Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 241Question →

A security administrator wants to collect continuous host-level telemetry, such as process creation events, registry modifications, and network connections, to detect fileless malware and zero-day threats in real time across corporate workstations. Which of the following security solutions best fulfills this requirement?

Show answer & explanation

Answer: Endpoint Detection and Response (EDR)

Answer

Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) provides continuous monitoring and recording of host activity (such as process creation, memory utilization, and system modifications). This telemetry allows security teams to detect behavioral anomalies, fileless malware, and zero-day exploits that bypass signature-based tools.

Step-by-Step Solution

1
Identify the primary operational requirement.
The goal is to capture continuous host-level telemetry (process lineage, registry changes) to identify zero-day and fileless attacks.
Traditional network-level or signature-based security controls cannot observe local operating system behavioral events.
2
Evaluate the capabilities of host security controls.
Endpoint Detection and Response (EDR) installs an agent directly on endpoints to record real-time telemetry and perform behavioral threat detection.
EDR specifically fills the visibility gap left by legacy antivirus and perimeter network defenses.

Key Concept

Endpoint Detection and Response (EDR) Telemetry and Behavioral Detection
Question 242Question →

During an ongoing security breach, an Incident Response Team (IRT) identifies that an attacker has gained access to internal endpoints using harvested domain administrator credentials and is actively attempting lateral movement across enterprise network segments via pass-the-ticket techniques. Which of the following containment actions should the IRT execute IMMEDIATELY to stop ongoing lateral movement while preserving evidence integrity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Place affected endpoints into network quarantine VLANs or apply host-level isolation rules to block non-essential communications.; Reset compromised user credentials and force a double reset of the Kerberos Ticket Granting Service account (KRBTGT) password.

Answer

The incident response team should place affected endpoints into network quarantine or isolate them at the host level, and reset compromised credentials along with the Kerberos Ticket Granting Service account (KRBTGT) password.
During the containment phase of an incident response process involving Active Directory credential theft and lateral movement, the priority is stopping further adversary spread while maintaining evidence integrity. Network/host isolation prevents C2 traffic and lateral connections while keeping volatile memory intact for digital forensics. Resetting compromised domain credentials along with a double reset of the KRBTGT password invalidates stolen Kerberos tickets, preventing ongoing unauthorized authentication across the enterprise domain.

Step-by-Step Solution

1
Analyze the attack vector and phase requirements.
Identified pass-the-ticket lateral movement using valid domain admin credentials during the Containment phase of incident response.
Containment requires stopping adversary movement immediately without destroying evidence.
2
Select host and network-level containment controls.
Isolate affected hosts via software isolation or quarantine VLANs.
Host isolation stops lateral traffic while keeping the system powered on for RAM capture.
3
Select identity containment controls.
Reset compromised credentials and perform a double reset of the KRBTGT account password.
A double reset of KRBTGT invalidates both current and previous Kerberos Ticket Granting Tokens (TGTs), revoking adversary access across the domain.

Key Concept

NIST Incident Response Containment Strategy & Active Directory Attack Remediation
Question 243Question →

An incident response team is preparing to collect evidence from a physical storage drive recovered during an investigation. To ensure that the drive's contents cannot be altered or modified by the operating system while creating a forensic bit-stream image, which of the following tools should the technician use to connect the drive to the workstation?

Show answer & explanation

Answer: A hardware write-blocker

Answer

A hardware write-blocker should be used to intercept write commands and prevent modification of the target drive during evidence acquisition.
A hardware write-blocker is physically placed between the evidence drive and the forensic computer. It permits read requests (necessary to copy or image the drive) while dropping write requests, ensuring that the original evidence remains unchanged.

Step-by-Step Solution

1
Identify the primary risk during physical drive analysis.
Connecting a suspect drive directly to a forensic workstation can cause the operating system to write metadata or system files to the drive.
Any modification to the original drive invalidates the evidence.
2
Select the appropriate forensic hardware control.
Deploying a hardware write-blocker between the drive and the workstation allows read operations for imaging while blocking all write operations.
Write-blockers guarantee read-only access to preserve forensic integrity.

Key Concept

Write-blocker usage during forensic acquisition
Question 244Question →

During a physical security audit at a remote branch office, a security analyst discovers an unauthorized rogue wireless access point connected directly to a network switch port. The rogue device is broadcasting an unencrypted SSID and bridging external wireless traffic directly into the internal corporate network segment. According to standard incident response frameworks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Disable the specific physical switch port connected to the rogue device to isolate it from the internal network.

Answer

Disabling the specific physical switch port connected to the rogue device is the immediate first action to contain the security incident.
Upon discovering an active rogue access point connected to an internal switch, the immediate priority in the incident response process is Containment. Disabling the physical switch port isolates the rogue access point and halts unauthorized bridging into the corporate network.

Step-by-Step Solution

1
Identify the active phase of the incident response lifecycle.
The incident has been detected, requiring immediate containment to prevent further unauthorized network access.
Containment limits the scope and impact of an active breach before remediation or forensic steps begin.
2
Select the appropriate containment action for a rogue physical access point.
Shutting down the connected switch port isolates the rogue device at Layer 1/Layer 2.
Disabling the physical switch port immediately cuts off internal network access for bridged unauthorized wireless clients.

Key Concept

Incident Response Process - Containment Phase
Question 245Question →

Match each vulnerability scanning concept on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Credentialed Scan
Non-Credentialed Scan
Passive Scan
Intrusive Scan

Matches

Show answer & explanation

Answer

Credentialed Scan pairs with using administrative privileges for internal inspection; Non-Credentialed Scan pairs with probing target services without log-in credentials; Passive Scan pairs with observing network traffic without sending probes; Intrusive Scan pairs with executing active verification scripts that risk disrupting system stability.
Each scanning technique directly aligns with its specific operational characteristic: credentialed scans log in locally, non-credentialed scans probe externally without authentication, passive scans sniff network traffic without transmitting packets, and intrusive scans run verification checks that may disrupt target services.

Step-by-Step Solution

1
Evaluate authentication requirements for scanning modes.
Credentialed scanning requires valid system credentials for internal host access, whereas non-credentialed scanning operates without log-in access.
Privilege access determines whether the scanner inspects internal settings or external interfaces.
2
Evaluate traffic generation and system impact levels.
Passive scanning silently inspects passing network traffic without sending packets, while intrusive scanning sends active probes that can disrupt target services.
Operational safety dictates whether silent packet capture or active impact testing is appropriate.

Key Concept

Vulnerability assessment tools vary by privilege level (credentialed vs. non-credentialed) and network impact (passive vs. intrusive).
Question 246Question →

An enterprise Security Operations Center (SOC) detects abnormal outbound DNS traffic indicating potential data exfiltration via DNS tunneling from an internal host. Place the incident response actions in the correct chronological order according to standard NIST incident handling guidelines, starting from the initial response through completion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the standard NIST incident response lifecycle: Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. First, analyze DNS logs and SIEM alerts to verify the threat and scope. Second, apply firewall rules and isolate the compromised workstation to contain exfiltration. Third, terminate malicious processes and remove malware during the eradication phase. Finally, conduct a post-incident review and update playbooks during the lessons learned phase.
The correct order follows the standard NIST SP 800-61 incident response lifecycle. The response begins with Detection and Analysis to confirm the incident and identify affected systems, followed by Containment to halt active DNS exfiltration and network movement. Eradication and Recovery follow to clear malicious artifacts and restore clean state, concluding with Post-Incident Activity to document lessons learned and enhance detection rules.

Step-by-Step Solution

1
Perform Detection & Analysis
Identified the compromised host and verified active DNS tunneling exfiltration.
Accurate scope identification is required before technical remediation can begin.
2
Execute Containment
Blocked outbound tunneling traffic and network-isolated the workstation.
Prevents additional data leakage while preservation and eradication efforts are conducted.
3
Conduct Eradication & Recovery
Removed malicious exfiltration scripts and restored clean host operations.
Ensures the threat vector is completely eliminated before returning the host to normal production.
4
Complete Post-Incident Activity
Updated monitoring rules and documented lessons learned.
Improves security posture and operational playbooks against future DNS tunneling attempts.

Key Concept

Incident Response Lifecycle Phases (NIST SP 800-61)
Question 247Question →

An incident response team is conducting live digital evidence acquisition on a compromised enterprise gateway server suspected of hosting an active in-memory exploit. Based on the RFC 3227 standard Order of Volatility, in what sequence should the forensic investigator capture the following digital evidence components, starting from the most volatile to the least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition sequence from most volatile to least volatile is: Processor cache memory and CPU registers → System RAM → Temporary swap files and virtual memory paging files → Local NVMe solid-state drive partitions and event logs → Remote offsite archival tapes and cloud backup repositories.
Digital forensics follows RFC 3227 guidelines for the Order of Volatility, prioritizing data collection from the most perishable sources to the most stable. CPU registers and cache are updated continuously within nanoseconds and must be gathered first if live CPU state is required. Physical RAM comes next, containing active processes and network sockets that evaporate upon loss of power. Temporary swap files and pagefiles reside on disk but fluctuate frequently with virtual memory management, placing them third. Local NVMe non-volatile disk partitions persist across reboots and are collected fourth. Finally, remote offsite backups and archival tapes are long-term offline media, representing the least volatile evidence source.

Step-by-Step Solution

1
Identify the volatility level of CPU-bound data
Processor registers and cache are identified as operating at nanosecond speeds, making them the most perishable data on the target host.
Any execution change or system halt immediately alters CPU register states.
2
Assess volatile main system memory
System RAM is placed second because power loss or reboot flushes all in-memory structures and active connections.
RAM retains state only while continuous power is supplied to memory modules.
3
Evaluate disk-backed temporary storage
Temporary swap space and pagefiles are sequenced third.
While stored on secondary media, swap contents are continually updated by the OS virtual memory manager and can be overwritten quickly.
4
Sequence fixed persistent local storage
Local NVMe drive partitions are placed fourth.
Non-volatile storage persists data after power down and requires active deletion or wiping to alter contents.
5
Identify offline or remote archival media
Remote offsite archival tapes and cloud backups are placed last as the least volatile data.
Archival media and offsite backups are immutable or detached from live host operations, remaining stable over long periods.

Key Concept

Order of Volatility in Digital Forensics
Question 248Question →

A digital forensics analyst receives a seized external hard drive transported from a field office via a secure courier. Upon intake, the analyst notices that the tamper-evident transport bag was torn and the accompanying paper tracking form lacks the courier's transfer signature. Before connecting the drive to a hardware write-blocker for imaging, which of the following actions MUST the analyst perform first to maintain evidentiary standards?

Show answer & explanation

Answer: Document the seal discrepancy and missing signature on the chain of custody log, notify the lead investigator, and recalculate the intake verification hash.

Answer

Document the seal discrepancy and missing signature on the chain of custody log, notify the lead investigator, and recalculate the intake verification hash.
Chain of custody protocol dictates that any physical damage, missing signatures, or transfer anomalies must be explicitly recorded in the evidence tracking log. Logging the discrepancy immediately alongside re-verifying hash values ensures full transparency and legal defensibility when presenting evidence in court.

Step-by-Step Solution

1
Inspect the physical evidence packaging and custody documentation upon receipt.
Identified physical seal damage and missing transfer signatures on the tracking document.
Chain of custody requires continuous accounting of evidence handling, physical security, and custodian transfers.
2
Log all observed irregularities directly on the formal custody documentation and inform incident leadership.
Maintained an accurate, audit-ready record of potential transit compromise without concealing handling defects.
Failing to document physical tampering creates unexplainable gaps that invalidate evidence admissibility in legal proceedings.
3
Verify drive integrity against baseline cryptographic hash values logged prior to transit.
Determined whether data content was altered during transport.
Comparing hash values verifies data integrity despite physical package damage.

Key Concept

Chain of Custody Documentation and Evidence Intake Integrity Verification
Estimated Time:2m 0s
Question 249Question →

A security administrator is evaluating Endpoint Detection and Response (EDR) software to upgrade workstation security across an enterprise environment. Which of the following capabilities are primary features provided by EDR solutions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Continuous real-time telemetry monitoring of host processes, registry changes, and file activity; Automated host isolation capabilities to contain infected devices from the network

Answer

Endpoint Detection and Response (EDR) solutions primarily provide continuous host-level telemetry monitoring and automated response actions such as host network isolation.
The correct options highlight the core design of EDR: recording real-time host activity (such as process execution and file system modifications) and enabling automated containment actions (such as isolating an infected host from the network) to prevent lateral movement.

Step-by-Step Solution

1
Identify the primary scope of EDR solutions
EDR operates directly on host endpoints (workstations and servers) to provide visibility and response actions.
Understanding where EDR operates differentiates host capabilities from network boundary security controls.
2
Evaluate host telemetry and response features
Continuous monitoring of process execution, registry edits, and file changes alongside automated host isolation represent core EDR functions.
EDR moves beyond traditional static antivirus signatures by offering real-time behavioral monitoring and active threat containment.

Key Concept

Endpoint Detection and Response (EDR) Core Capabilities
Question 250Question →

An incident response team is performing live digital evidence acquisition on a compromised enterprise application server following a detected in-memory code injection attack. To ensure dynamic evidence is captured before it is lost or modified, the forensic investigator must collect data strictly according to the standard Order of Volatility. Place the following digital evidence sources in the correct order of acquisition, from MOST volatile (acquired first) to LEAST volatile (acquired last).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition sequence from most volatile to least volatile is: CPU registers and processor cache memory contents -> System RAM, active kernel process tables, and live ARP routing caches -> Temporary file system directories and virtual memory page/swap files -> Local persistent solid-state drive (SSD) system partitions -> Off-site optical backup media and long-term archival tape storage.
The standard Order of Volatility established by RFC 3227 and CompTIA Security+ requires capturing evidence in sequence from shortest lifespan to longest lifespan: 1) CPU registers and cache, 2) Main memory (RAM) and network caches, 3) Temporary file systems and virtual memory/swap space, 4) Non-volatile local disk partitions, and 5) Remote/offline archival backups.

Step-by-Step Solution

1
Identify the primary principle of live evidence acquisition.
Digital evidence must be acquired starting with data that disappears fastest (highest volatility) to preserve transient indicators of compromise.
The Order of Volatility (RFC 3227) dictates that dynamic hardware memory components take precedence over persistent block storage.
2
Evaluate hardware memory volatility.
CPU registers and cache update continuously at CPU clock speeds, followed by system RAM and live kernel network caches.
CPU states are lost instantaneously upon context switching or power loss, while RAM retains dynamic operational data only while powered.
3
Evaluate disk-backed temporary storage vs. persistent block storage.
Swap files and temp directories are prioritized before physical OS disk partitions.
Swap/page files act as extended volatile memory on disk and are rapidly overwritten during continuous system operation compared to static file structures on primary drive partitions.
4
Order long-term and offline storage media.
Local persistent SSD partitions precede offline optical media and backup tapes.
Offline backup media and archival tapes are disconnected, static, and immutable, giving them the lowest volatility of all evidence types.

Key Concept

Order of Volatility (RFC 3227)
Question 251Question →

During a routine audit, a Security Operations Center (SOC) analyst detects an unauthorized rogue wireless access point bridged directly into an isolated network segment containing sensitive customer databases. Forensic monitoring confirms that an external threat actor is actively exfiltrating live database traffic across this rogue wireless link. According to standard incident response lifecycle frameworks, which of the following actions should the incident response team perform FIRST?

Show answer & explanation

Answer: Disable the switch port connected to the rogue access point to isolate the wireless bridge and stop active data transfer.

Answer

Disable the switch port connected to the rogue access point to isolate the wireless bridge and stop active data transfer.
According to NIST SP 800-61 and ISO/IEC 27035 frameworks, once an active breach with exfiltration is detected, the immediate priority is Containment. Disabling the physical switch port stops ongoing exfiltration over the rogue wireless bridge without altering volatile memory on the target database servers.

Step-by-Step Solution

1
Identify the current phase of the incident response lifecycle.
The incident is actively occurring with ongoing data exfiltration, placing it in the Containment, Eradication, and Recovery phase (specifically requiring immediate containment).
Before root-cause elimination or recovery can begin, active exfiltration must be halted to limit damage.
2
Select the immediate containment control.
Disabling the physical switch port supporting the rogue access point immediately isolates the unauthorized device from the internal network.
Network link suppression isolates the attacker's exfiltration pathway while preserving volatile memory and system logs on the database server for forensic analysis.

Key Concept

Incident Response Lifecycle - Containment Strategy
Estimated Time:2m 0s
Question 252Question →

A cybersecurity analyst is investigating an active fileless malware infection on a host machine operating multiple virtualized enterprise services. The analyst must capture digital evidence in strict compliance with the Order of Volatility while maintaining chain of custody standards for legal admissibility. Which of the following procedures should the analyst execute FIRST?

Show answer & explanation

Answer: Capture the host system's volatile physical memory (RAM) over a secure network stream to an external forensic destination before creating VM snapshots or modifying system power states.

Answer

The analyst should capture the host system's volatile physical memory (RAM) over a secure network stream to an external forensic destination before creating VM snapshots or modifying system power states.
According to the forensic Order of Volatility, volatile data such as CPU registers, cache, and RAM must be collected before less volatile data like hard drives or archived logs. In a live investigation involving fileless malware, capturing system RAM prior to any state change (such as taking snapshots or pulling plug power) ensures that critical volatile evidence is preserved intact.

Step-by-Step Solution

1
Identify the Order of Volatility for digital evidence acquisition.
System memory (RAM), CPU cache, and active network connections are classified as most volatile and must be captured before non-volatile storage or power state changes.
Fileless malware resides entirely within volatile system memory and will be permanently lost if the machine is powered off or modified.
2
Evaluate the impact of hypervisor snapshots or disk imaging prior to memory dump.
Hypervisor snapshots alter physical disk state and write active memory pages to disk files, contaminating the original evidence.
Live memory dumps must occur before disk modifications to maintain forensic purity.
3
Execute volatile memory capture while logging cryptographic hashes for chain of custody.
RAM contents are safely acquired for analysis without destroying transient evidence.
Preserves both evidentiary admissibility and critical malware runtime context.

Key Concept

Order of Volatility and Live Forensic Evidence Acquisition
Estimated Time:2m 0s
Question 253Question →

A security analyst receives a high-fidelity Endpoint Detection and Response (EDR) alert indicating that a web service process on a critical Linux server is executing unauthorized shell commands and attempting outbound command-and-control communications. The analyst must contain the threat immediately to prevent lateral movement while preserving volatile memory and maintaining an administrative management channel to the host. Which of the following is the most appropriate action to take using the EDR console?

Show answer & explanation

Answer: Execute host isolation to restrict network traffic while maintaining the EDR management agent connection.

Answer

Execute host isolation to restrict network traffic while maintaining the EDR management agent connection.
Executing host isolation via the EDR platform selectively blocks network traffic at the endpoint level while keeping the secure agent-to-console communications channel open. This isolates the compromised system from internal and external network assets to prevent lateral movement, while preserving volatile memory (RAM) and allowing security analysts to conduct remote containment and investigation actions.

Step-by-Step Solution

1
Identify the primary operational requirement based on the incident scenario.
The requirement is immediate active containment of malicious C2 communication and lateral movement on an endpoint without destroying volatile memory or losing analyst control.
Incident response containment actions must prioritize stopping attack spread while preserving forensic evidence.
2
Evaluate the native containment capabilities of Endpoint Detection and Response (EDR) platforms.
EDR host isolation segregates the endpoint software network stack at the kernel/agent level, allowing only EDR agent telemetry and control traffic to pass back to the management platform.
Host network isolation immediately cuts off attacker C2 channels and lateral probing without powering down the host or altering volatile memory state.
3
Compare host network isolation against alternative actions such as perimeter blocking, rebooting, or signature scanning.
Perimeter firewalls do not stop internal lateral movement, rebooting destroys volatile RAM evidence, and legacy AV scans do not actively isolate the compromised network socket.
Host isolation via the EDR console is the only action that fulfills all scenario requirements.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Question 254Question →

A digital forensics investigator is preparing to capture a bit-stream copy of a seized hard drive recovered from an employee's computer during an insider threat investigation. To ensure that the physical drive's original data remains unmodified and that the acquired evidence is legally admissible, which of the following procedures must the investigator implement prior to starting the imaging process?

Show answer & explanation

Answer: Connect the target hard drive through a hardware write-blocker and calculate an initial cryptographic hash value.

Answer

Connect the target hard drive through a hardware write-blocker and calculate an initial cryptographic hash value.
Connecting the evidence drive through a hardware write-blocker guarantees that no write commands reach the physical disk during acquisition. Computing an initial cryptographic hash (such as SHA-256) before and immediately after imaging proves that the image is a bit-for-bit identical duplicate of the original drive without modification.

Step-by-Step Solution

1
Isolate the evidence disk
Prevents unauthorized access or network interaction.
Ensures the drive is handled in a controlled forensic environment.
2
Attach a hardware write-blocker to the drive controller interface
Blocks write signals from the forensic workstation controller.
Protects the evidence from accidental modifications, timestamp updates, or operating system writes.
3
Generate an initial cryptographic hash (e.g., SHA-256) of the original drive
Creates a baseline hash digest value.
Establishes a verifiable integrity baseline to compare against forensic disk images.

Key Concept

Digital Forensics Evidence Acquisition Integrity and Write Protection
Question 255Question →

A Security Operations Center (SOC) team receives an automated alert generated by their Security Information and Event Management (SIEM) system regarding suspicious outbound traffic from host IP 10.10.4.15. The team pulls the following correlated telemetry logs:

[Sysmon Event ID 22 - DNS Query]
ProcessImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
QueryName: aW50ZXJuYWwtZGF0YS0wMQ.exfil.attacker-domain.com
QueryStatus: 0 (SUCCESS)

[Perimeter Firewall Egress Log]
SrcIP: 10.10.4.15 | DstIP: 198.51.100.45 | DstPort: 53 | Protocol: UDP | Action: ALLOWED | BytesSent: 1420

[SIEM Correlation Engine Alert]
Rule_ID: RULE_DNS_HIGH_ENTROPY_SUBDOMAINS
Condition: Count(DNS_Query) > 500 per 60 seconds targeting unique high-entropy subdomains of a single domain.

Based on the log telemetry and correlation rule output, which of the following best identifies the active attack vector and the underlying operational reason it bypassed initial perimeter controls?

Show answer & explanation

Answer: DNS tunneling data exfiltration, which exploited uninspected outbound UDP port 53 traffic permitted for domain name resolution.

Answer

DNS tunneling data exfiltration, which exploited uninspected outbound UDP port 53 traffic permitted for domain name resolution.
The correct answer identifies DNS tunneling data exfiltration. The telemetry clearly demonstrates a script (PowerShell) emitting high-frequency DNS queries featuring encoded strings in the subdomain section to an external attacker-controlled domain. Outbound UDP port 53 is commonly left open for host name resolution, which allowed the exfiltration channel to operate until flagged by the SIEM's entropy-based correlation rule.

Step-by-Step Solution

1
Analyze the process and query parameters in the Sysmon Event ID 22 log entry.
Identified PowerShell executing DNS lookups against encoded strings embedded as subdomains (e.g., 'aW50ZXJuYWwtZGF0YS0wMQ.exfil.attacker-domain.com').
Attackers encode stolen binary or text data into DNS queries to bypass standard payload inspection.
2
Examine the firewall log and SIEM correlation rule trigger.
Confirmed that outbound UDP port 53 traffic from host 10.10.4.15 was allowed, and the SIEM recorded >500 high-entropy subdomain requests per minute.
Firewalls often allow outbound DNS traffic (port 53 UDP) implicitly for operational lookup capability, enabling DNS tunneling exfiltration if outbound queries are not restricted to internal recursive resolvers.
3
Synthesize the indicators to confirm the threat vector.
Matched high-frequency encoded subdomain queries over UDP port 53 with DNS tunneling for exfiltration.
The payload pattern and network path match DNS protocol misuse rather than web application attacks or authentication failures.

Key Concept

DNS Tunneling and Log Correlation
Question 256Question →

During an ongoing incident investigation, a security analyst detects that an unauthorized rogue laptop is actively transmitting encrypted data across an internal enterprise network. According to standard incident response frameworks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Disconnect the rogue laptop from the network to contain the incident.

Answer

Disconnect the rogue laptop from the network to contain the incident.
Disconnecting the rogue laptop immediately contains the threat by severing active network communication, preventing further unauthorized data exfiltration in accordance with standard incident response lifecycle guidelines.

Step-by-Step Solution

1
Identify the current phase of the incident response process based on the scenario.
An active threat (rogue device transmitting data) has been detected, requiring immediate containment.
Containment limits the damage of an ongoing incident and prevents further unauthorized data transmission.
2
Select the action that corresponds to the containment phase.
Disconnecting or isolating the unauthorized device stops active communication immediately.
Containment must occur prior to performing eradication, recovery, or post-incident review.

Key Concept

Incident Response Lifecycle - Containment Phase
Question 257Question →

A security engineer is conducting vulnerability scans across an enterprise hybrid cloud environment. During network-based authenticated scans of Linux server instances, the scanner continuously reports multiple critical vulnerabilities for outdated software packages. However, system administrators confirm that vendor-specific security patches were already installed via package management backporting, which updates internal code without changing upstream major version strings. Furthermore, the network scans consistently fail to capture vulnerabilities on ephemeral, short-lived container instances deployed during peak auto-scaling events. Which of the following vulnerability assessment approaches should the security engineer implement to eliminate these false positives and ensure continuous visibility into short-lived instances?

Show answer & explanation

Answer: Deploy agent-based vulnerability scanning software directly onto the host images.

Answer

Deploying agent-based vulnerability scanning software directly onto host images.
Deploying local scanning agents on host images ensures direct access to system package databases (such as RPM or DPKG), allowing the scanner to verify backported security fixes accurately without relying on misleading network version banners. Agents also initialize automatically when auto-scaled or ephemeral containers boot up, guaranteeing visibility during short lifespans.

Step-by-Step Solution

1
Analyze the core limitations of the current network-based vulnerability scanning methodology.
Network-based scanners often rely on version banners retrieved via remote services, leading to false positives when enterprise Linux distributions backport security fixes without changing version numbers. Network scans also miss ephemeral hosts that terminate before scheduled scan windows.
Identifying why false positives occur and why short-lived assets are missed is necessary to select the proper scanning architecture.
2
Evaluate how agent-based scanning addresses local software inventory and ephemeral infrastructure.
Local agents query local package management databases directly, recognizing backported fixes accurately. Additionally, agents register immediately upon instance launch, providing instant visibility into short-lived workloads.
Agent-based deployment solves both the backporting false-positive issue and the ephemeral asset tracking challenge.

Key Concept

Agent-based vs. Network-based Vulnerability Scanning
Estimated Time:2m 0s
Question 258Question →

A security analyst notices suspicious process execution on a financial department workstation during an active malware outbreak. To immediately block the workstation's network communication with other internal systems while preserving the security team's remote telemetry and control channel, which of the following is the most appropriate action to take?

Show answer & explanation

Answer: Perform a network host isolation action through the EDR console

Answer

Perform a network host isolation action through the EDR console
Executing a host isolation feature via an EDR platform severs all network traffic to and from the targeted workstation except for the encrypted connection between the EDR agent and its management console. This effectively stops lateral movement while enabling continuous incident investigation.

Step-by-Step Solution

1
Identify the primary operational requirement during containment
The goal is to stop lateral movement across internal systems while keeping host telemetry and remote management functional.
Containment must block malicious network traffic without losing control over the compromised endpoint.
2
Evaluate Endpoint Detection and Response (EDR) host isolation capabilities
EDR agents can isolate the endpoint software-wise, restricting network adapters to communicate only with the EDR management console.
This prevents lateral spread while allowing analysts to inspect memory, terminate processes, and gather telemetry.

Key Concept

Endpoint Network Isolation
Question 259Question →

A Security Operations Center (SOC) analyst is reviewing raw telemetry in a SIEM console containing the following event logs from an internal DNS resolver and perimeter firewall:

2026-07-27T14:10:02Z dns-resolver named[2104]: query: 61646d696e2d70617373776f7264.exfil.external-badactor.net IN TXT + (10.0.4.15)
2026-07-27T14:10:05Z dns-resolver named[2104]: query: 636f6e666964656e7469616c3132.exfil.external-badactor.net IN TXT + (10.0.4.15)
2026-07-27T14:10:08Z perimeter-fw kernel: [DENY] SRC=10.0.4.15 DST=203.0.113.50 PROTO=TCP SPT=49210 DPT=443 SIG=DIRECT_OUTBOUND_RESTRICTED

Based on these correlated log entries, which of the following security findings are accurate? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Host 10.0.4.15 is using DNS tunneling via hex-encoded subdomains in TXT record queries to exfiltrate data.; Direct outbound TCP traffic on port 443 from host 10.0.4.15 to IP address 203.0.113.50 was explicitly dropped by the perimeter firewall.

Answer

Host 10.0.4.15 is using DNS tunneling via hex-encoded subdomains in TXT record queries to exfiltrate data, and direct outbound TCP traffic on port 443 from host 10.0.4.15 to IP address 203.0.113.50 was explicitly dropped by the perimeter firewall.
The correct findings identify DNS tunneling via hex-encoded subdomain queries for TXT records originating from host 10.0.4.15, as well as the perimeter firewall explicitly blocking direct outbound TCP port 443 traffic from that same host to IP 203.0.113.50.

Step-by-Step Solution

1
Analyze the DNS resolver log entries.
Identified high-entropy hex strings ('61646d696e...' and '636f6e6669...') prepended to query requests sent to 'exfil.external-badactor.net' via TXT records from source host 10.0.4.15.
Attackers frequently encode stolen data into DNS subdomain requests (DNS tunneling) to bypass standard perimeter inspection.
2
Analyze the perimeter firewall log entry.
Identified a '[DENY]' event for TCP traffic sourced from 10.0.4.15 trying to reach external IP 203.0.113.50 on port 443.
Firewall logs explicitly report packet filtering decisions (ALLOW/DENY/DROP) along with layer 3/4 headers.
3
Synthesize the correlated findings.
Confirmed DNS tunneling exfiltration attempts and verified that direct HTTPS connections from the internal host to the external IP address were blocked by firewall policy.
Correlating telemetry across network controls confirms both successful protocol abuse (DNS) and blocked direct channel attempts.

Key Concept

DNS Tunneling Detection and Firewall Telemetry Analysis
Question 260Question →

A security analyst receives a high-severity EDR alert indicating a fileless process injection attack targeting a critical server. To mitigate lateral movement, preserve evidence, and remediate the incident, the analyst must follow a structured EDR incident response workflow. In what order should the analyst perform the following response actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of EDR response actions is: 1) Apply host-level network isolation via the EDR agent while preserving console communication channels, 2) Acquire volatile memory artifacts and process dumps from the endpoint, 3) Run automated remediation playbooks to terminate malicious process trees and remove persistence mechanisms, and 4) Distribute newly extracted Indicators of Compromise (IoCs) to global EDR detection rules.
The proper EDR response workflow prioritizes immediate containment (host network isolation) to stop lateral movement, followed by volatile evidence acquisition (RAM/process dumps) before evidence is destroyed. Once evidence is preserved, active remediation (killing process trees and persistence) is executed. Finally, threat intelligence gained from the incident (IoCs) is deployed globally across all endpoint policies to prevent broader exploitation.

Step-by-Step Solution

1
Isolate the compromised endpoint from the network.
Lateral movement vectors are immediately severed while EDR agent communication remains online.
Containing the threat prevents lateral propagation and reduces enterprise risk before further investigation.
2
Capture volatile RAM and endpoint process telemetry.
Transient forensic artifacts (e.g., injected code in memory) are preserved for analysis.
Terminating processes prior to memory capture destroys critical fileless forensic evidence.
3
Execute remediation playbooks to kill malicious processes and clean persistence.
The active threat components on the host are stopped and eradicated.
Host remediation ensures the attacker can no longer execute commands or maintain access on the system.
4
Update central EDR detection policies with extracted IoCs.
The entire fleet is protected against identical attack vectors across the enterprise.
Post-incident hardening ensures enterprise-wide protection using newly gathered threat intelligence.

Key Concept

EDR Incident Containment, Forensic Acquisition, and Remediation Workflow
PreviousPage 13 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 13 | Examkin