Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 281Question →

During an ongoing incident investigation involving an enterprise network gateway suspected of active data exfiltration, an incident responder is tasked with collecting digital evidence from the running target system to support potential legal prosecution. Which of the following procedures must the responder perform to maintain evidence integrity and adhere to forensic collection standards? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Capture the system's volatile memory (RAM) prior to powering down the host or taking a disk image.; Calculate and record SHA-256 cryptographic hashes of acquired disk images immediately after capture on the chain of custody form.

Answer

The responder must capture the volatile RAM prior to host shutdown or disk imaging and calculate cryptographic hashes (SHA-256) immediately following image acquisition to log on the chain of custody documentation.
Adhering to forensic collection principles requires prioritizing memory collection according to the Order of Volatility (capturing RAM before volatile state is wiped) and establishing verifiable integrity controls (computing cryptographic hash values immediately upon image acquisition to record in the custody log).

Step-by-Step Solution

1
Evaluate evidence collection priority using the Order of Volatility.
Identify that system memory (RAM) is extremely volatile and will be lost if the machine is powered down or if disk imaging operations alter memory state.
Capturing RAM first preserves live memory artifacts such as unencrypted keys, active connections, and running processes.
2
Determine evidence integrity verification requirements for legal defensibility.
Compute a cryptographic hash (such as SHA-256) immediately upon bit-stream disk acquisition.
Recording the initial hash on the chain of custody form allows future investigators to prove the image has not been modified.

Key Concept

Order of Volatility and Evidence Integrity Verification
Question 282Question →

During off-hours monitoring, a Security Operations Center (SOC) analyst receives a high-severity alert indicating that an unauthorized IAM access key associated with a developer account is actively making API calls to export enterprise database snapshots to an unapproved external cloud storage location. The analyst verifies that data exfiltration is currently taking place in real time. Following standard NIST SP 800-61 incident response lifecycle guidelines, which of the following actions should the analyst take FIRST?

Show answer & explanation

Answer: Apply an explicit deny inline policy to the compromised IAM account to immediately revoke active API session tokens and halt exfiltration.

Answer

The analyst should immediately attach an explicit deny inline policy to the compromised IAM account to revoke active sessions and halt ongoing exfiltration.
The correct response is to apply an explicit deny policy to the compromised IAM user account. In the NIST SP 800-61 incident response framework, when an active data breach or exfiltration event is detected, the immediate priority is Containment. Disabling or restricting the compromised credentials stops the threat actor from making further API calls and halts exfiltration immediately.

Step-by-Step Solution

1
Identify the current incident response phase
The scenario describes an ongoing, active exfiltration breach in real time.
According to NIST SP 800-61, active breaches require immediate execution of Containment controls before moving to Eradication or detailed Forensics.
2
Evaluate containment actions for compromised cloud credentials
Applying an explicit deny policy or disabling the IAM access keys immediately revokes active API tokens and stops data exfiltration.
Containment limits the scope and damage of an active security incident.
3
Distinguish containment from out-of-order phases
Forensic evidence acquisition (Eradication/Analysis) and restoring data from backups (Recovery) are necessary subsequent steps, but must follow successful containment.
Executing recovery or forensic collection without prior containment allows malicious exfiltration to persist.

Key Concept

Incident Response Containment Phase Execution
Estimated Time:2m 0s
Question 283Question →

A security operations team observes significant network degradation and inconsistent scan results during scheduled vulnerability assessments of an enterprise auto-scaling container cluster. The current scanning infrastructure relies on a centralized network scanner initiating remote, credentialed SSH/WinRM connections across dynamically assigned pod IP addresses, frequently failing when transient instances terminate mid-scan. Which architectural modification best resolves these operational scanning challenges while minimizing privileged credential transmission across the internal network?

Show answer & explanation

Answer: Deploy agent-based vulnerability monitoring integrated directly into baseline container images to report local software inventory and system state changes asynchronously.

Answer

Deploying agent-based vulnerability monitoring directly within baseline container images resolves host discovery and performance issues in auto-scaling, ephemeral environments.
Deploying agent-based vulnerability scanners into baseline container images provides continuous visibility into ephemeral microservices without relying on persistent network connections or remote SSH/WinRM credential authentication. Agents execute locally, consume minimal system resources, and push telemetry to a centralized console asynchronously, eliminating scan failures caused by container termination during active scans.

Step-by-Step Solution

1
Analyze the operational constraints and failure points in the current vulnerability scanning architecture.
Identified that centralized credentialed network scanning creates network overhead and fails when ephemeral container instances terminate before scans finish.
Centralized network scans depend on stable IP addresses and persistent network sessions.
2
Evaluate scanning methodologies against dynamic and auto-scaling cloud workload requirements.
Agent-based scanning operates locally on the target host/container, executing checks without requiring active remote network sessions or inbound SSH/WinRM credentials.
Local agents collect state telemetry and push findings asynchronously, making them ideal for dynamic, short-lived infrastructure.
3
Select the option that eliminates network overhead and handles transient instance lifecycles while maintaining high vulnerability discovery fidelity.
Deploying agents into container base images provides continuous, low-overhead visibility regardless of IP changes or container lifespan.
Agent-based assessment eliminates remote credential transmission across the network while delivering complete local package inspection.

Key Concept

Agent-Based vs. Network-Based Vulnerability Scanning in Ephemeral Environments
Estimated Time:3m 0s
Question 284Question →

A security analyst is establishing the standard administrative workflow for user onboarding and offboarding within an enterprise Identity and Access Management (IAM) system. Place the following identity lifecycle steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for identity and access management operations begins with identity verification, followed by account provisioning with role-based access, MFA token enrollment, and finally access recertification and deprovisioning.
The correct operational order follows the standard Identity and Access Management (IAM) lifecycle: first verify the person's identity, then provision the account with appropriate rights, enroll the user in MFA for secure access, and continuously perform access recertification and eventual account deprovisioning.

Step-by-Step Solution

1
Identify initial identity validation
Identity verification and identity proofing must occur first.
Organizations must confirm the identity of an individual before creating user accounts or granting enterprise resource access.
2
Establish digital credentials
Account provisioning and role assignment occur next.
An active account object in the domain directory is required before secondary security configurations can take place.
3
Apply strong authentication controls
Multi-Factor Authentication (MFA) enrollment follows credential provisioning.
The user binds their hardware token or authenticator app to their newly created user account.
4
Manage ongoing operations and termination
Access recertification and deprovisioning represent the operational audit and end-of-lifecycle phase.
Privilege recertification audits entitlement drift over time, and deprovisioning revokes rights when employment ends.

Key Concept

Identity Lifecycle Management
Question 285Question →

An enterprise security team needs to deploy a security capability to corporate laptops that provides continuous behavioral telemetry, process execution monitoring, and the ability to perform remote network host isolation during an incident. Which of the following technologies best meets these operational requirements?

Show answer & explanation

Answer: Endpoint Detection and Response (EDR)

Answer

Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) agents run directly on end-user devices to log process execution, track host behavior in real time, and allow SOC analysts to isolate compromised hosts from the network remotely.

Step-by-Step Solution

1
Identify the required capabilities from the scenario
The requirements are continuous host-level telemetry, process execution tracking, and remote host containment/isolation capabilities.
Security controls must match the specific functional scope requested by the incident response team.
2
Compare candidate security tools against host-level vs network-level functionality
Only host-based agent tools operating on the endpoint can monitor granular system process behavior and enforce host network interface isolation.
Network appliances like firewalls and NIDS lack visibility into internal OS process execution and file access.
3
Select the host security technology designed for behavioral monitoring and containment
Endpoint Detection and Response (EDR) provides behavioral detection, logging, and remote host isolation capabilities.
EDR agents are engineered specifically to provide real-time endpoint visibility and incident remediation capabilities.

Key Concept

Endpoint Detection and Response (EDR) capabilities including continuous monitoring and host isolation
Question 286Question →

A security administrator needs to perform a routine vulnerability scan on a critical production database server during business hours. The administrator must maximize detection accuracy for missing operating system patches while ensuring database availability is not impacted. Which of the following scanning practices should the administrator select? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Perform a credentialed scan using administrative account privileges; Configure the scanner to use non-intrusive scan options

Answer

The administrator should perform a credentialed scan using administrative account privileges and configure the scanner to use non-intrusive scan options.
Selecting credentialed scanning enables the vulnerability scanner to log into the host and accurately read installed patches and system configurations with minimal network overhead. Pairing this with non-intrusive scan settings ensures the scanner only checks system state against known vulnerability signatures without executing potentially destabilizing exploit code on production systems.

Step-by-Step Solution

1
Analyze the operational constraints of the scenario
Identified the need for high vulnerability detection accuracy on a live production server without risking service interruption.
Production environments require non-disruptive assessment techniques.
2
Evaluate authentication requirements for scanning
Selected credentialed scanning because authenticating directly to the host provides precise insight into local patch levels and configurations.
Uncredentialed network scans can miss internal local vulnerabilities or misinterpret closed ports.
3
Evaluate impact controls for vulnerability scanning
Selected non-intrusive scanning to ensure checks only inspect signatures and version headers rather than attempting system exploitation.
Intrusive tests or exploit scripts can cause unexpected system crashes on production databases.

Key Concept

Credentialed vs. Non-Intrusive Vulnerability Scanning Configuration
Question 287Question →

A Security Operations Center (SOC) analyst receives an active EDR telemetry alert indicating that a Windows workstation is executing malicious code via a Living-off-the-Land (LotL) binary. Place the following Endpoint Detection and Response (EDR) containment and incident handling actions in the correct chronological order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: 1) Apply software-based host network isolation through the EDR console, 2) Terminate the malicious process and its associated child process tree via the EDR process lineage view, 3) Gather volatile system telemetry, including process memory dumps and EDR sensor logs, for analysis, and 4) Remove persistence artifacts, such as malicious scheduled tasks or registry keys, and lift host isolation.
In standard EDR incident response workflows, immediate containment (network isolation via the software agent) takes precedence to stop C2 traffic and lateral movement. Next, active malicious process trees are terminated to freeze payload execution. Once contained, volatile forensic artifacts (RAM/process dumps) are collected for root-cause analysis. Finally, persistence mechanisms are eradicated and system integrity is verified before removing isolation.

Step-by-Step Solution

1
Isolate the endpoint on the network using the EDR agent.
Network communication to external adversary C2 servers and adjacent internal hosts is halted immediately.
Preventing lateral movement and outbound data exfiltration is the top priority during active endpoint compromise.
2
Terminate active malicious processes identified by EDR process lineage tracking.
The execution of malicious payloads on the local machine stops.
Stopping active memory execution prevents further host degradation or local encryption after the network perimeter of the host is locked down.
3
Trigger remote volatile telemetry collection via EDR forensic capabilities.
Memory dumps and sensor logs are preserved for root-cause investigation.
Forensic telemetry provides necessary IoCs to determine the initial breach vector without interrupting critical containment steps.
4
Perform system remediation and remove persistent startup entries before restoring full network connectivity.
The endpoint is clean and safe to rejoin normal production operations.
Restoring network connectivity prior to removing persistence mechanisms allows the adversary to regain access immediately upon reconnection.

Key Concept

EDR Incident Containment and Response Lifecycle
Estimated Time:1m 30s
Question 288Question →

A forensic investigator arrives at an enterprise branch office to analyze a powered-on physical server suspected of hosting an active in-memory keylogger that exfiltrates proprietary records. To preserve evidence for legal proceedings while strictly following forensic acquisition standards, which of the following actions must the investigator take before acquiring non-volatile disk media?

Show answer & explanation

Answer: Capture the host system memory (RAM) to an external sanitized storage media and document the acquisition hash on the chain of custody form.

Answer

Capturing host system memory (RAM) to sanitized storage and logging its cryptographic acquisition hash on the chain of custody form prior to non-volatile disk acquisition.
The correct action prioritizes system RAM preservation over non-volatile media in strict accordance with the Order of Volatility (CPU registers/cache → System RAM → Swap/page files → Hard disk drive → Archival media). Furthermore, recording the acquisition hash on a formal chain of custody document ensures tamper-evidence and legal admissibility.

Step-by-Step Solution

1
Evaluate the current state of the compromised host.
The server is powered on and running an active in-memory malware threat.
Live systems contain highly volatile data in CPU cache and RAM that will be permanently lost if powered down or if lower-volatility acquisitions are prioritized.
2
Apply the Order of Volatility principles.
RAM must be acquired before non-volatile media (hard drives/SSDs).
Data in RAM changes rapidly and cannot be recovered once overwritten or cleared.
3
Establish Chain of Custody and Evidence Integrity.
Calculate a cryptographic hash (e.g., SHA-256) of the memory dump immediately upon acquisition and log it alongside timestamp and handler details.
Proves evidence integrity and authenticates the acquisition state for court admissibility.

Key Concept

Order of Volatility and Chain of Custody Integrity
Estimated Time:2m 0s
Question 289Question →

During an incident response investigation, a Security Operations Center (SOC) team detects an active web shell on a public-facing web server cluster. Log telemetry confirms that the threat actor is abusing harvested service account credentials to attempt lateral movement toward the enterprise database tier. According to standard incident response lifecycle frameworks, which of the following containment actions should the Incident Response Team (IRT) execute immediately? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke the compromised service account credentials and terminate all active authentication sessions in the identity provider.; Isolate the compromised web server cluster from the internal network using firewall rules and host microsegmentation.

Answer

The correct containment actions are revoking the compromised service account credentials and isolating the compromised web server cluster from the internal network using microsegmentation.
In accordance with standard incident response playbooks, containment aims to halt the spread of an active compromise while preserving evidence. Disabling compromised service account credentials neutralizes the adversary's authentication access, while network microsegmentation isolates the web server cluster to prevent lateral movement to database assets.

Step-by-Step Solution

1
Determine the current phase of the incident response lifecycle.
The incident is currently in the Containment phase following active detection of a web shell and attempted lateral movement.
Containment limits incident impact and prevents lateral expansion before moving to eradication.
2
Identify effective containment controls that preserve evidence.
Revoking compromised account tokens blocks authorized access abuse, and microsegmenting network paths blocks traffic to internal database servers.
These controls stop attacker activity without overwriting system volatile memory or storage logs.
3
Differentiate containment actions from eradication or preventive controls.
System reimaging is classified under eradication/recovery, while WAF signature updates represent preventive controls.
Executing eradication prior to containment breaches standard NIST/ISO IR lifecycle sequence.

Key Concept

Incident Response Containment Phase Execution
Question 290Question →

A security operations team is implementing Just-In-Time (JIT) access controls within a Privileged Access Management (PAM) framework to reduce standing administrative privileges. Place the operational steps of a JIT privileged access session lifecycle in the correct sequential order from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for a Just-In-Time (JIT) privileged access lifecycle is: 1) Request submission with justification, 2) Policy evaluation and approval routing, 3) Issuance of ephemeral or temporary credentials, 4) Brokered session execution with recording, and 5) Automatic session revocation and credential rotation.
Just-In-Time (JIT) access management operates on a strict sequence to prevent standing privileges. First, an administrator requests elevated rights with valid justification. Next, the PAM platform validates contextual policies and obtains necessary approvals. Third, short-lived credentials or certificates are provisioned. Fourth, the user connects via a proxied gateway that logs all actions. Finally, upon expiration of the session timer, access is revoked and credentials are automatically rotated.

Step-by-Step Solution

1
Identify the request phase
The administrator submits an access request specifying the target system and justification.
JIT workflows require explicit user initiation with business context before elevated permissions are granted.
2
Identify the authorization and policy check phase
The PAM platform evaluates contextual policies and routes the request for approval.
Access policy checks and approvals ensure zero trust principles are enforced before issuing access.
3
Identify credential provision
The PAM service issues short-lived ephemeral credentials or checks out a temporary account.
Credentials must be generated or checked out dynamically only after successful request approval.
4
Identify active session monitoring
The user connects via a brokered PAM gateway with keystroke and session logging.
Privileged sessions require real-time proxying and auditing to maintain security compliance.
5
Identify lifecycle termination
The PAM system revokes permissions and rotates account credentials when the window expires.
Automatic revocation and rotation eliminate standing privileges and secure the target resource.

Key Concept

Just-In-Time (JIT) Privileged Access Management Lifecycle
Question 291Question →

An enterprise security architecture team is updating its vulnerability assessment strategy across a diverse hybrid infrastructure. The environment comprises internal database servers, virtualized cloud workloads, and legacy operational technology (OT) controlling industrial processes. The team must maximize vulnerability discovery accuracy while adhering to strict operational availability constraints. Which of the following scanning strategies should the security team implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy authenticated agent-based vulnerability scanners on internal server endpoints to identify missing local patches and configuration drift without generating heavy network traffic.; Utilize passive network traffic monitoring and non-intrusive asset discovery techniques across operational technology (OT) segments to evaluate vulnerabilities without interrupting control systems.

Answer

The security team should deploy authenticated agent-based vulnerability scanners on internal server endpoints and utilize passive network traffic monitoring on operational technology networks.
Authenticated agent-based scanning provides comprehensive insight into host-level patch management and security configurations without burdening internal networks with active network scanner traffic. Concurrently, using passive network monitoring in sensitive operational technology segments captures device and protocol vulnerability data safely without exposing critical control hardware to active probing risks.

Step-by-Step Solution

1
Determine the optimal scanning approach for standard enterprise host systems requiring low network impact.
Authenticated agent-based scanning provides maximum local visibility into missing patches and configuration issues with negligible network traffic.
Agents leverage local system credentials and execute directly on the host OS.
2
Determine the safe scanning methodology for highly sensitive industrial control systems (OT).
Passive network traffic analysis allows vulnerability and asset discovery without injecting probes that could crash OT devices.
Availability and system stability are critical priorities in operational technology environments.
3
Evaluate and reject invalid control substitutions and high-risk operational practices.
Reject substituting vulnerability scanning with WAFs and reject running intrusive scans against OT hardware.
Preventive inline firewalls do not inspect internal vulnerability states, and intrusive active scans induce downtime.

Key Concept

Differentiating between credentialed agent-based, non-credentialed network-based, and passive vulnerability scanning methods based on asset sensitivity and operational constraints.
Question 292Question →

During security monitoring, an analyst detects unauthorized data exfiltration via DNS tunneling originating from an internal web application server. The incident response team validates the threat and confirms the incident response playbook needs to be executed immediately. According to standard incident response lifecycle frameworks, which of the following actions should the responder take FIRST during the containment phase?

Show answer & explanation

Answer: Isolate the affected web server from the network while keeping it powered on.

Answer

Isolate the affected web server from the network while keeping it powered on.
Isolating the affected host from the network immediately halts active data exfiltration via DNS tunneling while preserving volatile memory (RAM) needed for digital forensics. Following standard IR frameworks (such as NIST SP 800-61), containment must occur before eradication or recovery steps begin.

Step-by-Step Solution

1
Identify the current Incident Response lifecycle phase based on the scenario.
The scenario transitions from Detection & Analysis into Containment.
Once an active threat like data exfiltration is verified, the IR team must act quickly to limit the scope of impact.
2
Determine the primary objective of the Containment phase.
Halt active data exfiltration while preserving volatile system memory for forensic preservation.
Disconnecting network interfaces or applying VLAN segregation isolates the threat without destroying RAM artifacts.
3
Select the action that aligns with immediate containment requirements.
Isolating the specific affected host from the network while keeping power maintained is the correct initial action.
Actions like remediation, playbook reviews, or broad network disruptions belong to different phases or cause unintended operational failure.

Key Concept

Incident Response Lifecycle Containment Strategy
Question 293Question →

During a threat hunting operation on a dual-homed critical enterprise jump server running Windows Server, a SOC analyst identifies suspicious memory-only reflective DLL injection into a legitimate system process. Telemetry shows the process initiating beaconing over an encrypted channel to an unknown external IP address while simultaneously maintaining active RPC session handles to adjacent internal database servers. Which of the following containment actions should the security analyst perform using the Endpoint Detection and Response (EDR) agent to stop lateral movement without losing volatile memory evidence or breaking analyst access?

Show answer & explanation

Answer: Initiate host isolation via the EDR console to block non-security network traffic while maintaining the agent telemetry channel.

Answer

Initiate host isolation via the EDR console to block non-security network traffic while maintaining the agent telemetry channel.
The correct option correctly identifies the primary containment feature of EDR solutions: host isolation. EDR software agents manipulate kernel-level network filters to isolate the endpoint from all local and remote endpoints except for the designated EDR management console IPs. This halts external command-and-control (C2) beaconing and internal RPC-based lateral movement while keeping the system powered on so analysts can remotely capture volatile memory and inspect process lineage.

Step-by-Step Solution

1
Analyze the threat scenario and containment requirements.
Identified fileless memory-only malware attempting active lateral movement via RPC while beaconing out.
The system contains volatile evidence in RAM that must be preserved for forensic acquisition while immediately halting network communications.
2
Evaluate EDR network isolation capabilities against traditional network/system controls.
EDR host isolation applies software-defined filtering at the endpoint NDIS/kernel layer, severing peer-to-peer and outbound network channels.
This leaves the encrypted EDR agent management tunnel intact so responders can perform remote memory dumps and endpoint triage without physical host access or rebooting.
3
Select the optimal action adhering to incident response standards.
Enact endpoint isolation through the EDR console.
This stops C2 activity and internal lateral movement instantaneously while maintaining volatility preservation standards.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation and Telemetry Preservation
Estimated Time:2m 0s
Question 294Question →

A senior systems engineer is evaluating centralized administrative access controls for an organization's network infrastructure devices, including core switches and routers. Operational security requirements specify that the solution must encrypt the entire packet payload during transit, strictly separate authentication and authorization processes, and support per-command authorization auditing for administrative sessions. Which of the following protocols should the engineer implement to satisfy these operational requirements?

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct protocol because it encrypts the entire packet payload, operates over TCP, and decouples authentication from authorization to allow per-command authorization and detailed command logging.
TACACS+ satisfies all listed criteria: it encrypts the full payload of every packet (unlike RADIUS, which only encrypts the user password), operates over reliable TCP (port 49), and separates authentication, authorization, and accounting. This architecture permits granular authorization of specific commands typed by network administrators and detailed command-level accounting logs.

Step-by-Step Solution

1
Analyze the operational requirements provided in the scenario
Identified key requirements: full packet payload encryption, decoupling of authentication and authorization, and per-command authorization auditing.
Evaluating protocol capabilities against exact operational specifications is required to choose the correct AAA implementation.
2
Compare AAA transport protocols (TACACS+ vs. RADIUS)
RADIUS encrypts only the password field and combines authentication with authorization into single packet flows. TACACS+ encrypts the entire packet payload and maintains separate processes for authentication, authorization, and accounting.
Distinguishing between RADIUS and TACACS+ architecture reveals which protocol satisfies command-level granular authorization and payload encryption.
3
Select the protocol that supports per-command CLI authorization auditing
TACACS+ allows administrators to validate and log individual commands issued during network device sessions.
TACACS+ explicitly supports command-level authorization filters required for secure network infrastructure operations.

Key Concept

Centralized AAA Protocol Operations (TACACS+ vs. RADIUS)
Question 295Question →

A security analyst is reviewing authentication and session logs from an enterprise Identity Provider (IdP) following a suspected compromise of a cloud-hosted infrastructure management console. The investigation reveals the following log snippet:

[2026-07-27T14:02:11Z] AUTH_SUCCESS [email protected] AuthMethod=FIDO2_HardwareKey SourceIP=192.168.10.45 Location=Corp_HQ_HQ1
[2026-07-27T14:02:14Z] SESSION_ISSUED [email protected] OAuthTokenID=tk-998231 Scope=CloudAdmin_FullAccess
[2026-07-27T14:02:40Z] API_CALL [email protected] OAuthTokenID=tk-998231 SourceIP=198.51.100.77 Location=External_Unknown Endpoint=/api/v1/iam/roles/delete
[2026-07-27T14:02:45Z] API_CALL [email protected] OAuthTokenID=tk-998231 SourceIP=198.51.100.77 Location=External_Unknown Endpoint=/api/v1/storage/exportAll

Further physical access logs confirm User j.doe was continuously present at Corporate HQ during this timeframe. Which of the following identity operational vulnerabilities MOST likely enabled this unauthorized access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Absence of continuous access evaluation (CAE) or token binding allowing a stolen OAuth bearer token to be replayed from an external source IP address; Failure to enforce location-aware risk policies that trigger step-up MFA or session revocation when anomalous client network context is detected

Answer

The compromise was enabled by the lack of continuous access evaluation (or sender-constrained token binding) allowing token replay, alongside missing location-aware risk policies to enforce step-up MFA upon context shift.
The scenario highlights session hijacking/token theft where a legitimate token generated during hardware key authentication at HQ was executed from an unknown external IP address. The two primary identity operation breakdowns are: 1) Using unconstrained bearer tokens without Continuous Access Evaluation (CAE) to bind sessions to device/network posture, and 2) Lacking adaptive, location-aware risk rules that automatically flag impossible travel or demand step-up MFA when session origin changes abruptly.

Step-by-Step Solution

1
Analyze the authentication and API activity timestamps and attributes
The user authenticated successfully at HQ using a FIDO2 hardware key, but 26 seconds later, the resulting OAuth session token was utilized from an external IP address (198.51.100.77).
This discrepancy indicates a session token theft/replay attack or adversary-in-the-middle (AiTM) proxy interception.
2
Identify session validation operational controls needed to mitigate token replay
Without Continuous Access Evaluation (CAE) or sender-constrained token mechanisms (such as DPoP/mTLS), bearer tokens can be used from any device regardless of network origin change.
Standard bearer tokens do not validate client network posture dynamically after initial issuance.
3
Evaluate risk-based authentication triggers
The Identity Provider failed to detect impossible travel / network context shifts or mandate step-up MFA/re-authentication when an external IP attempted administrative API calls.
Modern IAM operations require adaptive access control policies that dynamically assess real-time risk metrics.

Key Concept

Session Token Binding & Adaptive Risk-Based Access Control
Question 296Question →

During an active security incident on an enterprise application server, logs indicate an unauthorized process attempting to extract LSASS memory contents. The incident response team must immediately stop potential lateral movement across the internal domain while keeping an active channel open to capture volatile RAM and run diagnostic commands. Which capability of an Endpoint Detection and Response (EDR) platform best meets these requirements?

Show answer & explanation

Answer: Initiating agent-based network host isolation to restrict endpoint traffic while maintaining security console communications

Answer

Initiating agent-based network host isolation to restrict endpoint traffic while maintaining security console communications
Agent-based host network isolation enforced by an EDR platform blocks non-essential inbound and outbound host traffic at the endpoint network layer. This stops an attacker from moving laterally across the domain, while preserving the secure control channel between the EDR agent and the central management server so security teams can capture volatile RAM and execute remediation commands.

Step-by-Step Solution

1
Analyze incident requirements and constraints
The solution must isolate internal network communications (to prevent lateral movement) without destroying volatile RAM or losing remote management access.
Maintaining telemetry and remote access is necessary for forensic analysis and containment.
2
Compare available host containment controls
Agent-based network isolation disconnects local network adapters from general traffic while preserving the EDR agent's encrypted management channel to the SOC console.
This contains the threat laterally while enabling volatile memory collection and remote command execution.

Key Concept

EDR Host Isolation and Behavioral Containment
Question 297Question →

A digital forensics specialist receives a sealed evidence bag containing a seized hard drive from a field investigator for intake into the forensic laboratory. Which of the following actions should the specialist perform first to maintain the chain of custody?

Show answer & explanation

Answer: Inspect the tamper-evident container, verify the serial numbers against the transfer documentation, and sign the custody log.

Answer

The specialist should inspect the tamper-evident container, verify serial numbers against transfer documentation, and sign the custody log.
Maintaining proper chain of custody requires documenting every physical transfer of evidence immediately upon receipt. Verifying tamper-evident seals and matching serial numbers against custody forms before signing ensures uninterrupted accountability and legal admissibility.

Step-by-Step Solution

1
Examine physical evidence packaging upon receipt
Assures the evidence bag and tamper seals have remained intact since seizure.
Physical integrity of packaging proves evidence was not altered in transit.
2
Reconcile item identification numbers with the chain of custody form
Confirms the exact physical evidence handed over matches official records.
Mismatched serial numbers undermine legal admissibility in court.
3
Record timestamp, relinquishing party, receiving party, and signature on the custody log
Establishes unbroken accountability for physical possession.
Chain of custody requires an uninterrupted chronological record of custody.

Key Concept

Chain of Custody Intake and Evidence Handling
Estimated Time:1m 0s
Question 298Question →

An enterprise administrator requires short-term elevated permissions to perform maintenance on a critical domain controller. Rather than assigning a permanent administrative account, the security operations team uses a Privileged Access Management (PAM) solution that temporarily grants rights and automatically revokes them when the maintenance window expires. Which of the following identity and access management operational concepts is best demonstrated in this scenario?

Show answer & explanation

Answer: Just-In-Time (JIT) access elevation

Answer

Just-In-Time (JIT) access elevation
Just-In-Time (JIT) access elevation provides temporary administrative privileges only when needed for a specific task, reducing standing privileges and mitigating account compromise risk.

Step-by-Step Solution

1
Analyze the operational access requirement in the scenario
The administrator requires temporary elevated permissions exclusively for an emergency maintenance window.
Persistent administrative access creates unnecessary attack surface and risk.
2
Identify the PAM privilege management mechanism applied
The PAM system provisions temporary elevated rights and revokes them automatically after maintenance.
Dynamic, time-bound privilege assignment corresponds directly to Just-In-Time (JIT) access control.

Key Concept

Privileged Access Management (PAM) and Just-In-Time (JIT) Provisioning
Question 299Question →

A security analyst is investigating an authentication alert involving an enterprise user account. Log analysis indicates that the account completed a successful multi-factor authentication (MFA) login from a corporate desktop in Chicago. Less than ten minutes later, authentication logs show successful access to cloud resources using the same account credentials via legacy POP3/IMAP protocols from an unmanaged external IP address, bypassing MFA prompts. Which of the following operational actions should the analyst take to contain the immediate risk and prevent future occurrences of this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke all active refresh tokens and terminate existing active sessions for the compromised user account; Disable legacy authentication protocols within the enterprise identity provider conditional access policies

Answer

The analyst should immediately revoke all active refresh tokens and terminate active sessions for the user account, and disable legacy authentication protocols within the identity provider policies.
Revoking active sessions cuts off existing unauthorized access from token reuse, while disabling legacy authentication protocols prevents attackers from bypassing multi-factor authentication mechanisms via protocol downgrade vectors.

Step-by-Step Solution

1
Identify the authentication gap from event logs
Determined that legacy protocols enabled an MFA bypass from an external location following a valid login.
Legacy mail protocols cannot perform interactive multi-factor authentication challenges.
2
Execute immediate account containment
Existing sessions and refresh tokens for the affected user are revoked.
Invalidating active session tokens prevents unauthorized reuse of compromised session states.
3
Implement identity policy remediation
Legacy authentication mechanisms are disabled enterprise-wide.
Ensures all incoming identity requests pass through modern authentication channels enforced by multi-factor checks.

Key Concept

Legacy Authentication Mitigation and Session Invalidation
Question 300Question →

During a security audit, a vulnerability analyst configures an authenticated network-based vulnerability scanner to audit a subnet of Linux application servers using an SSH service account. The resulting report indicates zero critical or high vulnerabilities across all hosts. However, a concurrent local agent-based scan on the same servers flags several high-severity vulnerabilities associated with missing kernel patches and outdated system libraries. Which of the following best explains why the authenticated network scan failed to detect these vulnerabilities?

Show answer & explanation

Answer: The SSH service account lacked root or elevated permissions, preventing the network scanner from querying package managers and inspecting restricted system directories.

Answer

The SSH service account lacked root or elevated permissions, preventing the network scanner from querying package managers and inspecting restricted system directories.
For an authenticated network scan to conduct an accurate patch and vulnerability audit, the scanner must log in using an account with sufficient privileges (such as root or a user with elevated sudo rights). If a low-privileged account is used, the scanner cannot access system package logs, query internal package managers, or inspect restricted system binaries, causing it to miss local software flaws that full-privilege local agents easily detect.

Step-by-Step Solution

1
Analyze the scanning context and discrepancy
An authenticated network scan reported no missing high/critical vulnerabilities, while a local agent identified missing kernel patches and library flaws.
Both scan types examine host configuration, but their depth depends on execution privilege and access context.
2
Evaluate the credential requirements for authenticated network scanning
Network vulnerability scanners connecting via SSH require administrative (root or sudo) privileges to execute local commands, inspect restricted files, and query package managers (e.g., rpm, dpkg).
If the service account used by the scanner lacks sufficient privileges, the scan degrades to basic banner grabbing or limited file checks, failing to discover local software flaws.
3
Compare against local agent privileges
Local security agents typically execute with root/SYSTEM service rights, granting them full visibility into installed software packages regardless of network access accounts.
Insufficient account permissions on remote authenticated scans explain why local agents report vulnerabilities that network scanners miss.

Key Concept

Credentialed vs. Agent-Based Scanning Privileges
PreviousPage 15 / 32Next