Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 261Question →

An incident response team is performing live evidence collection on an enterprise web application server following a detected code injection attack. To preserve forensic integrity, in what sequence should the analyst collect the following data sources, ordered from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU cache and register contents, System RAM and ARP cache, Swap file and pagefile data, Local solid-state drive (SSD) image, and Offsite backup tapes and archival media.
Digital evidence acquisition must adhere strictly to the Order of Volatility (RFC 3227). Data must be collected starting with the most short-lived and fragile sources: CPU registers/cache first, followed by RAM/routing tables, swap files, local persistent disks, and lastly offline archival media.

Step-by-Step Solution

1
Identify the standard forensic Order of Volatility principles (RFC 3227).
Recognized that evidence acquisition must prioritize data sources based on how quickly they can be lost or altered.
Capturing highly perishable data first prevents essential evidence from being overwritten during operational steps.
2
Rank CPU registers and cache as the top priority.
Placed CPU cache and register contents in position 1.
CPU cache registers operate at nanosecond speeds and clear or overwrite continuously.
3
Rank System RAM and network routing/ARP tables as second priority.
Placed System RAM and ARP cache in position 2.
RAM contains live system memory and active connection states lost as soon as power is cut.
4
Rank temporary virtual memory and swap/pagefile data as third priority.
Placed Swap file and pagefile data in position 3.
Although written to storage media, swap files change rapidly as operating system virtual memory pages.
5
Rank persistent local storage and offsite archives in the remaining final positions.
Placed local SSD image in position 4 and offsite backup tapes in position 5.
Non-volatile disk drives and offline archives maintain persistence over extended time frames.

Key Concept

Order of Volatility
Question 262Question →

A security analyst monitoring session logs observes multiple concurrent active sessions originating from different geographic regions for a single administrative account on an enterprise cloud portal, indicating active session hijacking. According to standard incident response playbooks, which of the following actions should the team perform immediately as part of the containment phase? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke all active session tokens and force a credential reset for the compromised account across the identity provider.; Apply network egress filters to block communication between internal systems and the adversary's IP address.

Answer

The containment phase requires immediately invalidating compromised active session tokens via the identity provider and enforcing perimeter IP blocking against the adversary's infrastructure.
Invalidating hijacked session tokens and placing block rules against adversary IP addresses directly stop active unauthorized access, fulfilling the primary goal of the containment phase.

Step-by-Step Solution

1
Identify the primary objectives of the containment phase in incident response.
The main objective of containment is to stop the spread of the attack and prevent the threat actor from maintaining active access without altering persistent server configurations prematurely.
Containment limits damage to enterprise systems while preserving system state for investigative analysis.
2
Evaluate the immediate containment measures for session hijacking.
Revoking active session tokens terminates the attacker's unauthorized session, and blocking adversary IP addresses prevents immediate re-entry.
These actions directly neutralize the active vector of exploitation without skipping ahead to eradication or recovery phases.

Key Concept

Incident Response Containment Phase Actions
Estimated Time:1m 30s
Question 263Question →

A security analyst detects suspicious fileless PowerShell execution on an enterprise workstation. The analyst needs to use Endpoint Detection and Response (EDR) capabilities to respond to the incident effectively while maintaining investigation capability. Which of the following response actions are primary capabilities provided directly by an EDR platform in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolating the host from the network logically while maintaining an active agent management channel for remote investigation; Capturing real-time host telemetry including process lineage trees, parent-child relationships, and command-line arguments

Answer

The primary EDR capabilities in this scenario are isolating the host from the network while maintaining an administrative agent channel, and collecting continuous host telemetry including process lineage trees and command-line arguments.
Endpoint Detection and Response (EDR) provides granular host isolation to contain suspicious activity without severing the security team's remote management channel. Additionally, EDR continuously collects behavioral telemetry, such as process execution trees and command-line arguments, which allows security analysts to reconstruct attack chains during fileless execution scenarios.

Step-by-Step Solution

1
Evaluate containment actions available at the endpoint level.
Host network isolation severs lateral network access without killing the EDR agent connection.
This prevents threat propagation while allowing ongoing remote forensic investigation.
2
Evaluate threat detection and analytical capabilities of EDR.
Process lineage tree tracking records execution arguments and parent process origins.
This telemetry exposes malicious activity that circumvents traditional static file signatures.

Key Concept

Endpoint Detection and Response (EDR) Core Capabilities
Question 264Question →

An Endpoint Detection and Response (EDR) agent detects an active ransomware process attempting to encrypt files on a enterprise workstation. Place the following incident response workflow steps in the correct chronological order from first action to last action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps in the EDR incident response workflow is: 1) Isolate the host from the network, 2) Terminate the malicious process tree, 3) Perform memory analysis and process tree inspection, 4) Execute remediation and remove persistence artifacts.
In standard EDR operational playbooks, the immediate priority upon detecting active malware is containment (host isolation), followed by terminating the active process execution, conducting forensic memory analysis, and finally executing remediation commands to remove persistence.

Step-by-Step Solution

1
Network Host Isolation
The host is isolated from the enterprise network to block lateral movement.
Immediate containment minimizes the threat radius before taking further investigative actions.
2
Malicious Process Termination
The execution of ransomware process threads is stopped.
Terminating the process halts active file encryption on the endpoint.
3
Telemetry & Memory Forensics
Process lineage and memory artifacts are collected for analysis.
Forensic inspection identifies how the attack occurred and what persistence mechanisms were dropped.
4
Remediation & Cleanup
Registry keys are cleaned up and infected files are restored from shadow copies.
Host state is returned to a clean baseline after full analysis and containment.

Key Concept

EDR Automated Containment and Incident Response Workflow
Question 265Question →

An enterprise Security Information and Event Management (SIEM) pipeline is being configured to ingest, analyze, and respond to authentication anomalies across a hybrid environment. Place the following stages of the SIEM log processing pipeline in the correct sequential order from initial endpoint activity to final incident response.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of stages in a SIEM log processing pipeline is: (1) Telemetry Collection, (2) Parsing and Extraction, (3) Data Normalization, (4) Event Correlation, and (5) Alerting and Orchestration.
The correct sequence mirrors the standard data lifecycle within a SIEM pipeline: Telemetry Collection gathers raw logs; Parsing extracts specific variables from text; Normalization standardizes field names across multi-vendor log sources; Correlation applies stateful detection logic across normalized events; and Alerting/Orchestration triggers notifications and automated response playbooks.

Step-by-Step Solution

1
Identify the entry point of event data into the log management pipeline.
Telemetry Collection is established as the initial stage where raw events are emitted and received.
Data must be gathered from endpoints, firewalls, and application servers before any processing can begin.
2
Determine how unstructured log payloads are converted into usable data fields.
Parsing and Extraction follows Collection.
Raw string messages (e.g., Syslog headers or Windows XML) must be broken down into discrete attributes such as IP addresses and event IDs.
3
Standardize variable attributes across multiple vendor platforms.
Data Normalization occurs after Parsing.
Mapping diverse vendor keys (e.g., 'src_ip' vs 'SourceAddress') to a unified schema is required so correlation rules can evaluate events uniformly.
4
Analyze structured, uniform data against security rule logic.
Event Correlation takes place post-normalization.
Correlation engines compare normalized telemetry against detection rules across time windows to detect multi-stage attacks.
5
Identify the response and notification phase resulting from correlation matches.
Alerting and Orchestration is the final stage.
Notifications, ticketing, and automated mitigation actions via SOAR occur only after rule logic identifies a verified threat condition.

Key Concept

SIEM Log Processing Pipeline
Question 266Question →

During an incident investigation on a critical Linux application server, system administrators report that an attacker executed a fileless payload by injecting malicious code directly into the memory space of a legitimate running daemon. To hide their tracks, the attacker wiped the local bash history, deleted event logs from disk, and terminated the interactive shell session. Despite these anti-forensic measures, the Endpoint Detection and Response (EDR) agent successfully captured the complete process lineage, parent-child relationships, and exact memory allocation calls. Which of the following capabilities enabled the EDR agent to maintain continuous behavioral visibility in this scenario?

Show answer & explanation

Answer: Kernel-level system event hooking and sensor callbacks that record process execution telemetry independently of local storage and user-space shells

Answer

Kernel-level system event hooking and sensor callbacks that record process execution telemetry independently of local storage and user-space shells
The correct response highlights kernel-level event hooking and sensor callbacks. Modern EDR solutions install lightweight sensors that integrate deeply with the operating system kernel. These sensors capture execution events, thread creation, memory allocations, and process tree relationships in real time as they occur in memory. Because telemetry is transmitted continuously to an isolated monitoring collector, local anti-forensic actions—such as clearing bash histories or deleting log files from disk—have no effect on the agent's recorded process history.

Step-by-Step Solution

1
Analyze the attack techniques and anti-forensic steps in the scenario.
The attack involves fileless execution (in-memory code injection into a daemon process) accompanied by anti-forensic techniques (wiping local bash history and disk logs).
Identifying the nature of the attack reveals why traditional disk-based or log-file-dependent controls fail.
2
Evaluate how Endpoint Detection and Response (EDR) captures telemetry during fileless execution.
EDR agents operate sensor drivers at the operating system kernel level (e.g., eBPF in Linux, OS kernel callbacks) to continuously observe process calls, API hooks, and memory allocations in real time.
Kernel hooks sit below user-space applications and disk storage, ensuring telemetry stream generation cannot be disabled or erased by user-space log wiping.
3
Select the choice that correctly describes this EDR mechanism.
Kernel-level system event hooking provides real-time, independent telemetry capture unaffected by disk log destruction.
This directly matches the technical requirement for tracking fileless process lineage.

Key Concept

Kernel-Level EDR Telemetry and Fileless Threat Visibility
Question 267Question →

A security analyst is reviewing the following web server access log snippet captured by an enterprise SIEM during a routine alert review:

192.168.1.45 - - [27/Jul/2026:14:32:10 +0000] "GET /login.php HTTP/1.1" 200 4502
192.168.1.45 - - [27/Jul/2026:14:32:12 +0000] "POST /login.php HTTP/1.1" 401 1240
192.168.1.45 - - [27/Jul/2026:14:32:15 +0000] "POST /login.php HTTP/1.1" 401 1240
192.168.1.45 - - [27/Jul/2026:14:32:18 +0000] "POST /login.php HTTP/1.1" 200 5830
192.168.1.45 - - [27/Jul/2026:14:32:25 +0000] "GET /admin/db_export.php?id=1%20OR%201=1 HTTP/1.1" 403 342

Based on the web server log snippet provided, which of the following statements correctly interprets the sequence of security events?

Show answer & explanation

Answer: The client successfully authenticated after two failed attempts, but was subsequently blocked by authorization controls when requesting an administrative resource.

Answer

The client successfully authenticated after two failed attempts, but was subsequently blocked by authorization controls when requesting an administrative resource.
The log entries record two failed authentication attempts (HTTP 401) followed by a successful login response (HTTP 200). Subsequently, the client attempted to access an administrative endpoint containing a SQL injection syntax pattern, which triggered an HTTP 403 Forbidden response. HTTP 403 demonstrates that authorization controls effectively restricted access to the protected administrative resource.

Step-by-Step Solution

1
Analyze HTTP response status codes for authentication requests
Two consecutive POST requests to /login.php returned HTTP 401 (Unauthorized), followed by a third POST request returning HTTP 200 (OK).
HTTP 401 indicates failed identity verification (authentication failure), whereas HTTP 200 confirms successful authentication.
2
Examine post-authentication request payload and response status code
The request to /admin/db_export.php included a SQL injection pattern (id=1 OR 1=1) and returned HTTP 403 (Forbidden).
HTTP 403 confirms that the user was authenticated but lacked authorization permissions to access the administrative resource.

Key Concept

Log analysis and correlation of HTTP status codes to differentiate between authentication failures (HTTP 401) and authorization denials (HTTP 403).
Estimated Time:1m 30s
Question 268Question →

A security analyst needs to assess internal enterprise workstations for missing operating system patches and local configuration weaknesses without sending administrative credentials across the network during the scan. Which of the following scanning methods should the analyst deploy to achieve this goal?

Show answer & explanation

Answer: Agent-based vulnerability scanning

Answer

Agent-based vulnerability scanning provides direct host-level visibility into missing patches and local configurations without requiring administrative credentials over the network.
Agent-based scanning installs a lightweight agent directly on target endpoints. Because the agent runs locally within the operating system, it can thoroughly audit installed updates, local registry keys, and software configurations without transmitting domain or host credentials over the network.

Step-by-Step Solution

1
Identify the primary assessment requirements.
The target environment requires host-level patch inspection without transmitting elevated network authentication credentials.
Transmitting administrative credentials over network segments introduces unnecessary security risk.
2
Compare scanning implementation architectures.
Agent-based scanners run locally with elevated host permissions, retrieving accurate patch data without relying on network authentication protocols.
Local agents execute internal checks directly on the endpoint and transmit encrypted findings back to a management console.

Key Concept

Agent-based vs. network-based vulnerability scanning
Question 269Question →

A Security Operations Center (SOC) team is responding to a fileless attack on an enterprise server, where an adversary is executing malicious commands directly in RAM by abusing legitimate process handles spawned by a web daemon. The SOC analyst must leverage Endpoint Detection and Response (EDR) platform capabilities to detect ongoing malicious behavior and execute host containment without destroying volatile RAM evidence. Which of the following actions should the analyst implement using the EDR solution? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable process lineage tracking and behavioral monitoring to analyze parent-child process relationships and API execution patterns in real time.; Execute software-based host isolation through the EDR agent to quarantine the server from network communication while keeping system power on.

Answer

The analyst should enable process lineage tracking and behavioral monitoring to identify anomalous in-memory process execution, and perform host-level isolation via the EDR agent to cut network communications while preserving volatile RAM.
Process lineage tracking provides real-time visibility into process tree creation and API activity, allowing SOC analysts to identify unauthorized command shells spawned in RAM by web services. Host isolation issued via EDR disconnects network interface communications while keeping the machine powered, effectively halting lateral movement and C2 traffic while preserving volatile RAM for incident response forensics.

Step-by-Step Solution

1
Identify the EDR detection mechanism suitable for fileless memory execution.
Process lineage and API telemetry capture parent-child execution paths, revealing malicious sub-processes launched by web daemons.
Fileless memory attacks bypass traditional static file signatures, necessitating behavioral process tracing.
2
Select the host containment method that preserves volatile system state.
Host-level software network isolation quarantines network interfaces at the OS driver level while leaving power intact.
Host isolation blocks lateral movement and C2 traffic without clearing volatile RAM evidence needed for forensic investigation.
3
Evaluate invalid distractor controls against incident response principles.
Perimeter network rules fail to contain internal host actions, and rebooting wipes RAM prior to evidence collection.
Incident response workflows require host isolation before eradication and recovery activities.

Key Concept

EDR Behavioral Telemetry & Host-Level Network Isolation
Question 270Question →

An organization discovers that an exposed API key associated with a cloud storage container was leaked on a public repository, allowing unauthorized external downloading of sensitive customer backups. Place the following incident response workflow steps in the correct chronological order according to standard incident handling frameworks.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the incident response workflow is: (1) Analyze cloud audit logs to confirm scope, (2) Revoke the exposed API key and restrict storage access, (3) Rotate service accounts and purge unauthorized persistence, (4) Restore normal bucket operations and monitor access, and (5) Conduct an after-action review to update playbooks.
According to NIST SP 800-61 incident response guidelines, response follows a defined sequence: Detection & Analysis (analyzing cloud logs to determine scope), Containment (revoking the leaked key and restricting bucket permissions), Eradication (rotating service accounts and remediating access vulnerabilities), Recovery (restoring production access with monitoring), and Post-Incident Activity (conducting an after-action review).

Step-by-Step Solution

1
Detection & Analysis
Confirm leak details, identify compromised credentials, and establish incident scope.
Accurate scope assessment is necessary prior to implementing targeted containment measures.
2
Containment
Revoke leaked access keys and block further unauthorized data downloads.
Immediate containment stops ongoing exfiltration and mitigates risk to enterprise assets.
3
Eradication
Remove invalid credentials and remediate security posture weaknesses.
Eradication eliminates root threat components from the environment.
4
Recovery
Return systems to clean operational state under heightened monitoring.
Recovery ensures secure operational continuity.
5
Post-Incident Activity
Document lessons learned and update operational security playbooks.
Post-incident review improves future incident response capabilities and controls.

Key Concept

NIST Incident Response Lifecycle Phases (Detection/Analysis -> Containment -> Eradication -> Recovery -> Post-Incident Activity)
Question 271Question →

A tier-2 incident response analyst investigating an alert observes an unknown binary executing child processes that modify critical system registry keys and initiate outbound command-and-control (C2) traffic over non-standard ports on a remote workstation. To immediately prevent lateral movement across the internal subnet while retaining live telemetry, remote command shell access, and memory inspection capability via the agent console, which action should the analyst take?

Show answer & explanation

Answer: Initiate agent-based host isolation on the affected endpoint through the EDR platform console.

Answer

Initiate agent-based host isolation on the affected endpoint through the EDR platform console.
Host isolation implemented directly by the EDR agent restricts all inbound and outbound host network communications except for the dedicated control channel between the agent and the EDR management console. This effectively neutralizes lateral movement and command-and-control communication while preserving volatile RAM state and allowing SOC analysts to run commands, extract memory, and execute playbooks remotely.

Step-by-Step Solution

1
Analyze the incident requirements
The analyst must mitigate lateral movement across the internal network while keeping management channels open for memory investigation and live triage.
Standard network block options kill remote management, while doing nothing permits adversary lateral propagation.
2
Evaluate EDR containment capabilities
Host isolation (also known as endpoint network isolation) cuts off peer-to-peer and general outbound network access on the endpoint while maintaining an encrypted tunnel back to the EDR cloud or management platform.
This specific capability meets both operational demands: isolation from internal assets and continued analyst access.
3
Select the optimal response action
Applying agent-based host isolation fulfills all scenario requirements without destroying volatile system memory state.
It stops lateral movement immediately without requiring physical disconnection or network infrastructure changes.

Key Concept

Endpoint Detection and Response Host Isolation
Estimated Time:2m 0s
Question 272Question →

A Security Operations Center analyst investigates a network intrusion detection system (NIDS) alert generated by telemetry from an internal application gateway servicing database queries. The raw payload captured in the monitoring alert log reads as follows:

http
POST /api/v1/query HTTP/1.1
Host: dbgateway.internal.net
User-Agent: CustomClient/2.4
Content-Type: application/x-www-form-urlencoded
Payload: account_id=1092%27+OR+%271%27%3D%271&session_token=8f9a2b

The security monitoring dashboard erroneously categorized this incident as a client-side Cross-Site Scripting (XSS) event and initiated an automated ticket to update client browser security policies. Based on the network telemetry provided, which of the following response and remediation measures should the analyst take? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Reclassify the alert within the SIEM as a server-side SQL injection attempt and adjust signature parsing rules for encoded database attack patterns.; Deploy or tune an inline Web Application Firewall (WAF) to inspect application-layer HTTP POST parameters for database manipulation strings.

Answer

The analyst should reclassify the event as a server-side SQL injection attempt while adjusting NIDS parsing signatures, and implement or tune a Web Application Firewall (WAF) to inspect HTTP POST application parameters.
The captured HTTP POST payload contains the URL-encoded sequence `%27+OR+%271%27%3D%271`, which decodes to `' OR '1'='1`. This syntax is a classic SQL injection vector targeting backend database logic rather than client-side script execution. Consequently, the analyst must reclassify the SIEM alert to reflect a server-side SQL injection attack and update NIDS detection rules. Additionally, implementing or tuning a Web Application Firewall (WAF) provides the necessary application-layer (Layer 7) packet inspection to block malicious SQL parameters prior to reaching backend gateways.

Step-by-Step Solution

1
Analyze the URL-encoded payload contained within the network monitoring alert.
Decoded payload `%27+OR+%271%27%3D%271` translates to `' OR '1'='1`, which is a standard SQL injection pattern intended to bypass authentication or database query boundaries.
Accurate alert interpretation prevents misdirected incident response procedures.
2
Identify the incorrect SIEM alert classification and remediation directive.
The dashboard misclassified a server-side database injection attempt as a client-side Cross-Site Scripting (XSS) attack.
Updating SIEM correlation rules and NIDS signatures ensures proper alert triage and future signature matching accuracy.
3
Select the appropriate network security control to block web application database attacks.
A Web Application Firewall (WAF) provides Layer 7 payload inspection capabilities to detect and drop SQL injection attempts in real time.
Standard network-level firewalls or deception systems (honeypots) do not function as inline application payload filters.

Key Concept

Network Security Alert Analysis and Application Layer Control Selection
Question 273Question →

A Security Operations Center (SOC) analyst receives a high-severity alert showing that an automated ransomware script is actively executing on an enterprise endpoint and encrypting shared network folders. The analyst confirms the active file encryption via endpoint telemetry. According to standard incident response frameworks, which of the following actions should the analyst take FIRST?

Show answer & explanation

Answer: Isolate the compromised endpoint from the network by disabling its network adapter.

Answer

Isolate the compromised endpoint from the network by disabling its network adapter.
In accordance with standard incident response playbooks (such as NIST SP 800-61), containment must occur immediately after an active incident is confirmed to prevent further damage or data loss. Isolating the infected host from the network stops the ransomware from communicating with Command & Control (C2) servers and encrypting additional network resources while preserving the system state for forensic investigation.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
The scenario describes an ongoing attack actively spreading across network shares (Detection & Analysis moving into Containment).
Determining the correct phase ensures actions follow the NIST/ISO Incident Response Life Cycle.
2
Determine the primary immediate objective during active ransomware propagation.
The immediate objective is containment—stopping the ransomware from reaching additional hosts or shared drives.
Containment limits the scope and blast radius of the security incident.
3
Select the option that achieves immediate containment without destroying volatile forensic evidence.
Network isolation stops network activity while leaving volatile system memory intact for analysis.
Network isolation is the standard first containment step in playbooks for active network-aware malware.

Key Concept

Incident Response Lifecycle Phases and Containment Strategy
Estimated Time:1m 15s
Question 274Question →

A security administrator is establishing a SIEM log handling pipeline for enterprise endpoint and network telemetry. Place the following stages of SIEM log processing in the correct sequential order, starting from the initial arrival of raw security telemetry to final analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages from ingestion to response is: Log Data Collection, Parsing and Field Normalization, Data Indexing and Storage, Event Correlation Engine Processing, and Alert Generation and Incident Dispatch.
The standard SIEM data pipeline follows a strict logical workflow: raw telemetry is collected from endpoints and network devices (Log Data Collection), converted into a unified structure (Parsing and Field Normalization), stored with fast retrieval keys (Data Indexing and Storage), evaluated across sources against security logic (Event Correlation Engine Processing), and finally escalated to analysts when malicious conditions are matched (Alert Generation and Incident Dispatch).

Step-by-Step Solution

1
Identify the ingress stage of raw log telemetry.
Log Data Collection occurs first as telemetry is gathered from diverse source devices.
Raw logs cannot be processed, searched, or analyzed before they are gathered by SIEM agents or collectors.
2
Determine how diverse log formats are converted into standardized fields.
Parsing and Field Normalization immediately follows log collection.
Different operating systems and applications format logs differently; normalization translates raw strings into common fields like source IP, destination IP, and event ID.
3
Identify how processed logs are prepared for rapid search and retention.
Data Indexing and Storage is applied to normalized log records.
Indexing creates fast lookup structures so complex queries and correlation algorithms can run efficiently over high-volume data.
4
Analyze how pattern detection occurs across stored events.
Event Correlation Engine Processing evaluates indexed data against defined logic.
Correlation requires access to structured, indexed events to match multi-event patterns across disparate log sources.
5
Determine the final output stage triggering analyst workflow.
Alert Generation and Incident Dispatch occurs after correlation logic flags suspicious behavior.
Alerts are generated only after correlation logic successfully detects a policy violation or threat indicator.

Key Concept

SIEM Log Processing Pipeline
Question 275Question →

During an ongoing threat hunting investigation within a Linux database cluster, an automated Endpoint Detection and Response (EDR) agent alerts on suspicious ptrace system calls initiating in-memory execution of anonymous memory segments from an unprivileged web server process. To immediately mitigate lateral movement and preserve essential volatile evidence for detailed analysis, which TWO of the following actions should the SOC analyst initiate directly through the EDR management platform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable software-based host network isolation while preserving persistent administrative agent command-and-control channels.; Trigger remote volatile memory acquisition and endpoint telemetry log collection before terminating suspect process lineages.

Answer

The SOC analyst should enable software-based host network isolation while maintaining EDR agent management connectivity, and trigger remote volatile memory acquisition alongside telemetry log collection before terminating processes.
Enabling host network isolation directly through the EDR agent isolates network adapters to halt lateral movement while preserving the out-of-band management link. Simultaneously acquiring volatile RAM evidence before killing suspect processes ensures forensic artifacts associated with fileless memory injection are retained intact.

Step-by-Step Solution

1
Isolate the compromised host at the endpoint software layer using EDR network containment.
Network traffic to and from the host is restricted to prevent lateral propagation while keeping management channels alive.
Prevents attacker movement while allowing security analysts to conduct remote investigation.
2
Perform remote volatile memory (RAM) and endpoint process telemetry acquisition.
In-memory fileless payloads and execution artifacts are captured prior to process disruption.
Preserves transient evidence following proper digital forensic order of volatility.

Key Concept

Endpoint Detection and Response (EDR) Host Containment and Volatile Evidence Preservation
Question 276Question →

A Security Operations Center (SOC) analyst is investigating a high-severity alert triggered by a SIEM correlation rule on an enterprise Linux server. The log stream displays the following chronologically ordered events:

text
Jul 27 14:15:02 auth-srv pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.51.100.45 user=root
Jul 27 14:15:05 auth-srv pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.51.100.45 user=root
Jul 27 14:15:09 auth-srv sshd[4102]: Accepted password for deploy_admin from 198.51.100.45 port 52144 ssh2
Jul 27 14:15:22 auth-srv sudo: deploy_admin : TTY=pts/1 ; PWD=/home/deploy_admin ; USER=root ; COMMAND=/usr/bin/useradd -m -g sudo backdoor_admin

Which of the following security incidents is most accurately indicated by this log telemetry?

Show answer & explanation

Answer: A successful password-guessing attack against a valid user account followed by unauthorized administrative privilege escalation and local user creation.

Answer

The log telemetry indicates a successful password-guessing attack against a valid user account followed by unauthorized administrative privilege escalation and local user creation.
The correct answer accurately synthesizes the event sequence across multiple host log entries. The initial entries demonstrate automated password guessing (brute force) targeting the root user from IP 198.51.100.45. Shortly after, the attacker successfully authenticates into the deploy_admin user account from the same IP address. Once logged in, the attacker executes a sudo command to create a new local account named backdoor_admin with administrative privileges, which represents post-exploitation activity.

Step-by-Step Solution

1
Analyze the authentication failure logs
Identified two failed SSH authentication attempts for the root user from source IP address 198.51.100.45 within a 3-second window.
Rapid sequential failed login attempts from a single IP indicate credential brute-forcing or password guessing.
2
Analyze the successful authentication log entry
Observed an accepted SSH password login for user deploy_admin four seconds later from the exact same source IP (198.51.100.45).
Correlation of the source IP connects the initial failed guessing attempts with the subsequent successful login into a valid account.
3
Evaluate the post-authentication command log entry
Determined that deploy_admin used sudo to run useradd with root privileges to create a new user named backdoor_admin.
Executing privileged commands immediately after a suspicious authentication event points to post-exploitation activity and privilege escalation.

Key Concept

SIEM Multi-Source Telemetry Correlation & Log Analysis
Question 277Question →

A system administrator needs to deploy a security control to enterprise endpoints that continuously monitors local host activity, logs process execution lineage, and enables immediate network isolation of compromised devices. Which of the following security solutions best meets these requirements?

Show answer & explanation

Answer: Endpoint Detection and Response (EDR)

Answer

Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) solutions utilize host agents to gather real-time process execution metrics, analyze process trees for anomalous behavior, and provide immediate containment mechanisms such as host-level network isolation.

Step-by-Step Solution

1
Analyze the operational requirements provided in the scenario.
Identified the need for host telemetry logging, process lineage tracking, and automated host isolation.
These controls require an agent running directly on the operating system capable of inspecting system behavior and altering network adapter connectivity.
2
Compare candidate security tools against the required capabilities.
Endpoint Detection and Response (EDR) provides real-time process monitoring, behavioral detection, and automated host isolation features.
EDR specifically expands beyond legacy static signature scanning to capture host execution contexts and enable active incident containment.

Key Concept

Endpoint Detection and Response (EDR) Core Capabilities
Estimated Time:45s
Question 278Question →

A security analyst is reviewing centralized authentication and privileged access logs during an investigation. The following event log snippet was captured:

Timestamp: 2026-07-27 10:12:01 UTC | User: [email protected] | Src_IP: 192.168.10.45 | Auth_Type: SAML_SSO | Status: SUCCESS | Location: New York, USA
Timestamp: 2026-07-27 10:13:15 UTC | User: [email protected] | Src_IP: 203.0.113.19 | Auth_Type: SAML_SSO | Status: SUCCESS | Location: London, UK
Timestamp: 2026-07-27 10:13:40 UTC | User: [email protected] | Resource: DC-01.company.local | Privilege: Domain Admin Vault | Action: Checkout | Status: APPROVED

Based on the log entries above, which of the following represents the MOST likely incident root cause and the immediate identity and access management (IAM) operational response?

Show answer & explanation

Answer: An impossible travel anomaly indicates valid credential compromise; the security team must immediately terminate active user sessions and disable the account.

Answer

An impossible travel anomaly indicates valid credential compromise; the security team must immediately terminate active user sessions and disable the account.
The log snippet reveals two successful logons for user [email protected] occurring 74 seconds apart from New York and London. This represents a classic 'impossible travel' anomaly, proving that valid account credentials or session tokens have been compromised. In IAM operations, the primary immediate containment action is to revoke all active tokens, end open sessions, and disable the account to prevent unauthorized domain administrator escalation.

Step-by-Step Solution

1
Analyze authentication log timestamps and locations
Identified two successful SAML SSO logons for the same user account from New York, USA and London, UK within 74 seconds of each other.
Physical travel between these locations in under two minutes is impossible, indicating credential compromise (such as token hijacking or credential harvesting).
2
Evaluate downstream actions taken by the compromised account
The compromised account successfully performed a privileged vault checkout for domain admin access on critical infrastructure.
Threat actors frequently leverage stolen standard account credentials to escalate privileges via Privileged Access Management (PAM) workflows.
3
Determine the appropriate IAM containment operation
Revoke active session tokens, invalidate refresh tokens, and temporarily disable the account.
Immediate account lifecycle suspension and active session termination stops ongoing unauthorized access across all enterprise services.

Key Concept

Impossible travel detection and immediate incident containment in IAM operations
Estimated Time:1m 30s
Question 279Question →

A security analyst receives an alert showing suspicious process activity and memory execution on an enterprise host. Which of the following actions can the analyst perform directly through an Endpoint Detection and Response (EDR) agent to immediately contain and investigate the host? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolate the compromised host from the network while maintaining agent management connectivity.; Terminate running malicious processes and process trees remotely on the endpoint.

Answer

The analyst can isolate the compromised host from the network while maintaining agent management connectivity, and terminate running malicious processes remotely on the endpoint.
Endpoint Detection and Response (EDR) agents provide direct host-level control. Isolating the endpoint restricts lateral movement while keeping command telemetry active, and terminating malicious processes stops unauthorized code execution in host memory.

Step-by-Step Solution

1
Identify the direct capabilities of host-based EDR agents during active containment.
Recognize that EDR provides centralized host isolation and remote process termination.
EDR solutions are deployed directly on endpoints to perform host-level containment and telemetry management.
2
Evaluate network isolation capabilities.
Select host network isolation.
Host network isolation cuts off communication to other internal systems while allowing security analysts to maintain an active management session to investigate.
3
Evaluate active process termination capabilities.
Select remote process termination.
EDR software enables SOC analysts to kill malicious processes running in host memory directly from the security console.

Key Concept

Endpoint Detection and Response (EDR) host isolation and process termination capabilities
Question 280Question →

A security administrator receives an alert indicating that domain credentials belonging to a recently terminated employee were used to successfully log in to an internal server. Which of the following identity and access management (IAM) operational processes would have directly prevented this unauthorized access?

Show answer & explanation

Answer: Performing prompt account deprovisioning as part of the employee offboarding workflow

Answer

Performing prompt account deprovisioning during offboarding directly revokes authentication credentials, preventing terminated employees from logging in to network systems.
Account deprovisioning is an essential IAM operational process executed during offboarding to disable or remove user accounts immediately upon termination. Deactivating the account revokes identity rights and prevents former staff from authenticating to enterprise systems.

Step-by-Step Solution

1
Identify the operational vulnerability presented in the scenario.
The issue is an active identity credential belonging to a terminated worker.
When employment is terminated, user credentials must immediately cease to be valid for authentication.
2
Evaluate the appropriate preventive IAM lifecycle procedure.
Automated or timely account deprovisioning deactivates access rights and credentials.
Deprovisioning directly revokes identity access privileges at the authentication source.

Key Concept

Identity Lifecycle Management and Account Deprovisioning
PreviousPage 14 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 14 | Examkin