR to the CA for identity verification, receiving the CA-signed certificate, and concluding with importing the certificate and trust chain onto the web host.
The correct order follows the standard PKI lifecycle: local key generation and CSR creation must occur first, followed by CSR submission to the CA, CA signing/issuance using the CA's private key, and finally server binding with intermediate certificates included to establish the complete chain of trust.

Step-by-Step Solution

1
Generate asymmetric keys locally and form the CSR
A secure local private key is created along with a CSR holding the matching public key and Distinguished Name (DN) properties.
The private key must remain confidential on the server while the public key and identity data are prepared for validation.
2
Submit the CSR to the CA/RA
The CA receives the enrollment request and initiates verification checks.
The Certificate Authority must verify that the requester is authorized to claim the identity specified in the request.
3
CA signing and certificate issuance
An X.509 digital certificate is generated and signed with the CA's private key.
The CA's signature binds the host's public key to its identity, establishing trust for any client that trusts the CA.
4
Server binding and intermediate chain installation
The web service presents a complete certificate path to connecting clients.
Installing the host certificate and intermediate CA bundle ensures clients can validate the full trust path back to the trusted Root CA.

Key Concept

PKI Certificate Enrollment Lifecycle
Question 172Question →

An organization's security manager is implementing a human risk management campaign to address a high frequency of unattended, unlocked workstations observed during an internal audit. In what chronological order should the security manager execute the following phases of the campaign, from initial risk assessment to program evaluation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with performing a baseline compliance audit, followed by developing targeted microlearning modules, executing the training alongside technical controls, and concluding with follow-up audits to evaluate behavioral improvement.
A structured security awareness and human risk management framework follows a logical progression: assessment, design, deployment, and evaluation. Conducting a baseline audit establishes pre-intervention compliance levels. Designing targeted training materials directly addresses the vulnerabilities identified in the audit. Deploying the modules and technical controls applies the remediation, and performing unannounced post-training audits provides the quantitative data necessary to evaluate program efficacy against the baseline.

Step-by-Step Solution

1
Establish initial baseline metrics.
Gathers empirical data on non-compliance prior to taking corrective action.
Security awareness programs require pre-intervention metrics to measure training effectiveness accurately.
2
Design tailored security awareness content.
Creates focused instructional material tailored to the observed physical security gaps.
Educational content must be developed based on identified baseline weaknesses before deployment.
3
Deliver training and enforce technical safeguards.
Educates personnel while enforcing technical controls like automated screen timeouts.
Program deployment happens after awareness materials and technical policies are established.
4
Perform post-implementation evaluation.
Determines human risk reduction by comparing new audit figures to original baseline statistics.
Evaluating campaign efficacy requires comparing post-training operational data against initial baseline metrics.

Key Concept

Human Risk Mitigation Program Lifecycle
Estimated Time:1m 30s
Question 173Question →

An organization is updating its incident response playbooks to better integrate end-user security awareness reporting with human risk management oversight. Place the following operational steps in the correct chronological sequence from initial detection by an employee to the continuous improvement of the security awareness program.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with the employee reporting the suspicious message via the phishing button, followed by automated technical analysis of the email payload, enterprise-wide mailbox purging by the security operations team, and finally utilizing reporting metrics to update role-based security awareness scenarios.
The correct operational sequence moves from initial end-user detection and reporting, through automated analysis and SOC-driven enterprise containment, to utilizing telemetry to optimize the security awareness program.

Step-by-Step Solution

1
End-User Reporting
Suspicious email submitted to the incident triage queue
The incident reporting lifecycle begins when an employee recognizes a security anomaly and reports it.
2
Automated Technical Triage
Header analysis and payload detonation in a sandbox
Submitted artifacts must be analyzed automatically to verify malicious intent and extract indicators of compromise (IOCs).
3
Incident Containment
Global removal of identified malicious messages across all mailboxes
Confirmed threats must be remediated immediately across the enterprise mail environment to mitigate exposure.
4
Human Risk Telemetry & Program Adjustment
Refining security awareness simulations and role-based training based on real-world threat data
Telemetry from user reporting provides behavioral metrics to measure training efficacy and target ongoing risk management efforts.

Key Concept

Security Awareness Reporting Workflow and Human Risk Management
PreviousPage 9 / 9
All practice questions — CompTIA Security+ | Examkin