Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 321Question →

A Security Operations Center (SOC) analyst receives a high-severity alert from a Wireless Intrusion Prevention System (WIPS) indicating that an unauthorized rogue access point has been connected to an internal network switch port. Which of the following sequence of steps represents the correct order for responding to this incident according to standard incident response playbooks?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response actions is: 1) Validate the alert by analyzing switch port logs and netflow data; 2) Logically isolate the affected switch port via network management tools; 3) Physically remove the unauthorized access point and update NAC policies; 4) Restore standard switch port settings and verify network telemetry; 5) Conduct a post-incident review to document lessons learned.
Standard incident response frameworks (such as NIST SP 800-61) define a strict sequential process: Detection and Analysis (validating the WIPS alert via switch logs), Containment (logically isolating the switch port), Eradication (physically removing the rogue AP and updating NAC rules), Recovery (restoring switch port operation safely and monitoring telemetry), and Post-Incident Activity (conducting a lessons learned review).

Step-by-Step Solution

1
Perform Detection and Analysis
Confirmed rogue access point location and operational impact.
Before initiating containment or remediation, responders must analyze and validate the alert to verify an actual incident is taking place.
2
Implement Containment
Rogue access point network communication is disabled.
Isolating the switch port stops potential data exfiltration and unauthorized network access while preserving evidence.
3
Execute Eradication
Rogue hardware is physically removed and NAC controls are updated.
Eradication removes the root cause of the incident from the network architecture.
4
Perform Recovery
Switch port is securely re-enabled and monitored for clean operational status.
Recovery ensures affected infrastructure is returned to safe production operations with active monitoring.
5
Conduct Post-Incident Activity
Incident report created and physical security playbooks updated.
Lessons learned feed back into the incident response lifecycle to harden enterprise defenses against future incidents.

Key Concept

Incident Response Lifecycle Phases (NIST SP 800-61)
Estimated Time:1m 30s
Question 322Question →

An organization is establishing a secure onboarding process for system administrators to enforce least privilege and privileged access management (PAM). In what order should the administrative security operations team perform the following operational tasks during user onboarding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with identity verification via HR records, followed by provisioning a standard baseline account in the Identity Provider, then integrating the user into the Privileged Access Management solution, and concluding with enforcing Multi-Factor Authentication and conducting a final permission audit.
The correct sequence starts with identity verification against authoritative HR records to validate authorization. Next, a basic non-privileged account is created in the central Identity Provider to enforce least privilege. The account is subsequently registered in the Privileged Access Management (PAM) vault to manage temporary elevation securely. Finally, Multi-Factor Authentication (MFA) registration is completed and initial permissions are audited to finalize secure onboarding.

Step-by-Step Solution

1
Identity Validation
HR authorization baseline confirmed.
Prevents unauthorized account creation by confirming employment and role requirements before generating directory objects.
2
Baseline Provisioning
Standard non-privileged account created.
Establishes a core user identity following least privilege principles prior to assigning elevated rights.
3
PAM System Integration
Identity linked to vault for just-in-time privilege checkouts.
Ensures administrative activities are subject to credential vaulting, session recording, and automated access revocation.
4
MFA Activation & Audit
Strong authentication registered and RBAC baseline verified.
Ensures multifactor security controls are operational and access limits are verified before granting access to systems.

Key Concept

Identity Lifecycle Management and PAM Onboarding Operations
Question 323Question →

An enterprise infrastructure security team is performing a post-incident audit across a hybrid multi-cloud environment. Log correlation reveals that a former cloud administrator whose Active Directory account was disabled during an automated offboarding process was still able to access confidential production storage buckets two days later:

[2026-07-25 09:00:00] AD_EVENT: User 'dev_admin_04' status updated to DISABLED via HR workflow.
[2026-07-25 09:01:15] SCIM_EVENT: Provisioning sync sent DELETE request for user GUID 'usr-99482' to Cloud IdP -> HTTP 200 OK.
[2026-07-27 14:10:22] API_GATEWAY: OAuth Token Refresh Request for Client ID 'App-Storage-v2' using Refresh Token 'rt_88dfa2...'.
[2026-07-27 14:10:23] CLOUD_IDP: Token Endpoint issued new Access Token 'at_44c12...' without re-evaluating directory account state.
[2026-07-27 14:11:05] STORAGE_SERVICE: GET /buckets/prod-finance-db -> HTTP 200 OK (Authenticated via 'at_44c12...').

Which of the following operational root causes BEST explains why the offboarded administrator retained API access despite successful SCIM deprovisioning, and what remediation should be implemented?

Show answer & explanation

Answer: The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.

Answer

The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.
The log analysis demonstrates that while SCIM successfully deprovisioned the user object in the Cloud Identity Provider, the user's previously issued long-lived OAuth refresh token remained active. When the API Gateway presented this refresh token, the token endpoint generated a new access token without performing a real-time check against the user's directory account status. To prevent unauthorized post-offboarding access, IAM operations must explicitly revoke active refresh tokens and user sessions upon termination, as well as deploy Continuous Access Evaluation (CAE) to enforce real-time access policy decisions.

Step-by-Step Solution

1
Analyze the account deprovisioning log entries.
Active Directory disabled the user account and SCIM issued an automated DELETE call to the Cloud IdP, which returned HTTP 200 OK.
Confirms that account deprovisioning succeeded at both the primary directory level and the federated identity provider level.
2
Examine the OAuth token refresh event occurring two days post-offboarding.
The API Gateway presented a long-lived refresh token (`rt_88dfa2...`), and the Cloud IdP issued a new short-lived access token (`at_44c12...`) without re-evaluating whether the underlying directory user account was active.
Identifies that standard OAuth 2.0 token endpoints evaluate refresh token validity independently of live directory status unless active session revocation or real-time continuous evaluation is configured.
3
Determine the operational root cause and required security remediation.
The root cause is unrevoked refresh tokens combined with passive token validation. The required control remediation is revoking all active refresh tokens and user session state during offboarding, alongside implementing Continuous Access Evaluation (CAE).
Ensures that identity state changes are immediately propagated and enforced across token endpoints and API resource gateways in real time.

Key Concept

OAuth 2.0 Refresh Token Lifecycle, Session Revocation, and Continuous Access Evaluation (CAE)
Estimated Time:2m 0s
Question 324Question →

A security analyst is acquiring digital evidence from a running enterprise application server immediately after detecting an active intrusion. Place the evidence sources in sequence according to the standard order of volatility, starting with the MOST volatile evidence first and ending with the LEAST volatile evidence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of volatility from most volatile to least volatile is: CPU cache and processor registers, followed by System RAM and ARP cache, Temporary swap space and pagefiles, Local solid-state drive (SSD) storage, and finally Offsite optical and magnetic backup tapes.
Digital forensics standards dictate capturing evidence in order of decreasing volatility to prevent data loss. CPU registers and cache memory vanish almost instantaneously, followed by system RAM and dynamic network tables, virtual memory swap files on disk, non-volatile local drives, and lastly offsite backup media.

Step-by-Step Solution

1
Identify CPU hardware state as the highest priority.
CPU cache and processor registers are placed first.
Registers and processor cache are the most short-lived data structures in a computer system.
2
Prioritize main system RAM and active network cache.
System RAM and ARP cache are placed second.
Volatile memory contains running process code, cryptographic keys, and active network states that disappear on shutdown.
3
Order secondary virtual storage and local drives.
Temporary swap space and pagefiles are placed third, followed by local SSD storage fourth.
Swap files update dynamically during system runtime, while primary local disk storage retains persistent files.
4
Place long-term offline archives last.
Offsite optical and magnetic backup tapes are placed fifth.
Offline backup media is immutable and least susceptible to immediate modification or loss.

Key Concept

Order of Volatility
Estimated Time:1m 30s
Question 325Question →

A security analyst is investigating a alert generated by a SIEM correlation engine. The console displays the following sequential log entries collected from an enterprise web server and host database:

2026-07-27 11:05:12 | Host: WEB-01 | Apache: 192.168.1.105 - - "POST /login.php HTTP/1.1" 200 4512 "username=admin' OR '1'='1"
2026-07-27 11:05:13 | Host: WEB-01 | Auth: Successful authentication for user 'admin' from 192.168.1.105
2026-07-27 11:05:18 | Host: DB-01 | MySQL: Query executed: SELECT * FROM users WHERE username='admin' OR '1'='1'

Based on these correlated log entries, which of the following best describes the attack vector being executed and its immediate impact?

Show answer & explanation

Answer: SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.

Answer

SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.
The HTTP POST request contains the classic SQL injection payload 'OR '1'='1, which forces the database conditional check to evaluate as true. As a result, the backend application authenticates the request as the 'admin' user without verifying credentials, leading to an authentication bypass.

Step-by-Step Solution

1
Analyze the web server request payload in the Apache HTTP log.
The input string "username=admin' OR '1'='1" contains SQL syntax markers intended to alter database query logic.
Web logs reveal initial attack vectors and payload delivery.
2
Correlate web server authentication events with host database query logs.
The database executed `SELECT * FROM users WHERE username='admin' OR '1'='1'`, which evaluates to true for all rows, returning a valid admin record.
Evaluating downstream database behavior confirms if an input payload successfully altered application backend processing.
3
Determine the impact of the successful payload execution.
The web application granted a successful authentication session for 'admin' without requiring a valid password.
Connecting payload execution to log authentication outcomes identifies the threat type as SQL injection leading to authentication bypass.

Key Concept

SQL Injection (SQLi) Log Analysis
Question 326Question →

A system administrator is auditing user permissions following a departmental transfer. An employee moved from the Accounting department to Human Resources but still retains write access to the Accounting file share. Which of the following identity and access management operations should be executed to resolve this issue?

Show answer & explanation

Answer: Conduct an access privilege review to adjust permissions in accordance with least privilege

Answer

Conducting an access privilege review to adjust permissions in accordance with the principle of least privilege.
An access privilege review allows security administrators to audit user entitlements following organizational changes, revoking obsolete rights so that access aligns with the principle of least privilege.

Step-by-Step Solution

1
Identify the administrative gap
The employee maintains rights to resources no longer required for their updated job role.
Job transfers often lead to privilege creep if rights from previous roles are not explicitly revoked.
2
Select the appropriate IAM lifecycle process
Perform an access recertification/review.
Periodic or event-driven access reviews evaluate authorization boundaries to remove unneeded entitlements.

Key Concept

Account Lifecycle Operations & Privilege Recertification
Question 327Question →

An enterprise identity administrator is enforcing phishing-resistant multi-factor authentication (MFA) for privileged accounts. What is the correct sequence of events for registering a FIDO2 WebAuthn hardware security key with the Identity Provider (IdP)? Place the steps in chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct registration sequence begins with the IdP issuing a cryptographic challenge nonce to the client browser. Next, the user touches the hardware key to generate an origin-bound asymmetric key pair on the device. Then, the security key signs the challenge and returns the signature, public key, and attestation data to the IdP. Finally, the IdP validates the attestation statement and registers the public key to the user's IAM account profile.
The correct sequence follows the standard FIDO2/WebAuthn registration ceremony. First, the Identity Provider initiates the process by issuing a cryptographic challenge nonce to the browser. Second, upon user presence confirmation, the hardware token generates an origin-bound asymmetric key pair. Third, the token signs the challenge with the private key and returns the public key and attestation payload. Fourth, the Identity Provider verifies the attestation and signature before persisting the public key in the user's IAM profile.

Step-by-Step Solution

1
Identify the initial server-side trigger.
The Identity Provider generates a cryptographic challenge nonce to prevent replay attacks during WebAuthn registration.
Challenge creation must occur first so that the hardware key has fresh data to sign.
2
Determine the local hardware token response.
The user completes physical presence verification (e.g., touch sensor), prompting the security key to generate an origin-bound public/private key pair.
The key pair is created on-device in response to the browser receiving the registration challenge.
3
Trace the transmission of cryptographic proof.
The security key signs the challenge nonce using the private key and returns the signature, new public key, and attestation object to the IdP.
The IdP requires the signature and public key to verify authentic token hardware before enrollment.
4
Finalize identity binding at the Identity Provider.
The IdP authenticates the attestation metadata, verifies the signature against the issued challenge, and binds the public key to the user's IAM profile.
Saving the verified public key in the IAM user store is the final step required for future authentication.

Key Concept

FIDO2/WebAuthn Enrollment Ceremony and Cryptographic Credential Binding
Question 328Question →

A network security team receives a high-severity alert indicating anomalous telemetry from a critical database bridge host. An analyst inspects the correlated Network Flow (NetFlow) logs and DNS query events shown below:

Timestamp: 2026-07-27T14:02:11Z | SrcIP: 10.200.4.15:51204 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:07:11Z | SrcIP: 10.200.4.15:51210 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:12:10Z | SrcIP: 10.200.4.15:51216 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
DNS Lookup Query: z9x4k1.ec2-updates-sync.net -> Resolved: 198.51.100.77 (TTL: 30s)

The analyst notes that low-volume outbound encrypted connections occur at fixed 300-second intervals following short-TTL DNS queries for algorithmically generated subdomains. Which of the following mitigation actions should the security analyst perform FIRST to contain the threat while minimizing operational disruption to legitimate encrypted web services?

Show answer & explanation

Answer: Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.

Answer

Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.
The observed telemetry displays classic indicators of compromised host C2 beaconing: regular timing intervals (300 seconds), uniform low byte size (142 bytes), and dynamic DNS lookups with low TTLs. Employing DNS sinkholing (RPZ) combined with proxy-level SNI filtering precisely disrupts the malicious C2 channel without taking down legitimate outbound HTTPS access on port 443.

Step-by-Step Solution

1
Analyze flow and log telemetry indicators
Identified periodic outbound HTTPS connections (every 300 seconds) with fixed 142-byte payloads to an external IP resolved via short-TTL dynamic DNS, confirming malware C2 beaconing.
Recognizing command and control beaconing behavior isolates the precise threat mechanism.
2
Evaluate candidate mitigation controls for precision and operational impact
Determined that DNS sinkholing via RPZ combined with SNI proxy filtering specifically isolates and redirects malicious communications without impacting unrelated business HTTPS traffic.
Effective security controls must mitigate targeted threats while preserving availability for legitimate services.
3
Select the optimal initial containment step
Selected domain-specific sinkholing and SNI-based egress filtering as the preferred first-line containment strategy.
This approach disrupts C2 reachability immediately with minimal risk of broad service outage.

Key Concept

Network Security Monitoring Alert Analysis and Command & Control (C2) Beacon Containment
Question 329Question →

During security operations monitoring, an analyst receives an alert indicating anomalous API token creation and unexpected mass repository downloads originating from a compromised developer endpoint connected via VPN. The analyst confirms that an external threat actor is actively leveraging these stolen credentials to access private source code repositories. According to NIST incident response guidelines, which of the following immediate actions should the incident response team perform during the Containment phase of this incident? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Revoke active VPN sessions and invalidate all API tokens associated with the compromised developer account.; Apply restrictive host-based firewall rules to isolate the affected workstation while preserving volatile system memory for analysis.

Answer

The correct containment actions are revoking the active VPN sessions and invalidating stolen API tokens associated with the account, as well as applying host-based firewall rules to isolate the compromised endpoint while preserving volatile memory.
During the containment phase of an incident response process, the goal is to prevent the threat from spreading or causing further damage while preserving forensic evidence. Revoking compromised credentials and API tokens stops the attacker from continuing exfiltration, while network-isolating the host prevents lateral movement while preserving volatile system RAM for forensic investigation.

Step-by-Step Solution

1
Identify the primary phase of the incident response lifecycle requested in the scenario.
The scenario specifically asks for actions appropriate for the Containment phase of the NIST SP 800-61 IR framework.
Containment limits the scope and impact of an active breach before recovery steps begin.
2
Evaluate containment actions that immediately halt adversary activity without destroying digital evidence.
Revoking active credentials/tokens stops ongoing unauthorized remote access. Isolating the workstation network interface prevents lateral movement while retaining volatile RAM data.
Effective containment balances stopping threat activity with evidence preservation.
3
Distinguish containment phase actions from eradication, recovery, or post-incident activities.
Actions such as re-imaging hosts or holding lessons learned sessions belong to later IR phases.
Prematurely re-imaging hosts destroys forensic evidence before containment and investigation are complete.

Key Concept

NIST Incident Response Containment Phase Strategies
Question 330Question →

A Security Operations Center (SOC) analyst is reviewing an automated response playbook triggered by an Endpoint Detection and Response (EDR) agent following a suspected credential dumping attack against a high-value server. In what chronological sequence should the EDR agent and SOC workflow execute these actions to contain the threat and preserve forensic evidence?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Detect anomalous API memory read requests targeting LSASS, 2) Enforce host-level software network isolation, 3) Capture a volatile memory dump and terminate the offending process tree, and 4) Query tenant-wide EDR telemetry to identify other impacted endpoints.
The sequence follows the core EDR lifecycle: Detection must precede response; host-level network isolation must be established immediately after detection to block lateral spread; volatile memory collection and process termination follow isolation to safely remediate the host; and tenant-wide telemetry correlation occurs last to assess broader enterprise compromise.

Step-by-Step Solution

1
Identify initial threat activity.
The EDR behavioral monitor alerts on unauthorized memory access to sensitive system processes.
Detection provides the trigger for automated playbook execution.
2
Isolate the compromised system.
Host-based firewall rules block all inbound/outbound communication except EDR management connections.
Containment limits adversary lateral movement while keeping SOC visibility intact.
3
Acquire evidence and eradicate host execution.
Physical memory artifacts are saved to disk, followed by process tree termination.
Preserving volatile RAM prior to or simultaneously with process termination ensures critical memory-resident indicators are retained.
4
Perform enterprise scope analysis.
Telemetry indicators from the alert are cross-referenced across all enterprise endpoints.
Broader threat hunting ensures full scope eradication across the enterprise domain.

Key Concept

EDR Automated Containment and Incident Response Workflow Sequence
Question 331Question →

A security analyst conducts both a credentialed host vulnerability assessment and a non-credentialed network scan against a critical Linux database server. The non-credentialed network scan reports zero critical vulnerabilities, whereas the credentialed scan identifies multiple unpatched kernel vulnerabilities and weak local file permissions. Additionally, internal host firewalls on the server are configured to drop ICMP and block unauthenticated port probing from outside the local management subnet. Which of the following best explains the discrepancy between the two scan results?

Show answer & explanation

Answer: The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.

Answer

The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.
The option explaining that the host firewall filtered network probes while non-credentialed scans lack local OS permissions is correct. Credentialed scans log into the operating system using valid account privileges to audit internal configurations, installed packages, kernel versions, and local user rights. Non-credentialed scans view the target solely from the network perspective; if network traffic is blocked by firewalls or ACLs, or if vulnerabilities are internal to the OS configuration, non-credentialed scans will produce false negatives.

Step-by-Step Solution

1
Analyze the operational difference between credentialed and non-credentialed vulnerability scans.
Credentialed scans authenticate to the host OS using administrative credentials to inspect local files, registries, and patch status. Non-credentialed scans only examine network-exposed ports, banners, and services.
Understanding scan context determines what visibility each scanner type possesses.
2
Evaluate the impact of the target server's host firewall configuration.
The host firewall drops unauthenticated probes, causing the non-credentialed network scanner to see closed/filtered ports and miss running services.
Network filtering prevents non-credentialed scanners from reaching listening services or gathering banner information.
3
Synthesize why the credentialed scan successfully uncovered unpatched kernel flaws and weak permissions.
Because the credentialed scan authenticated locally, it bypassed network firewall restrictions and directly queried local system state (kernel version, patch history, and file system permissions).
Local system access provides complete visibility regardless of perimeter network controls.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Estimated Time:2m 0s
Question 332Question →

An IAM administrator at an enterprise health system is conducting emergency offboarding for a compromised account. The administrator disables the user's account in the on-premises Active Directory. However, an hour later, security operations detects ongoing unauthorized administrative API calls performed in the cloud SaaS platform using that identity. Upon reviewing the SCIM bridge synchronization logs, the analyst observes the following log entries:

[2026-07-27 14:02:11] WARN scim_sync_engine: PATCH /Users/usr_88291 HTTP/1.1 429 Too Many Requests - Rate limit exceeded. Account deprecation push failed.
[2026-07-27 14:02:11] INFO scim_sync_engine: Exponential backoff retry scheduled for 14,400 seconds.
[2026-07-27 14:15:00] AUDIT saas_api_gateway: Token authentication successful for usr_88291 via Bearer JWT. Active session valid.

Which of the following operational remediation actions should the analyst take FIRST to immediately terminate the unauthorized active cloud session?

Show answer & explanation

Answer: Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.

Answer

Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.
Directly revoking the active OAuth 2.0/JWT session and refresh tokens within the cloud SaaS administrative portal is the most direct and immediate operational control to kill the compromised session. Because the SCIM provisioning bridge failed due to HTTP 429 rate limiting, relying on automated account disabling will take up to four hours (the scheduled backoff period). Explicit session revocation invalidates the bearer token at the cloud gateway immediately.

Step-by-Step Solution

1
Analyze the log entries to identify the root cause of ongoing unauthorized access.
The SCIM synchronization bridge failed to push the disabled account status to the cloud provider due to HTTP 429 rate limiting, leaving the account active in the cloud while an active JWT bearer token remained valid.
Stateless authentication tokens (JWTs) remain valid until expiration or explicit token revocation at the API gateway/identity provider.
2
Evaluate containment actions for immediate session termination.
Directly revoking session tokens inside the SaaS portal terminates active sessions immediately without waiting for automated provisioning sync retries.
Token revocation is the primary operational response for terminating active session hijackings or compromised identity tokens.

Key Concept

Identity Lifecycle Operations and Active Session Revocation
Estimated Time:2m 0s
Question 333Question →

During a routine audit of enterprise endpoint logs, a threat hunter discovers an unauthorized, memory-resident process running on an HR file server that is actively sending encrypted outbound beacons to a suspicious external IP address. Initial investigation confirms an active Command and Control (C2) connection. According to standard incident response frameworks, which of the following actions should the security team take FIRST?

Show answer & explanation

Answer: Disconnect the infected HR file server from the network segment to prevent lateral movement while maintaining system power to preserve volatile RAM.

Answer

The security team should first disconnect the infected file server from the network segment to contain the threat while keeping power connected to preserve volatile memory.
According to the NIST Incident Response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), the immediate priority upon confirming an active compromise is containment. Network isolation prevents the attacker from exfiltrating data or moving laterally, while keeping the machine powered preserves volatile memory (RAM) necessary for memory forensics.

Step-by-Step Solution

1
Identify the current incident response phase
The incident is transitioning from detection and analysis to the containment phase due to active C2 traffic.
Once an active compromise is confirmed, immediate containment is required to halt communication and lateral movement.
2
Determine the appropriate immediate containment action
Network isolation stops outbound C2 beacons and prevents lateral propagation while leaving the system powered on preserves volatile memory (RAM) for analysis.
Standard NIST SP 800-61 incident response guidelines require containment before eradication and recovery steps can proceed safely.

Key Concept

Incident Response Lifecycle Phases and Containment Strategies
Question 334Question →

An EDR console triggers a high-severity behavioral alert on an enterprise application server after detecting an obfuscated PowerShell execution that attempts process injection into a legitimate system process and initiates an outbound connection to an unknown external IP address. Which of the following initial containment and investigation actions should the security analyst perform directly using EDR console capabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-level network isolation to the endpoint while maintaining management channel connectivity.; Kill the malicious process tree and capture a volatile memory dump for forensic analysis.

Answer

The analyst should isolate the host endpoint from the network while preserving EDR management communications and terminate the suspicious process tree while capturing volatile memory for investigation.
Isolating the endpoint network traffic while retaining agent communication stops malicious lateral movement without severing SOC management, and terminating process trees alongside volatile memory acquisition halts code execution while preserving volatile evidence.

Step-by-Step Solution

1
Initiate network isolation on the affected endpoint
Prevents lateral movement and command-and-control communication while leaving the EDR management channel active.
Containment is the immediate priority during an active process injection incident.
2
Terminate malicious processes and collect volatile memory telemetry
Stops malicious payload execution and captures RAM data required for memory analysis.
Preserves forensic evidence before process termination or host modification.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation and Process Containment
Estimated Time:1m 30s
Question 335Question →

Following an alert indicating that an unauthorized process attempted to dump LSASS memory on a corporate workstation, a security analyst needs to prevent the compromised host from communicating with internal network assets while preserving the host's active connection to the central EDR console for remote incident triage. Which of the following capabilities should the analyst execute?

Show answer & explanation

Answer: Host network isolation

Answer

Host network isolation is the appropriate EDR capability to stop lateral movement while retaining agent communication for incident triage.
Host network isolation configures the local software driver or agent to block all network traffic to and from the host, with an exception for the encrypted control channel to the EDR management platform. This effectively stops lateral movement across the enterprise while enabling security analysts to perform remote triage, memory dumps, and remediation actions.

Step-by-Step Solution

1
Identify containment objectives during an active host compromise
The host must be restricted from communicating with other internal network systems.
Preventing lateral movement limits the spread of post-exploitation activities across the enterprise.
2
Evaluate EDR features that isolate endpoints while retaining management control
Host network isolation applies software-defined filtering at the endpoint level, dropping user-space and local network traffic while keeping the EDR telemetry socket open.
Security operations teams require uninterrupted telemetry access to collect volatile data and execute response playbooks remotely.

Key Concept

Endpoint Detection and Response (EDR) Host Network Isolation
Estimated Time:1m 0s
Question 336Question →

During an active incident investigation on an enterprise Linux application server, an incident responder detects suspicious process execution originating from a kernel module. The server remains powered on and connected to the internal network segment. To preserve evidence while minimizing the loss of transient data, which of the following actions should the analyst perform FIRST according to the order of volatility?

Show answer & explanation

Answer: Capture the system RAM using a specialized live memory acquisition tool.

Answer

The incident responder should capture the system RAM using a specialized live memory acquisition tool prior to acquiring non-volatile storage or altering system state.
Capturing system RAM using a live acquisition tool is the correct initial action because volatile memory contains temporary process states, network connections, and loaded kernel modules that are permanently erased when the machine is shut down. According to the order of volatility, memory collection must precede persistent drive imaging.

Step-by-Step Solution

1
Identify the volatility level of candidate evidence sources.
System RAM and CPU registers are categorized as highly volatile, while local disk storage and network logs are far less volatile.
The order of volatility dictates collecting the most transient data first before it is modified or permanently lost.
2
Perform live acquisition of volatile memory.
A memory dump image is saved to secure external storage.
Preserving running processes, kernel structures, and active connections requires live RAM capture before system power state alterations occur.
3
Calculate and record cryptographic hashes of the memory dump file.
Integrity baseline is established for chain of custody tracking.
Ensures that acquired forensic artifacts can be validated against subsequent modifications during legal proceedings.

Key Concept

Order of Volatility in Digital Forensics
Question 337Question →

A Security Operations Center (SOC) analyst wants to standardize and automate the incident response steps for phishing alerts. The workflow needs to automatically extract suspicious URLs, query threat intelligence sources, and isolate affected endpoints without manual intervention. Which SOAR component should the analyst configure to execute this automated sequence of actions?

Show answer & explanation

Answer: A security playbook

Answer

A security playbook is the SOAR component used to execute automated, multi-step incident response workflows.
A security playbook is a automated linear or conditional script used by SOAR platforms to orchestrate incident response processes across connected systems. It allows SOC teams to automate repeated tasks such as extracting indicators, querying threat feeds, and isolating compromised hosts.

Step-by-Step Solution

1
Identify the primary operational requirement in the scenario.
The requirement is to define and execute an automated sequence of multi-tool actions (triage, threat lookup, endpoint isolation).
Understanding the goal distinguishes detection mechanisms from automation and orchestration mechanisms.
2
Evaluate the capabilities of Security Automation and Orchestration (SOAR).
SOAR uses playbooks (or runbooks) to codify step-by-step incident response workflows into executable logic using APIs.
Playbooks provide the automated conditional logic required to coordinate tasks across distinct security tools.

Key Concept

SOAR Playbooks and Automated Response
Question 338Question →

An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, validate the initial network alert to verify whether it represents a real event or false positive; second, examine relevant packet captures and netflow logs to determine the scope; third, isolate the affected workstation from the network; fourth, document the monitoring findings and notify the incident response team.
Effective network security monitoring follows a structured workflow: alert triage and validation must happen first, followed by telemetry inspection to scope the incident, host isolation to contain risk, and finally thorough documentation and incident escalation.

Step-by-Step Solution

1
Alert Validation
Confirmed genuine alert requiring investigation.
Before acting on an alert, security analysts must rule out false positives.
2
Telemetry & Log Analysis
Identified destination IP address and traffic volume.
Reviewing packet captures and network flows helps identify the exact nature and extent of the threat.
3
Host Containment
Workstation disconnected from local subnet.
Preventing lateral movement or exfiltration is critical once suspicious activity is confirmed and scoped.
4
Documentation & Escalation
Alert ticket updated and escalated to tier-2 incident response.
Proper documentation ensures complete chain-of-custody and smooth operational handoff.

Key Concept

Network Security Monitoring Triage & Incident Workflow
Question 339Question →

A security operations center (SOC) detects an active compromise of an administrative account with elevated privileges across hybrid cloud infrastructure. To contain the incident and restore secure identity operations according to privileged access management (PAM) best practices, place the mitigation and lifecycle remediation steps in the correct chronological sequence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for containing and remediating a compromised privileged account is: First, terminate active sessions and invalidate tokens at the IdP; second, trigger an automated SCIM push to revoke downstream federated SaaS access; third, rotate vaulted credentials within the PAM solution; fourth, perform an IGA entitlement recertification audit.
In security operations, incident containment prioritizes immediate threat suppression: active session termination and token invalidation at the IdP stop ongoing adversary actions. Once centralized sessions are severed, automated SCIM provisioning pushes account disablement to downstream federated services. Next, secrets stored in the PAM vault are rotated to prevent credential reuse. Finally, IGA recertification cleanses unauthorized entitlement changes made by the threat actor.

Step-by-Step Solution

1
Perform immediate active session containment
Active adversary connections are terminated and access tokens are invalidated at the centralized Identity Provider.
Containment must occur at the root IdP level before attackers can pivot or establish additional persistence mechanisms.
2
Synchronize account disablement across federated environments
SCIM protocol updates disable state across external Service Providers (SPs).
Relying solely on central IdP disablement without SCIM or continuous access evaluation (CAE) can leave active SaaS sessions functional until refresh tokens expire.
3
Rotate administrative secrets and vault baseline credentials
All static and dynamic passwords, API keys, and certificates associated with the compromised account are refreshed in the PAM vault.
Vault rotation ensures that harvested credentials cannot be reused to re-authenticate after sessions are killed.
4
Execute post-incident Identity Governance and Administration (IGA) recertification
All granted entitlements, group memberships, and role assignments are audited and reconciled against authorization baseline policies.
IGA recertification verifies that persistence mechanisms, such as unauthorized role assignments created during the incident, are completely removed.

Key Concept

Identity Lifecycle and Incident Response Containment in IAM Operations
Question 340Question →

Match each vulnerability assessment scan type to its defining operational characteristic.

Click a left item, then click its matching right item

Items

Credentialed Scan
Non-Credentialed Scan
Passive Scan
Intrusive Scan

Matches

Show answer & explanation

Answer

Credentialed Scan pairs with using system-level privileges for internal inspection; Non-Credentialed Scan pairs with unauthenticated external probing of exposed services; Passive Scan pairs with silently monitoring traffic flow without sending probes; Intrusive Scan pairs with executing tests that risk system instability or service disruption.
Each vulnerability scan type aligns with its specific operational profile: credentialed scans access host interiors using privileges, non-credentialed scans inspect external attack surfaces without privileges, passive scans collect intelligence from network traffic without packet injection, and intrusive scans run aggressive tests that may disrupt target availability.

Step-by-Step Solution

1
Identify the authentication level of the scan types.
Credentialed scans use local privileges for deep inspection, whereas non-credentialed scans simulate unauthenticated external observers.
Differentiating authentication capabilities clarifies internal inventory auditing versus surface attack view.
2
Analyze the operational impact and network traffic generation of the remaining scan types.
Passive scans capture existing traffic without transmitting data, while intrusive scans actively interact with vulnerabilities and risk causing service outages.
Understanding network traffic generation helps separate non-interfere monitoring from high-impact active testing.

Key Concept

Vulnerability assessment scan classifications (Credentialed, Non-Credentialed, Passive, Intrusive)
PreviousPage 17 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 17 | Examkin