Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 341Question →

During a high-volume credential stuffing campaign targeted at an enterprise web portal, an automated Security Orchestration, Automation, and Response (SOAR) playbook is triggered upon detecting repeated failed authentication alerts. To rapidly mitigate the active attack while minimizing the risk of self-inflicted service outages on critical infrastructure, which of the following actions should be configured as the initial automated response step in the playbook?

Show answer & explanation

Answer: Dynamically apply a temporary perimeter firewall drop rule for the external source IP addresses associated with the failed login requests while querying threat intelligence feeds for enrichment.

Answer

Dynamically applying a temporary perimeter firewall drop rule for the external source IP addresses associated with the failed login requests while querying threat intelligence feeds for enrichment.
The correct response dynamically blocks the external source IP addresses carrying out the attack at the perimeter while enriching alert data via threat intelligence. This encapsulates the core purpose of Security Automation and Orchestration (SOAR)—executing rapid, low-risk containment steps automatically while preserving system availability.

Step-by-Step Solution

1
Identify the primary goal of automated SOAR incident response containment.
The objective is to stop malicious ingress traffic rapidly while preserving infrastructure availability.
Effective automation must balance rapid threat containment against operational risk to core business services.
2
Evaluate the operational scope of perimeter blocking versus internal infrastructure shutdown.
Blocking external malicious IP addresses at the perimeter mitigates attack traffic without taking down internal authentication services or revoking legitimate user access rights.
Targeting external attack vectors at the boundary avoids collateral damage to internal systems.

Key Concept

Security Automation Playbook Design and Risk-Aware Containment
Question 342Question →

Place the typical steps of an automated Security Orchestration, Automation, and Response (SOAR) incident playbook in the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for an automated SOAR playbook is: 1) Ingest the alert payload automatically from a SIEM or EDR integration, 2) Enrich the alert data by querying external threat intelligence feeds for IP and domain reputation, 3) Execute active containment measures, such as applying a firewall block rule or isolating the affected endpoint, and 4) Update the incident ticket in the ITSM platform with execution logs and notify the security analyst.
An automated SOAR incident response playbook follows a logical operational flow: alert ingestion occurs first upon event detection, followed immediately by automated threat intelligence enrichment. After validating indicators, the playbook executes active containment integrations (such as network blocks or host isolation), and concludes by updating the ticketing system with full execution logs.

Step-by-Step Solution

1
Trigger workflow upon alert reception
Alert data is passed into the SOAR engine.
An automated playbook requires a triggered event payload to initiate execution.
2
Perform contextual threat enrichment
Indicators of compromise are checked against threat intelligence.
Gathering context ensures containment decisions are based on verified threat reputation.
3
Invoke automated containment integrations
Network perimeter or endpoint controls block the threat.
Containment API calls execute after conditions and enrichment checks pass.
4
Complete ticketing and analyst notification
The incident tracking system records all automated actions.
Final documentation and audit trail updates occur after containment actions finish.

Key Concept

SOAR Playbook Execution Lifecycle
Question 343Question →

An incident response team is reviewing operational logs from an enterprise Privileged Access Management (PAM) system after an emergency database restoration. The following audit log snippet was recorded during the incident:

[11:02:15] PAM_VAULT: Account 'bg_admin01' checked out by user 'j.doe'. Reason: INC-9904.
[11:02:16] PAM_VAULT: Temporary credentials issued; rotate-on-checkin timer active (4 hours).
[11:02:20] PAM_PROXY: SSH session initiated to target 'db-prod-01' by 'bg_admin01'. Live session recording enabled.
[11:45:10] PAM_VAULT: Account 'bg_admin01' manually checked back in by user 'j.doe'.

Based on identity and access management operational standards, which automated action should the PAM solution perform immediately upon account check-in?

Show answer & explanation

Answer: Rotate the credential password and terminate any active sessions associated with the checked-in account.

Answer

The PAM solution should immediately rotate the account password and invalidate any active sessions tied to the break-glass account upon check-in.
Privileged Access Management (PAM) systems use password vaulting and checked-out credential management to secure administrative access. When a user manually checks in a break-glass or shared administrative account, the PAM software immediately rotates the password in the target environment and revokes active proxy connections. This ensures the credentials used during the session cannot be reused.

Step-by-Step Solution

1
Analyze the log entries for account lifecycle events.
Identified that user 'j.doe' checked out emergency break-glass account 'bg_admin01' at 11:02:15 and checked it back in at 11:45:10.
Break-glass accounts utilize temporary credentials intended only for emergency window usage.
2
Determine the security requirements of a Privileged Access Management (PAM) vault check-in workflow.
Upon check-in, the PAM solution must ensure single-use credential integrity by invalidating the issued secret.
Automated password rotation prevents credential reuse, shoulder surfing exploits, and unauthorized persistent access.
3
Select the operational action that maintains zero-trust principle and least privilege.
The PAM system automatically rotates the password and terminates lingering proxy sessions.
This guarantees that the temporary authorization period is closed immediately upon work completion.

Key Concept

Privileged Access Management (PAM) Break-Glass Account Lifecycle & Automatic Credential Rotation
Question 344Question →

An enterprise infrastructure team discovers that an infected internal workstation executed fileless malware that established an encrypted outbound connection to an external command-and-control server. Traditional signature-based antivirus and perimeter firewalls failed to identify or restrict the malicious activity. To contain the active compromise immediately while ensuring SOC analysts retain remote telemetry collection and administrative management access to the host, which of the following Endpoint Detection and Response (EDR) capabilities should be executed?

Show answer & explanation

Answer: Initiate host-level network isolation with console management exemptions

Answer

Initiate host-level network isolation with console management exemptions
Host-level network isolation applied by an EDR agent restricts all network traffic to and from the infected endpoint, blocking outbound C2 beacons and preventing lateral movement. Crucially, EDR agents maintain an explicit channel exemption for management traffic back to the cloud or on-premises security console, allowing analysts to perform remote remediation and forensic triage.

Step-by-Step Solution

1
Analyze the incident requirements
Identified the need to instantly halt outbound command-and-control (C2) activity and internal lateral movement from a compromised host while keeping remote forensic and management connectivity intact.
Containment must occur at the endpoint layer without blinding security operations analysts.
2
Evaluate EDR containment mechanisms versus legacy defenses
Determined that host-level network isolation enforces software-defined isolation on the endpoint network stack.
Perimeter firewalls cannot stop internal lateral movement, and signature updates cannot contain active fileless threats.
3
Verify EDR console communication persistence
Confirmed that EDR host isolation policies explicitly preserve the agent-to-console management tunnel.
Analyst access to endpoint telemetry and automated playbook execution relies on maintaining this isolated management connection.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Estimated Time:1m 30s
Question 345Question →

A security analyst at a global logistics firm is reviewing central SIEM authentication logs following an automated threat alert. The log snippet reveals the following sequential events:

text
[08:15:02 UTC] IdP_SSO SUCCESS User: [email protected] Src_IP: 198.51.100.45 (New York, US) Auth: SAML+FIDO2
[08:16:35 UTC] Legacy_VPN SUCCESS User: [email protected] Src_IP: 203.0.113.88 (London, UK) Auth: RADIUS/PAP
[08:18:10 UTC] PAM_Gateway ALERT User: [email protected] Direct SSH attempt to Core_DB bypassing PAM proxy

Based on these logs, which of the following measures should the security team implement to contain the threat and mitigate the underlying operational IAM vulnerability? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Investigate potential credential harvesting or session hijacking indicated by the impossible travel time anomaly between authentication events.; Deprecate legacy authentication protocols that bypass cloud Identity Provider (IdP) conditional access policies and multi-factor authentication (MFA).

Answer

The security team must investigate potential credential harvesting or session hijacking indicated by the impossible travel anomaly, and deprecate legacy authentication protocols that bypass IdP conditional access and MFA controls.
The correct measures are analyzing the impossible travel anomaly (New York to London in 93 seconds) to detect compromised credentials or session theft, and disabling legacy authentication protocols (RADIUS/PAP) that allow threat actors to circumvent conditional access and MFA controls enforced by modern IdPs.

Step-by-Step Solution

1
Analyze SIEM authentication event timestamps and source locations.
Identified successful sign-in from New York via SAML+FIDO2 at 08:15:02 UTC followed by a successful sign-in from London via RADIUS/PAP at 08:16:35 UTC.
Authenticating from two distant geographic locations within 93 seconds represents an impossible travel scenario, indicating credential theft or compromise.
2
Evaluate authentication protocol weaknesses exposed in the logs.
Discovered that legacy RADIUS/PAP protocols remain enabled on the VPN gateway.
Legacy authentication mechanisms bypass modern IdP-enforced MFA and conditional access evaluation, creating an easily exploitable attack vector.
3
Select effective operational IAM remediation strategies.
Initiate incident response for credential harvesting/hijacking and disable/block legacy authentication protocols across all enterprise gateways.
These steps address both the immediate compromise incident and the architectural gap allowing protocol fallback attacks.

Key Concept

Identity and Access Management Operations Log Correlation and Legacy Protocol Hardening
Question 346Question →

A security operations team is refining its enterprise vulnerability management program to address scanning anomalies, deployment gaps, and risk prioritization metrics across diverse infrastructure assets. Match each vulnerability scanning scenario to its most appropriate operational response or root cause analysis.

Click a left item, then click its matching right item

Items

A scheduled credentialed scan reports zero vulnerabilities on a critical server, but raw scan logs reveal an SMB authentication failure during initial target enumeration.
A vulnerability scanner flags a critical zero-day vulnerability on an internal server, but local host isolation and air-gapped network segmentation negate the primary exploit vector.
Short-lived ephemeral container instances in a cloud environment complete their execution cycles between scheduled daily network scanning windows.
A vulnerability scanner flags an outdated software version, but local package management logs confirm the vendor backported the security patch without incrementing the main version string.

Matches

Show answer & explanation

Answer

1. The scenario involving SMB authentication failure pairs with verifying service account permissions, firewall ingress rules, and remote administrative interface access.
2. The scenario involving host isolation and air-gapped network segmentation reducing exploitability pairs with adjusting environmental and temporal CVSS metrics in the risk tracking system.
3. The scenario involving short-lived ephemeral containers missing scheduled scan windows pairs with shifting to continuous container registry scanning and CI/CD pipeline integration.
4. The scenario involving vendor backporting of security patches resulting in incorrect software version flags pairs with classifying the finding as a false positive, verifying package logs, and documenting an exception.
Each scenario represents a distinct operational operational challenge in vulnerability management: authentication troubleshooting for incomplete scans, CVSS environmental metric tailoring for isolated assets, container image registry scanning for ephemeral cloud workloads, and false positive exception handling for backported security patches.

Step-by-Step Solution

1
Analyze authentication failure logs in credentialed vulnerability scans.
Recognize that authentication failures revert credentialed scans to less comprehensive non-credentialed probes, requiring administrative credential and network access troubleshooting.
Credentialed scans require local host access via SMB/SSH to enumerate missing patches accurately.
2
Evaluate risk scoring contextual adjustments for compensating security controls.
Determine that environmental CVSS scoring factors in existing infrastructure mitigations such as air-gapping and network isolation.
CVSS Base Scores assess intrinsic vulnerability severity, whereas Environmental Scores reflect specific deployment contexts.
3
Address visibility gaps associated with dynamic microservices and cloud workloads.
Select static image scanning in registries and CI/CD pipelines over periodic network IP scanning.
Short-lived container lifecycles expire before scheduled network scanning passes occur.
4
Identify signature-based scanner inaccuracies caused by enterprise Linux patch backporting.
Confirm false positive status through local package verification and establish scanner exception rules.
Banner-grabbing scanners frequently fail to detect backported patches that leave main version strings unchanged.

Key Concept

Operational Assessment, Vulnerability Scanner Troubleshooting, and Environmental Risk Prioritization
Question 347Question →

A security administrator is auditing an organization's identity lifecycle procedures to ensure clear operational separation between authentication and authorization controls. Which of the following operational activities specifically perform authentication? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verifying a user's time-based one-time password (TOTP) token during the login sequence; Validating submitted user credential hashes against an Active Directory domain controller

Answer

Verifying a user's time-based one-time password (TOTP) token during the login sequence and validating submitted user credential hashes against an Active Directory domain controller specifically perform authentication.
Authentication strictly addresses identity verification. Verifying TOTP tokens and checking submitted credentials against an Active Directory domain controller both serve to confirm that a user is who they claim to be.

Step-by-Step Solution

1
Define authentication within IAM operations.
Authentication is the process of proving a claimed identity using credentials, tokens, or biometric factors.
Establishing identity must happen before access permissions can be evaluated.
2
Evaluate each activity against the definition of authentication.
Checking TOTP tokens and validating password hashes verify identity claims. Configuring folder permissions assigns rights (authorization), and trusting internal subnets assumes implicit network trust without identity verification.
Only mechanisms that validate claimed identity qualify as authentication operations.

Key Concept

Distinguishing identity verification (authentication) from access control enforcement (authorization) and perimeter implicit trust in IAM operations.
Question 348Question →

During network telemetry monitoring, a security technician observes an alert generated when an internal workstation attempts an unauthorized connection to a non-production server that contains simulated sensitive files and no real enterprise services. Which of the following network security monitoring concepts is actively being utilized in this scenario?

Show answer & explanation

Answer: A honeypot deployed as a deception mechanism to detect unauthorized internal access

Answer

A honeypot deployed as a deception mechanism to detect unauthorized internal access
A honeypot is a security control designed to act as a decoy to lure potential attackers or unauthorized users. Because a honeypot has no legitimate business purpose or real production traffic, any interaction or connection attempt made to it generates a high-confidence alert for security analysts.

Step-by-Step Solution

1
Analyze the network monitoring scenario
Identified a non-production decoy server designed with simulated data to attract interaction.
Security monitoring systems use intentionally vulnerable or decoy assets to alert security teams of lateral movement or unauthorized scanning.
2
Evaluate the security mechanism type
Decoy systems intended for detection and threat intelligence gathering are classified as honeypots.
Honeypots do not serve legitimate business functions, so any connection attempt to one triggers a high-fidelity alert.

Key Concept

Honeypots and Deception Technologies in Network Security Monitoring
Question 349Question →

A security technician needs to assess an internal enterprise server to accurately identify missing operating system patches and local software misconfigurations while minimizing network bandwidth usage. Which of the following scan methods should the technician execute?

Show answer & explanation

Answer: Credentialed vulnerability scan

Answer

Credentialed vulnerability scan
A credentialed vulnerability scan authenticates directly to the target operating system, allowing the scanner to inspect internal file versions, package managers, and registry settings directly. This yields precise patch and configuration details without requiring heavy network packet generation.

Step-by-Step Solution

1
Determine host assessment requirements
The scenario requires auditing internal system configuration details and patch levels without causing server instability.
Reading internal system registries and software patch databases requires local system authorization.
2
Select the appropriate vulnerability scanning method
Executing a credentialed scan allows the scanner to log in locally to perform a direct inventory.
Credentialed scans provide host-level precision, significantly reduce false positives, and consume less network bandwidth compared to intense unauthenticated probing.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Assessment
Question 350Question →

A security administrator is planning a routine security evaluation of internal server infrastructure. Which of the following are distinct operational advantages of conducting a credentialed vulnerability scan rather than a non-credentialed network scan? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Identification of missing local software patches and operating system updates; Lower rate of false positives due to direct host configuration querying

Answer

Credentialed vulnerability scans provide direct inspection of missing local patches and system configurations while significantly reducing false positives through direct host querying.
Credentialed vulnerability scans log into target systems to directly audit local file versions, installed security updates, and configuration files. This internal visibility enables precise patch verification and dramatically reduces false positives compared to unauthenticated network probing.

Step-by-Step Solution

1
Analyze the operational differences between credentialed (authenticated) and non-credentialed (unauthenticated) vulnerability scans.
Credentialed scans log into target host operating systems using administrative access, allowing direct inspection of patch registries, local settings, and software inventories.
Understanding scanner access privileges highlights what host-level visibility is gained.
2
Evaluate the impact on reporting accuracy and false positive rates.
Direct host access provides definitive data on installed patch levels, reducing false positives caused by generic network banner grabbing.
Authenticated access eliminates guesswork for services hidden behind network security controls or running on non-standard ports.
3
Differentiate vulnerability scanners from active control mechanisms like firewalls or automated remediation systems.
Vulnerability scanners remain detective assessment tools and do not directly enforce network firewall filtering or alter security control classifications.
Scanners produce diagnostic data; mitigation requires separate patch management or configuration enforcement processes.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Question 351Question →

Following an influx of fileless malware alerts detected by an Endpoint Detection and Response (EDR) solution, a Security Operations Center (SOC) team is refining an automated Security Orchestration, Automation, and Response (SOAR) playbook. During initial testing, a high-severity alert triggered the playbook to automatically isolate a primary Domain Controller, causing a critical network outage. Which playbook design modification BEST balances rapid threat containment with enterprise operational resilience to prevent future accidental outages?

Show answer & explanation

Answer: Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.

Answer

Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.
Implementing conditional evaluation of asset tags—mandating analyst approval prior to isolating critical systems like Domain Controllers while permitting automatic containment for standard endpoints—strikes the correct balance between rapid threat mitigation and enterprise system availability.

Step-by-Step Solution

1
Analyze the incident trigger and operational impact
Identified that unvalidated, fully automated isolation of critical core assets (such as Domain Controllers) introduces high risk of self-inflicted service outages.
SOAR playbooks must balance containment velocity against the operational impact of false positives or unvalidated high-severity alerts.
2
Evaluate risk mitigation strategies within playbook logic
Determined that integrating asset tag evaluation (e.g., critical infrastructure vs. standard endpoint) enables contextual response pathways.
Standard workstation endpoints can be automatically contained immediately, whereas critical infrastructure assets can route to an analyst queue for quick manual validation.
3
Select the optimal playbook containment design
Incorporating conditional branching and human-in-the-loop approval for critical assets prevents unplanned operational downtime while retaining rapid automated response for non-critical systems.
This approach preserves enterprise availability while preserving automated containment capabilities across the rest of the environment.

Key Concept

SOAR Automated Response Playbook Design and Asset-Aware Containment Logic
Question 352Question →

A security operations analyst at a financial institution is investigating an unauthorized change alert on a core network device. The organization relies on a central TACACS+ server integrated with an LDAP directory for network device administration. The analyst reviews the following TACACS+ audit log entries:

text
[2026-07-27 14:15:02 UTC] AUTHEN PASS: user="net_admin1" port="tty1" rem_addr="10.1.5.22"
[2026-07-27 14:15:10 UTC] AUTHOR PASS: user="net_admin1" cmd="show running-config"
[2026-07-27 14:16:05 UTC] AUTHOR FAIL: user="net_admin1" cmd="configure terminal" reason="Privilege level insufficient"
[2026-07-27 14:16:12 UTC] AUTHEN PASS: user="svc_monitor" port="tty2" rem_addr="10.1.5.50"
[2026-07-27 14:16:30 UTC] AUTHOR PASS: user="svc_monitor" cmd="configure terminal" matched_rule="rule_group_ops_override"

Further inspection confirms that `svc_monitor` is a low-privilege automated monitoring account with read-only rights in the LDAP directory. Which of the following operational misconfigurations best explains why `svc_monitor` was permitted to run the restricted command while `net_admin1` was denied?

Show answer & explanation

Answer: An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.

Answer

An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.
TACACS+ strictly separates authentication from authorization, evaluating authorization on a granular per-command basis. The log shows that `svc_monitor` authenticated successfully via LDAP but executed the command because a specific TACACS+ authorization rule (`rule_group_ops_override`) explicitly permitted it, overriding directory-level role expectations.

Step-by-Step Solution

1
Analyze the TACACS+ log entries for authentication and authorization events.
Both `net_admin1` and `svc_monitor` passed authentication (`AUTHEN PASS`). However, `net_admin1` failed authorization for `configure terminal`, whereas `svc_monitor` passed authorization due to `matched_rule="rule_group_ops_override"`.
Determining where the access decision diverged is essential to isolating the misconfiguration.
2
Evaluate TACACS+ operational architecture features regarding AAA separation.
TACACS+ completely separates Authentication, Authorization, and Accounting (AAA). Authorization policies are evaluated on a per-command basis using TACACS+ policy sets.
Understanding TACACS+ behavior explains how authorization can yield results independent of central authentication store roles.
3
Identify the operational root cause.
The local TACACS+ server contained a custom authorization rule (`rule_group_ops_override`) that matched `svc_monitor` and permitted command execution despite its low-privilege group status in LDAP.
Overly permissive or leftover local command authorization rules override intended centralized privilege restrictions.

Key Concept

TACACS+ AAA Decoupling and Per-Command Authorization
Estimated Time:2m 0s
Question 353Question →

A security analyst inspecting telemetry from an Endpoint Detection and Response (EDR) system observes an unapproved administrative utility downloading an encoded payload from an external domain, followed by an immediate attempt to modify host boot configurations. Which of the following is the MOST effective immediate action the analyst should take using the EDR platform to contain the incident?

Show answer & explanation

Answer: Perform host-level network isolation via the EDR console while keeping the management channel open for live investigation.

Answer

Initiating host-level network isolation via the EDR console while retaining agent management connectivity is the most effective containment step.
Isolating the endpoint at the network layer via EDR restricts network access (stopping command-and-control communication and lateral movement) while preserving the agent connection so analysts can continue investigating and gathering memory forensics.

Step-by-Step Solution

1
Analyze the telemetry alert
Identified suspicious command execution and payload download on an active endpoint.
Determines the immediate severity and potential for lateral movement.
2
Select the containment control
Apply EDR host-level network isolation.
Host isolation cuts off network connectivity to prevent spread, while maintaining the EDR control plane for remote triage.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Question 354Question →

A security administrator notices during a routine audit that an employee who transferred to a new department retains active access permissions from their previous job role. Which identity and access management procedure should be executed to address this issue?

Show answer & explanation

Answer: Perform user permission recertification and role adjustment

Answer

Perform user permission recertification and role adjustment
Performing user permission recertification and role adjustment systematically reviews an account's granted entitlements, revoking stale access rights to enforce the principle of least privilege following role transfers.

Step-by-Step Solution

1
Identify the core access issue resulting from the internal department transfer.
The user retains privilege creep (unneeded legacy access rights).
Changes in job roles require aligning permissions with current duties.
2
Evaluate the appropriate IAM operational control.
Permission recertification and privilege adjustment resolves inappropriate access.
Recertification audits existing rights and removes unneeded authorizations.

Key Concept

Account Lifecycle Management and Permission Recertification
Question 355Question →

A Security Operations Center (SOC) analyst is inspecting web server access logs ingested into a SIEM platform. An automated correlation rule generated a low-priority informational alert after detecting directory path indicators in incoming HTTP requests. The SIEM displays the following sequential log entries:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "GET /api/v1/download?file=../../../../etc/passwd HTTP/1.1" 200 4096
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "GET /api/v1/download?file=..%2f..%2f..%2f..%2fetc%2fshadow HTTP/1.1" 403 280

Based on these log entries, which of the following conclusions accurately identifies the security incident status and the required SIEM management action?

Show answer & explanation

Answer: A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.

Answer

A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.
The correct response recognizes that the HTTP status code 200 combined with a 4096-byte payload on the request containing path traversal sequences (../../../../etc/passwd) indicates that the application successfully served file contents to the attacker. Because the initial SIEM alert was categorized as low-priority/informational, the analyst must escalate the rule severity to ensure immediate incident response triggers upon successful exploitation.

Step-by-Step Solution

1
Analyze the request URI parameters in both log entries
Identified path traversal patterns (../../../../ and URL-encoded ..%2f..%2f..%2f..) targeting restricted system files (/etc/passwd and /etc/shadow).
Determining the threat vector requires evaluating the input payload within the HTTP GET request string.
2
Evaluate the HTTP response status codes and byte sizes in sequence
The first request returned HTTP status 200 (OK) with 4096 bytes transferred. The second request returned HTTP status 403 (Forbidden) with 280 bytes.
HTTP 200 indicates the server fulfilled the request and returned file content, whereas HTTP 403 indicates subsequent access blocking.
3
Determine the incident impact and required SIEM management response
Successful unauthorized retrieval of /etc/passwd confirms a successful breach. The low-priority SIEM rule failed to reflect the true severity.
SIEM correlation rules must be tuned to alert with high severity when directory traversal attempts return HTTP 200 success codes.

Key Concept

Directory Traversal Log Analysis and SIEM Alert Tuning
Question 356Question →

A security operations team is investigating an incident where an attacker maintained active access to enterprise cloud applications following the revocation of a compromised user's directory credentials. The centralized Identity Provider (IdP) successfully initiated password resets and disabled the directory account in response to a SIEM alert, yet the attacker continued performing privileged actions in single sign-on (SSO) web applications for several hours. Which of the following operational root causes directly contributed to this continuous unauthorized access and failure of immediate session termination? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The Identity Provider revoked user refresh tokens without invalidating active stateless JSON Web Tokens (JWTs) or clearing active session caches at the Relying Party applications.; The application architecture relied on standard OAuth 2.0 access token lifetimes without implementing Continuous Access Evaluation Protocol (CAEP) or real-time event-driven session revocation.

Answer

The persistent access was caused by the IdP revoking refresh tokens without invalidating active stateless JWT access tokens or session caches at the application tier, alongside the absence of Continuous Access Evaluation Protocol (CAEP) integration to communicate real-time credential revocation events to relying applications.
In modern federated IAM architectures, revoking credentials at the identity provider (IdP) stops new authentication requests and refresh token usage. However, active sessions established via stateless access tokens (such as JSON Web Tokens) remain valid at relying applications until their expiration time unless active token invalidation (or session cache clearing) is performed. Furthermore, implementing Continuous Access Evaluation Protocol (CAEP) allows identity providers to push real-time security events (e.g., credential revocation, user disablement) directly to relying parties, enabling immediate termination of active sessions across applications.

Step-by-Step Solution

1
Analyze the IAM session flow and revocation mechanics
Disabling an account or revoking refresh tokens in an IdP stops new authentication attempts and token refreshes, but does not inherently revoke currently active access tokens already issued to client applications.
Stateless access tokens (like JWTs) are verified digitally by applications without querying the IdP on every API request until the token expires.
2
Evaluate real-time event integration protocols between IdPs and Relying Parties
Without CAEP or shared signals framework (SSF), relying party applications operate in isolation from IdP status changes until existing token lifetimes lapse.
CAEP enables real-time synchronization of security events (e.g., account disablement, session revocation) between identity providers and service providers.
3
Identify misattributed infrastructure controls
Network perimeter firewalls, RADIUS servers, and TACACS+ AAA configurations govern network access and infrastructure device logins, not web SSO access token lifecycles.
Operational IAM incident response requires distinguishing identity protocol mechanics (OAuth/OIDC/SAML) from network layer AAA controls.

Key Concept

Federated Identity Session Lifecycles & Real-Time Revocation (CAEP/JWT Invalidation)
Question 357Question →

An IT security operations team wants to streamline incident triage by automatically connecting threat intelligence feeds with security monitoring tools and executing pre-defined response actions across different platforms. Which technology should the team implement to achieve this orchestration and automation?

Show answer & explanation

Answer: Security Orchestration, Automation, and Response (SOAR)

Answer

Security Orchestration, Automation, and Response (SOAR)
Security Orchestration, Automation, and Response (SOAR) integrates disparate security systems and software, allowing organizations to execute automated playbooks that enrich alerts and streamline response actions across the enterprise.

Step-by-Step Solution

1
Analyze the operational requirement given in the scenario.
The requirement calls for integrating disparate security tools and automating threat triage using pre-defined response actions.
Combining disparate tools into unified workflows requires an orchestration layer.
2
Compare the core functions of security solutions against the requirement.
SOAR connects threat feeds and security tools to run automated response playbooks, fulfilling all requirements.
SOAR is specifically designed for cross-platform security automation and workflow orchestration.

Key Concept

Security Automation and Orchestration (SOAR)
Question 358Question →

During an internal fraud investigation, a security analyst seizes a desktop computer and generates a forensic image of the primary storage drive. Months later, during a legal proceeding, opposing counsel moves to suppress the forensic disk image evidence. Which of the following circumstances would serve as the strongest basis for suppressing the evidence due to a breakdown in the chain of custody?

Show answer & explanation

Answer: An unrecorded gap exists in the evidence log showing a missing signature during the physical transfer of the drive between two investigators.

Answer

An unrecorded gap in the physical evidence log showing a missing signature during transfer serves as the strongest basis for suppressing evidence due to a chain of custody failure.
The chain of custody is a strict administrative and legal process requiring detailed record-keeping of every individual who collected, transported, accessed, or secured physical evidence. An unrecorded transfer or missing custodian signature creates an unverified gap in possession, making it impossible to legally guarantee that the evidence was not tampered with, swapped, or altered.

Step-by-Step Solution

1
Analyze the core objective of maintaining a chain of custody.
Chain of custody requires a complete, unbroken, chronological documentation trail of every person who possessed, transferred, or examined physical evidence.
Any unaccounted period or missing transfer sign-off compromises legal verification that evidence remained unaltered while in law enforcement or analyst custody.
2
Distinguish legal custodial requirements from technical acquisition choices.
Gaps in transfer logs directly breach procedural custody rules, whereas choices regarding software vs. hardware write-blockers, hashing algorithms, or network acquisition interfaces represent technical methodology.
Technical acquisition choices do not undermine evidence admissibility as long as verification hashes match and custodial logs are maintained.

Key Concept

Chain of Custody and Evidence Admissibility
Question 359Question →

A security technician is configuring network security monitoring rules to detect active compromises and data exfiltration. Which of the following observations represent valid network-level threat indicators that should trigger an immediate security alert? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Outbound network flow logs showing persistent connection attempts to known malicious Command and Control (C2) IP addresses; Network Intrusion Detection System (NIDS) alerts identifying anomalous ICMP packet payloads containing encoded data transfers from an internal server

Answer

The valid indicators of network-based compromise requiring alerts are persistent outbound connections to known Command and Control (C2) IP addresses and NIDS alerts identifying anomalous ICMP packet payloads carrying encoded data.
Outbound connection attempts to known Command and Control infrastructure and protocol anomalies like data-laden ICMP payloads represent real-time network layer telemetry indicating compromised internal assets and active tunneling, making both essential network alert triggers.

Step-by-Step Solution

1
Evaluate network connection telemetry for outbound threat indicators
Persistent outbound traffic to known C2 addresses confirms active malware beaconing from internal hosts.
Compromised endpoints routinely initiate outbound sessions to external command infrastructure to receive instructions.
2
Analyze protocol payloads for covert channel activity
Anomalous ICMP packets carrying data payloads signal ICMP tunneling.
Standard ICMP traffic carries simple echo request/reply data; embedding arbitrary data payloads indicates protocol misuse for data exfiltration.

Key Concept

Network Security Monitoring and Alerting
Question 360Question →

A Security Operations Center (SOC) team deploys an automated Security Orchestration, Automation, and Response (SOAR) playbook designed to mitigate rapid ransomware propagation. The playbook triggers automatically upon receiving high-severity Endpoint Detection and Response (EDR) telemetry, querying external threat intelligence APIs to verify file hashes before calling a Network Access Control (NAC) API to isolate the host network interface. During a red-team simulation, synthetic high-volume alert telemetry from an active primary domain controller causes the playbook to execute auto-isolation on the server, resulting in an immediate domain-wide operational outage. Which modification to the SOAR playbook logic or execution configuration best mitigates the operational risk of automated service disruption while maintaining rapid containment capabilities for verified threats?

Show answer & explanation

Answer: Implement conditional asset tagging with human-in-the-loop approval gates for tier-0 infrastructure alongside scoped containment actions such as perimeter firewall blocking instead of full interface isolation.

Answer

Implementing asset-aware conditional logic with human-in-the-loop (HITL) approval gates for critical tier-0 infrastructure and utilizing scoped containment controls best balances operational availability with incident response automation.
The correct answer addresses the root cause of the outage by introducing asset awareness and conditional execution paths into the SOAR playbook logic. For critical infrastructure (such as domain controllers or key database servers), automated full-network isolation poses a greater risk to business continuity than the threat itself. Implementing human-in-the-loop (HITL) approval gates or lower-impact microsegmentation/egress filtering preserves security operations without causing enterprise-wide outages.

Step-by-Step Solution

1
Analyze the operational vulnerability in the existing automated playbook
The SOAR playbook performs aggressive automated network interface isolation indiscriminately on any host, including critical tier-0 domain controllers.
Automated containment actions must evaluate the operational criticality of the target system to prevent self-inflicted denial-of-service events.
2
Evaluate containment actions based on risk and asset classification
Tier-0 systems require human-in-the-loop approval or non-disruptive scoped containment (e.g., blocking outbound external traffic rather than full port shutdown).
Asset awareness in playbooks ensures that high-impact automated actions are constrained when applied to critical enterprise services.
3
Differentiate effective logic fixes from misconfigured or non-functional options
Changing thresholds increases false positives, reclassifying control metadata does not change execution behavior, and imposing interactive MFA breaks system-to-system API authentication.
Only logic adjustments incorporating asset tags and approval workflow gates properly resolve the operational risk.

Key Concept

SOAR Playbook Design & Safety Controls
Estimated Time:2m 0s
PreviousPage 18 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 18 | Examkin