Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

An Incident Response Team (IRT) responds to a active command-and-control (C2) beaconing alert on a critical internal database server. Place the following incident response actions in the correct sequential order according to the standard NIST SP 800-61 incident response lifecycle, starting with the earliest action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential sequence follows the NIST SP 800-61 lifecycle: Network Isolation (Containment) -> Volatile Memory Capture (Evidence Preservation) -> Malware/Persistence Removal (Eradication) -> Clean Backup Restoration (Recovery) -> Lessons-Learned Session (Post-Incident Activity).

Under NIST SP 800-61, incident response progresses strictly through Containment (network isolation), Forensic Evidence Preservation (memory acquisition), Eradication (malware and backdoor removal), Recovery (system restoration from clean backups), and Post-Incident Activity (lessons learned review).

Step-by-Step Solution

Execute initial containment by disconnecting the host from the network

Stops active C2 communications and prevents lateral movement.

Containment limits incident scope and stops ongoing damage immediately.

Preserve volatile evidence

Obtains volatile RAM and process state while the system remains intact.

Evidence collection must occur before system modifications corrupt forensic artifacts.

Perform system eradication

Removes malicious software, persistence mechanisms, and compromise artifacts.

Eradication ensures the adversary cannot re-establish control once restored.

Execute operational recovery

Restores database operations from known-good backups and reinstates production status under heightened monitoring.

Recovery safely returns services to production after confirming eradication.

Conduct post-incident review (lessons learned)

Identifies root cause, updates playbooks, and addresses operational gaps.

Post-incident analysis improves organizational resilience against future incidents.

Key Concept

NIST SP 800-61 Incident Response Lifecycle

Question 22Question →

Match each enterprise security assessment requirement with the vulnerability scanning method or configuration best suited to satisfy it.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each assessment scenario correctly maps to its ideal vulnerability assessment approach: evaluating remote endpoint drift locally without VPN overhead requires Agent-Based Scanning; assessing sensitive legacy OT systems without active probe disruption requires Passive Network Scanning; testing live web applications for runtime flaws requires Dynamic Application Security Testing (DAST); and conducting authenticated central scans across network hosts using domain privileges requires Credentialed Network-Based Scanning.

Matching each scanning scenario requires balancing assessment goals against operational constraints. Agent-based scanning minimizes network overhead for remote laptops by executing locally. Passive scanning prevents fragile OT system crashes by analyzing existing network traffic. Dynamic Application Security Testing (DAST) assesses live web applications without source code. Credentialed network scanning provides deep visibility into network-connected hosts using administrative accounts.

Step-by-Step Solution

Analyze the constraint of remote worker endpoints and VPN bandwidth limitations.

Local host execution is required to avoid heavy network traffic over VPN, pointing directly to agent-based assessment.

Agent-based assessment offloads processing and scan execution locally to the endpoint.

Evaluate the sensitivity of legacy Operational Technology (OT) equipment.

Active scanning packets can overload fragile legacy stacks; non-intrusive traffic inspection (passive scanning) is required.

Passive scanners observe mirror/SPAN ports without sending traffic to target OT controllers.

Determine the application security testing methodology for live web applications.

Black-box assessment of a running web application corresponds to Dynamic Application Security Testing (DAST).

DAST interacts with running application interfaces to detect runtime flaws.

Identify the network scan configuration utilizing elevated permissions across a LAN.

Connecting remotely over the network with administrative privileges describes credentialed network scanning.

Credentialed network scans leverage administrative access over network management protocols to inspect internal configurations.

Key Concept

Vulnerability Scanning Methodologies and Deployment Models

Question 23Question →

Security telemetry indicates that an administrative workstation has executed an unauthorized script attempting to establish a reverse shell to an external command-and-control (C2) server and extract system credentials. Which of the following response actions should an analyst perform directly using the Endpoint Detection and Response (EDR) agent to contain the threat while preserving forensic evidence? (Select TWO.)

Select all that apply

Apply host network isolation through the EDR console to restrict network traffic exclusively to the security management channel.

Reconfigure the edge firewall access control list to block outbound traffic from the entire local workstation subnet.

Terminate the unauthorized process tree and quarantine the associated file artifacts using EDR response actions.

Perform an immediate hard power cycle of the system to clear volatile memory and stop script execution.

Show answer & explanation

Answer: Apply host network isolation through the EDR console to restrict network traffic exclusively to the security management channel.; Terminate the unauthorized process tree and quarantine the associated file artifacts using EDR response actions.

Answer

The correct containment and remediation actions are applying host network isolation through the EDR console and terminating the unauthorized process tree while quarantining file artifacts via EDR response tools.

Applying host network isolation via EDR blocks lateral network movement and external C2 communications while keeping the system running to preserve volatile RAM. Terminating the process tree and quarantining malicious files neutralizes execution directly at the endpoint level via native agent capabilities.

Step-by-Step Solution

Identify endpoint containment actions that prevent threat propagation without destroying system state.

Applying host network isolation blocks internal lateral movement and external C2 connections while preserving volatile RAM and maintaining agent connectivity.

Host isolation preserves volatile evidence while severing unauthorized network channels.

Apply process-level remediation directly on the endpoint using EDR execution management capabilities.

Killing the malicious process hierarchy and quarantining file artifacts halts further threat activity.

Direct EDR process termination neutralizes active attacks without resetting host hardware state.

Key Concept

Endpoint Detection and Response (EDR) Containment and Remediation Controls

Question 24Question →

A security administrator is reviewing identity and access management protocol configurations for network infrastructure management. When evaluating TACACS+ against RADIUS for central administrative access control, which of the following operational characteristics are specific to TACACS+? (Select TWO.)

Select all that apply

It encrypts the entire body of the communication packet.

It separates authentication and authorization services into distinct operational processes.

It combines authentication and authorization into a single unified transaction.

It relies on network perimeter placement to implicitly trust administrative connections.

Show answer & explanation

Answer: It encrypts the entire body of the communication packet.; It separates authentication and authorization services into distinct operational processes.

Answer

TACACS+ encrypts the entire body of the packet and separates authentication and authorization services into distinct operational processes.

TACACS+ is designed for administrative device management. It encrypts the complete body of every packet exchanged between the client and server and strictly separates authentication and authorization operations, enabling granular control over administrative commands.

Step-by-Step Solution

Analyze protocol encryption scope for administrative access.

Identify that TACACS+ encrypts the entire payload of the packet during transmission.

Full packet payload encryption protects credentials and sensitive commands from eavesdropping.

Evaluate AAA architecture modularity.

Determine that TACACS+ separates authentication and authorization into modular functions.

Separating AAA functions enables granular authorization controls on individual administrative commands.

Key Concept

TACACS+ Protocol Operational Characteristics

Question 25Question →

A security analyst is tasked with acquiring digital evidence from a detached persistent cloud storage volume associated with a compromised virtual machine. To ensure the collected storage volume data remains legally admissible and mathematically verifiable throughout the forensic investigation, which of the following procedures must the analyst perform? (Select TWO.)

Select all that apply

Calculate and record cryptographic hash values of the storage volume immediately before and after generating the forensic copy.

Maintain a detailed log recording the timestamp, handler identity, evidence control transfers, and purpose for every custody change.

Attach and boot the disk volume inside a temporary virtual machine to inspect running processes and modified files prior to imaging.

Substitute bit-stream cryptographic image hashing with cloud administrative API audit trail signatures for integrity verification.

Show answer & explanation

Answer: Calculate and record cryptographic hash values of the storage volume immediately before and after generating the forensic copy.; Maintain a detailed log recording the timestamp, handler identity, evidence control transfers, and purpose for every custody change.

Answer

The correct procedures are calculating cryptographic hash values of the storage volume before and after creating the forensic copy, and maintaining a detailed log recording timestamps, handler identities, transfers, and purpose for every evidence custody change.

Generating cryptographic hash values of evidence before and after duplicate acquisition confirms bit-level data integrity. Simultaneously, maintaining an explicit chain of custody log ensures continuous accountability and legal admissibility by tracking who handled the evidence at all times.

Step-by-Step Solution

Identify key requirements for digital evidence preservation and chain of custody.

Digital forensics requires proving bit-stream data integrity and maintaining an unbroken audit trail of physical/logical evidence possession.

Evidence must be verifiable and legally admissible in formal investigations.

Evaluate data integrity verification methods.

Generating matching cryptographic hashes (such as SHA-256) before and after copying confirms no modifications occurred during disk acquisition.

Any alteration in source or destination media results in a completely different hash output.

Evaluate chain of custody documentation standards.

Logging every individual who takes custody of evidence, along with exact dates, times, and transfer justifications, prevents claims of evidence tampering.

Chain of custody documentation establishes continuous legal control and accountability.

Key Concept

Digital Forensics Integrity Verification and Chain of Custody

Question 26Question →

A Security Operations Center (SOC) team is responding to a high-severity Endpoint Detection and Response (EDR) alert on a Linux server hosting critical API microservices. Telemetry indicates an adversary attempted to load an unsigned rootkit kernel module via the `init_module` system call while disabling the local `auditd` daemon. Which of the following initial containment and forensic actions should be executed to halt potential threat activity while preserving crucial digital evidence? (Select TWO.)

Select all that apply

Apply software-level host isolation via the EDR agent interface to cut endpoint communication while preserving the agent management tunnel.

Trigger an automated volatile memory capture (RAM dump) on the system before terminating suspicious processes or restarting host services.

Reconfigure perimeter network firewalls to block all inbound traffic targeted at the server's public IP address.

Send a remote hard-reboot signal to flush the unverified kernel module and reset system memory to a known baseline.

Show answer & explanation

Answer: Apply software-level host isolation via the EDR agent interface to cut endpoint communication while preserving the agent management tunnel.; Trigger an automated volatile memory capture (RAM dump) on the system before terminating suspicious processes or restarting host services.

Answer

The correct response actions are applying software-level host isolation through the EDR management plane and initiating a volatile memory capture before executing process termination or host resets.

The correct measures involve isolating the host using the EDR agent's software control features and capturing volatile memory (RAM) before taking invasive recovery actions. Host isolation via EDR restricts network access to stop lateral movement while preserving the out-of-band agent communication link required for investigation. Capturing RAM preserves volatile kernel-mode artifacts and active memory structures necessary for rootkit forensic analysis.

Step-by-Step Solution

Evaluate the immediate threat posed by kernel-level tampering and potential lateral movement.

Identify that network isolation is required immediately to restrict adversary activity.

Kernel module manipulation indicates root-level access; network isolation prevents lateral propagation across adjacent API microservices.

Select the appropriate isolation mechanism that maintains security analyst management capabilities.

EDR agent host isolation severing non-management traffic.

Agent-based isolation blocks unauthorized network traffic while retaining the telemetry and remote shell capabilities of the EDR tool.

Prioritize digital evidence preservation according to the order of volatility.

Perform a volatile memory capture prior to host reboot or process termination.

Kernel modules and memory-resident rootkits reside in volatile system RAM and must be captured before rebooting or clearing process states.

Key Concept

EDR Host Containment & Volatile Evidence Preservation Workflow

Question 27Question →

An enterprise security engineer is configuring vulnerability assessment approaches across specialized network segments and target environments. Match each operational scenario on the left with the scanning methodology or configuration best suited to satisfy its operational requirements on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each scenario maps to its respective specialized methodology: off-network endpoints use agent-based scanning; sensitive SCADA environments require passive network monitoring; web application testing uses DAST; and perimeter testing requires external non-credentialed scanning.

Each scenario maps directly to its intended scanning approach based on target architecture, network reachability, protocol layer, and operational risk tolerance.

Step-by-Step Solution

Analyze the operational constraints of mobile workforce endpoints operating without VPN connection.

Agent-based scanning operates locally on endpoints and reports back independently of local network connectivity, matching the mobile workforce requirement.

Network-based scanning requires reachable IP pathways or VPN connections that off-network laptops lack.

Evaluate the sensitivity constraints of legacy operational technology (SCADA) environments.

Passive network monitoring listens to wire traffic without sending active probe packets that could fault fragile PLCs.

Active probing can cause legacy OT devices to crash or behave unpredictably.

Examine the requirements for evaluating running web application code flaws without OS credentials.

DAST probes the web application protocol stack in a running state, identifying web-layer vulnerabilities without requiring host OS logins.

DAST evaluates input handling and session security externally at the application layer.

Determine the methodology for assessing perimeter exposure from an untrusted external perspective.

External non-credentialed scanning targets public-facing IP addresses outside the perimeter without authentication credentials.

This accurately mimics the vantage point and access level of an external attacker.

Key Concept

Vulnerability Scanning Methodologies and Environment-Specific Configurations

Question 28Question →

A security analyst is monitoring network alerts and observes repeated connection attempts targeting an isolated server in the DMZ. The server contains no actual production data or legitimate services and is specifically set up to decoy potential attackers. Which type of security tool is generating alerts for this monitored activity?

A honeypot deployed to detect unauthorized activity and collect threat intelligence

An inline Network Intrusion Prevention System (NIPS) active in blocking production network traffic

A Web Application Firewall (WAF) configured to sanitize Cross-Site Scripting (XSS) scripts

A perimeter router ACL applied to fix local application software vulnerabilities

Show answer & explanation

Answer: A honeypot deployed to detect unauthorized activity and collect threat intelligence

Answer

A honeypot deployed to detect unauthorized activity and collect threat intelligence

A honeypot is a security mechanism designed to act as a decoy to lure cyberattackers. Because a honeypot does not host legitimate services or production data, any connection attempt to it generates a high-fidelity alert for security analysts to monitor and analyze threat tactics.

Step-by-Step Solution

Analyze the scenario context provided in the network security monitoring alert

Identified that the target system contains no production data and exists solely as a decoy target

Systems intended purely to attract and detect unauthorized interaction are deception technologies

Match the observed function to network security monitoring concepts

Recognized that a honeypot serves as a decoy monitoring tool to observe attack vectors and gather intelligence

Any interaction with a honeypot is inherently suspicious since it hosts no real business functions

Key Concept

Honeypot Deception and Network Security Monitoring

Estimated Time:45s

Question 29Question →

During an active threat triage, telemetry from a critical workstation's Endpoint Detection and Response (EDR) agent alerts to suspicious memory modifications. An unprivileged process performed memory injection into a legitimate system binary using direct Native API system calls, bypassing user-mode API hooks. The rogue process has created an unbacked memory region executing stealthy code, but no outbound command-and-control (C2) network sockets have been established yet. Which action should the security analyst take FIRST via the EDR platform to mitigate risk without destroying essential volatile forensic evidence?

Enable network-level host isolation through the EDR console while keeping the agent communication tunnel active.

Execute an aggressive remote agent command to forcibly terminate the parent system process tree.

Update the perimeter gateway firewall rules to block inbound and outbound traffic for the endpoint's IP address.

Push a legacy signature update package to the endpoint and initiate a full disk antivirus scan.

Show answer & explanation

Answer: Enable network-level host isolation through the EDR console while keeping the agent communication tunnel active.

Answer

Enable network-level host isolation through the EDR console while keeping the agent communication tunnel active.

Enabling network-level host isolation via the EDR agent isolates the host from all network communication (except the secure EDR management channel). This prevents any impending C2 connections or internal lateral movement while maintaining system power and process states so security analysts can capture volatile RAM evidence.

Step-by-Step Solution

Analyze threat context

Identified an active fileless in-memory process injection attack bypassing API hooks.

Understanding that the payload resides strictly in volatile memory dictates that host shutdown or process termination will destroy key forensic artifacts.

Evaluate containment options against forensic preservation requirements

Selecting EDR host isolation isolates the network adapter driver without killing processes or restarting the machine.

Host isolation breaks potential network paths to prevent lateral movement or C2 calls while keeping the host active for volatile RAM acquisition.

Execute immediate response action

Containment is applied instantly via the EDR control plane.

Agent-side network driver isolation takes effect instantly across all network interfaces, including internal LAN subnets.

Key Concept

EDR Host Isolation and Volatile Evidence Preservation

Question 30Question →

A security analyst at a healthcare organization is auditing authentication logs following a security alert. The logs reveal that an offboarded remote employee successfully accessed internal resources using legacy RADIUS credentials. Although the central identity provider (IdP) had disabled the employee's primary directory account, the RADIUS server accepted local fallback credentials because it failed to synchronize account deprovisioning status. Which of the following identity management operational practices would have MOST effectively prevented this unauthorized access?

Implementing continuous identity lifecycle monitoring with automated directory synchronization and deprovisioning triggers.

Deploying a privileged access management (PAM) vault to manage standard remote user VPN sessions.

Configuring static network perimeter IP filtering rules to validate all inbound remote employee connections.

Enforcing resource authorization policies on the gateway prior to performing identity authentication checks.

Show answer & explanation

Answer: Implementing continuous identity lifecycle monitoring with automated directory synchronization and deprovisioning triggers.

Answer

Implementing continuous identity lifecycle monitoring with automated directory synchronization and deprovisioning triggers.

Automated directory synchronization combined with robust identity lifecycle operational workflows ensures that when an account is disabled in the primary directory, the deprovisioning status is immediately propagated to all auxiliary authentication stores (such as RADIUS or TACACS+ local fallback databases).

Step-by-Step Solution

Analyze the incident details from the authentication logs.

Identified that account revocation in the primary Identity Provider was not communicated to the local RADIUS database due to a synchronization failure.

Understanding the root cause is necessary to select the proper access control mitigation.

Evaluate the operational solution required to resolve missing account deprovisioning.

Continuous identity lifecycle workflows with automated deprovisioning sync ensure that account state changes apply globally across all identity repositories.

Proper identity lifecycle management prevents stale local accounts from remaining active after offboarding.

Key Concept

Identity Provisioning and Lifecycle Operations

Question 31Question →

A Security Operations Center (SOC) analyst is reviewing Identity and Access Management (IAM) event logs following an automated alert regarding an unauthorized privilege escalation attempt. The following log snippet was retrieved from the central SIEM:

[2026-07-27 10:02:11] IdP_AUTH SUCCESS user="j.smith" realm="corp.internal" src_ip="10.10.4.12" auth_method="MFA_TOTP"
[2026-07-27 10:02:14] PAM_ELEVATE_REQ user="j.smith" target_role="DomainAdmin" verified_group_membership=["Helpdesk_L1"]
[2026-07-27 10:02:15] PAM_POLICY_EVAL user="j.smith" rule="Trust_Internal_Subnet_AutoApprove" match=TRUE
[2026-07-27 10:02:16] PAM_SESSION_START user="j.smith" effective_role="DomainAdmin" status="GRANTED"

Based on the log data, which of the following operational root causes explains why `j.smith` was granted the `DomainAdmin` role?

The Privileged Access Management system authorized access based on network location rather than enforcing entitlement checks against the user's verified identity group.

The primary Identity Provider failed to properly authenticate the user during the initial login sequence before requesting privilege elevation.

An external threat actor conducted a real-time credential harvesting attack to bypass multi-factor authentication controls.

The automatic subnet approval rule operated as a compensating corrective control to maintain helpdesk operational continuity.

Show answer & explanation

Answer: The Privileged Access Management system authorized access based on network location rather than enforcing entitlement checks against the user's verified identity group.

Answer

The Privileged Access Management system authorized access based on network location rather than enforcing entitlement checks against the user's verified identity group.

The correct answer identifies that the Privileged Access Management engine performed flawed authorization. While the user was successfully authenticated via MFA, the PAM policy automatically granted `DomainAdmin` rights due to an internal IP trust rule (`Trust_Internal_Subnet_AutoApprove`), completely bypassing role-based group checks that showed the user only belonged to `Helpdesk_L1`.

Step-by-Step Solution

Analyze the authentication entry in the log snippet.

The entry `[2026-07-27 10:02:11] IdP_AUTH SUCCESS user="j.smith"... auth_method="MFA_TOTP"` shows identity verification (authentication) succeeded cleanly.

Establishes that the user identity was properly validated via multi-factor authentication.

Examine the privilege elevation request and group memberships.

The user `j.smith` belongs to `Helpdesk_L1` but requested `DomainAdmin` elevation.

Helps determine whether the user inherently possesses the authorization required for DomainAdmin rights.

Evaluate the policy decision entry from the PAM platform.

`PAM_POLICY_EVAL` matched `Trust_Internal_Subnet_AutoApprove`, leading to `PAM_SESSION_START` with status `GRANTED`.

Reveals that access elevation occurred because of an IP/location-based implicit trust rule overriding role entitlement checks.

Key Concept

Privileged Access Management (PAM) Authorization and Zero Trust Principles

Estimated Time:2m 0s

Question 32Question →

Match each organizational vulnerability assessment requirement to the most appropriate scan configuration method.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. Evaluating perimeter security from an unauthenticated adversary perspective matches Non-credentialed external network vulnerability scan.
2. Auditing internal patch levels and registry configurations with minimal bandwidth matches Credentialed network vulnerability scan.
3. Continuous vulnerability visibility for roaming laptops without VPN matches Agent-based vulnerability scan.
4. Enumerating active host IP addresses and open ports across a subnet matches Network discovery scan.

Each vulnerability scanning approach serves a distinct operational purpose: non-credentialed external scans evaluate perimeter risk from an attacker's perspective; credentialed network scans deliver low-impact, high-accuracy internal patch audits; host-based agents ensure continuous compliance for remote assets outside the network perimeter; and discovery scans rapidly map network topology and active hosts.

Step-by-Step Solution

Analyze the operational location, authentication requirements, and goal for each assessment scenario.

Identified four unique deployment requirements: unauthenticated external probing, authenticated internal audit, off-network continuous monitoring, and asset discovery.

Vulnerability scanning methods differ primarily by authentication level, host proximity/deployment model, and depth of analysis.

Map external probing without credentials to non-credentialed external scans.

Requirement 1 correctly pairs with Non-credentialed external network vulnerability scan.

This mode accurately mimics an external threat actor's vantage point on public-facing assets.

Map internal patch verification requiring low network impact to credentialed network scans.

Requirement 2 correctly pairs with Credentialed network vulnerability scan.

Authentication allows scanner access to inspect administrative logs, registries, and configuration files directly.

Map remote roaming endpoints to host agents, and subnet host mapping to discovery scans.

Requirement 3 pairs with Agent-based scan; Requirement 4 pairs with Network discovery scan.

Agents provide persistent endpoints monitoring independent of network location, whereas discovery scans rapidly enumerate host availability and ports.

Key Concept

Vulnerability Assessment Scanner Methods and Configurations

Question 33Question →

An enterprise Security Operations Center (SOC) identifies anomalous database queries originating from an authenticated SSL/TLS VPN remote user session outside of normal business hours. Place the following incident response actions in the correct chronological order from first step to last step according to the standard NIST Incident Response Lifecycle.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence according to the NIST Incident Response Lifecycle is: 1. Analyze logs and correlate alerts (Detection and Analysis), 2. Terminate VPN sessions and isolate database servers (Containment), 3. Revoke compromised credentials and remove persistence mechanisms (Eradication), 4. Restore systems from clean backups and enforce MFA reset (Recovery), and 5. Conduct a post-incident review meeting to update playbooks (Post-Incident Activity).

Standard incident response frameworks (such as NIST SP 800-61 Rev. 2) define a sequential lifecycle: Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. Security teams must first validate indicators to establish scope (Detection & Analysis), immediately restrict attacker access and isolate affected assets (Containment), eliminate threat artifacts and vulnerabilities (Eradication), restore systems to production under secure conditions (Recovery), and finally document lessons learned to improve playbooks (Post-Incident Activity).

Step-by-Step Solution

Identify Detection and Analysis activities

Analyzing VPN logs and SIEM data verifies the unauthorized access and determines the scope of compromise.

Responders must validate that a security incident has occurred and understand its footprint prior to executing operational containment.

Identify Containment activities

Terminating active connections and isolating hosts halts active malicious actions and prevents network spread.

Containment limits operational damage while security personnel plan and execute permanent threat eradication.

Identify Eradication activities

Revoking compromised tokens, removing backdoor mechanisms, and applying security patches eliminates the adversary's presence.

Eradication removes the root cause so affected hosts can be re-introduced to production safely.

Identify Recovery activities

Restoring database systems from known-good backups and re-enabling access brings business operations back online.

Recovery validates system integrity and resumes normal business capabilities under enhanced monitoring.

Identify Post-Incident Activity

Conducting a debrief session and updating playbooks documents response efficacy and lessons learned.

Post-incident review improves operational readiness and updates incident response playbooks for future events.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases

Estimated Time:1m 30s

Question 34Question →

A security engineer is configuring a Service Provider-initiated SAML 2.0 Single Sign-On (SSO) integration between an enterprise SaaS application (Service Provider) and an external cloud Identity Provider (IdP) with mandatory MFA. In what order should the steps occur to complete a secure authentication and access flow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the user requesting access at the Service Provider, followed by the SP generating a SAML AuthnRequest and redirecting the browser to the Identity Provider. Next, the IdP authenticates the user credentials and MFA challenge. After authentication succeeds, the IdP sends a signed SAML response to the SP Assertion Consumer Service endpoint. Finally, the SP validates the signature and token claims before creating the local session.

In a Service Provider (SP)-initiated SAML 2.0 Single Sign-On sequence, the workflow must start at the resource endpoint (SP), redirect to the identity repository (IdP) for credential and MFA verification, return a signed SAML assertion token to the Assertion Consumer Service (ACS) endpoint, and end with cryptographic validation and local session establishment by the SP.

Step-by-Step Solution

Identify the initiation point for Service Provider (SP)-initiated SSO

The unauthenticated client request to the application triggers the creation of a SAML AuthnRequest payload.

In SP-initiated flows, access attempts at the target application must precede redirection.

Trace the HTTP redirect sequence

The user's browser transfers the AuthnRequest parameter to the IdP endpoint.

The browser acts as the user-agent bridge carrying authentication requests between decoupled domains.

Perform centralized identity verification and policy enforcement

The IdP processes primary credentials and enforces secondary MFA challenges.

Authentication and policy evaluation take place entirely on the trusted Identity Provider.

Return the signed security token via browser redirect/POST

The IdP constructs a SAML assertion signed with its private key and sends it to the SP Assertion Consumer Service (ACS).

The ACS endpoint is designed to receive and parse federated identity assertions.

Validate cryptographic trust and grant local application authorization

The SP checks the IdP's public certificate signature, expiration timestamps, and recipient claims before granting access.

Verification prevents SAML response spoofing and token replay attacks.

Key Concept

SAML 2.0 SP-Initiated SSO Authentication Flow

Question 35Question →

During an ongoing incident investigation, a Security Operations Center (SOC) team detects that an automated Continuous Integration/Continuous Deployment (CI/CD) build server has been compromised. An attacker modified build scripts to exfiltrate enterprise API credentials to an external host while continuing to compile production software images. Which TWO of the following containment actions should the incident response team perform immediately to mitigate the incident while preserving evidence?

Select all that apply

Isolate the compromised build server network interface via virtual firewall rules while capturing its volatile RAM.

Revoke and rotate the exposed API tokens and service account credentials associated with the build pipeline.

Purge the source repository commit logs and immediately re-image the build server operating system from clean media.

Apply a network filter blocking all inbound HTTP/HTTPS traffic to the primary enterprise core perimeter router.

Show answer & explanation

Answer: Isolate the compromised build server network interface via virtual firewall rules while capturing its volatile RAM.; Revoke and rotate the exposed API tokens and service account credentials associated with the build pipeline.

Answer

The containment strategy requires isolating the compromised build server network interface while capturing volatile memory, alongside revoking and rotating all exposed API tokens and service account credentials.

Effective containment of a compromised automation pipeline requires stopping both host communication and credential abuse. Isolating the build server at the network level combined with memory capture preserves volatile forensic evidence while halting exfiltration. Concurrently, revoking and rotating exposed API tokens prevents the adversary from leveraging stolen credentials against peripheral enterprise resources.

Step-by-Step Solution

Identify immediate containment goals

Determine that stopping active exfiltration and preventing unauthorized API access takes priority during containment.

Containment limits the scope and damage of an incident without prematurely destroying forensic artifacts.

Preserve state while stopping network exfiltration

Isolate the virtual host at the network layer and acquire a memory dump.

Acquiring memory prior to shut down ensures critical volatile evidence (such as injected process memory) is preserved.

Invalidate exfiltrated identity assets

Revoke and re-issue all affected tokens and secrets.

Exfiltrated credentials allow threat actors to bypass perimeter boundaries regardless of host containment.

Key Concept

Incident Response Containment Strategies and Evidence Preservation

Question 36Question →

A security technician needs to conduct a vulnerability scan on an internal application server to accurately identify missing software patches and internal misconfigurations without disrupting active services. Which of the following scanning approaches best satisfies these requirements?

Credentialed, non-intrusive scan

Non-credentialed, intrusive scan

External penetration test

Passive network monitoring

Show answer & explanation

Answer: Credentialed, non-intrusive scan

Answer

Credentialed, non-intrusive scan

A credentialed, non-intrusive scan uses valid system credentials to authenticate directly to the target operating system. It inspects installed software registries, missing patches, and local security configurations with high accuracy while avoiding aggressive exploit traffic that could disrupt server availability.

Step-by-Step Solution

Determine authentication requirement

Local system access is needed to accurately verify installed software versions and patch levels.

Unauthenticated network scans only see open network ports and service banners, resulting in potential false positives.

Determine scan impact requirement

A non-intrusive scan method must be selected.

Intrusive scanning sends exploit payloads or intensive tests that could crash live application services.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning

Estimated Time:1m 0s

Question 37Question →

During a network security monitoring review of a cloud environment, a security analyst examines the following NIDS alert log associated with an internal application gateway:

Timestamp: 2026-07-27T14:22:01Z
Src_IP: 192.168.10.45:49152 -> Dst_IP: 10.0.4.12:80
Signature: HTTP_Req_Pattern_Match
Payload Snippet: POST /search.php HTTP/1.1\r
Host: store.internal\r
User-Agent: Mozilla/5.0\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: 68\r
\r
item=1+UNION+SELECT+null,username,password_hash+FROM+users--

Following this initial request, outbound firewall logs capture sustained 15-minute periodic TCP connections from 10.0.4.12 to an external IP address over port 443. Based on the log evidence, which of the following represents the most accurate diagnosis of the activity and the appropriate immediate analyst action?

The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.

The alert indicates a Cross-Site Scripting (XSS) attack attempting to execute scripts in the user's browser; the analyst should deploy an inline script-blocking policy on the client workstation (192.168.10.45).

The alert indicates a misconfigured honeypot decoy system triggering automated alerts; the analyst should reclassify the NIDS signature from a detective control to an inline preventive control to auto-drop future packets.

The alert indicates an application vulnerability; the analyst should immediately modify perimeter firewall rules to block inbound TCP port 80 traffic to prevent further web traffic.

Show answer & explanation

Answer: The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.

Answer

Analyzing the payload snippet reveals a classic SQL injection pattern (`UNION SELECT null,username,password_hash FROM users--`) attempting to extract user credentials from a backend database. Correlating this NIDS alert with the subsequent sustained outbound TCP port 443 sessions from the target web server indicates potential post-exploitation activity or data exfiltration. Isolating the target web server halts egress communications while enabling forensic analysis.

Step-by-Step Solution

Analyze NIDS HTTP payload syntax

Identified 'UNION SELECT null,username,password_hash FROM users--' as a SQL injection (SQLi) attack targeting backend database credentials.

Determines the specific attack vector targeting the database application logic.

Correlate NIDS payload with outbound NetFlow/Firewall logs

Observed subsequent persistent outbound traffic over TCP port 443 from the target server (10.0.4.12) to an external IP.

Establishes post-exploitation behavior indicative of data exfiltration or Command and Control (C2) beaconing.

Determine containment response action

Selected network isolation of server 10.0.4.12.

Prevents ongoing outbound data exfiltration while preserving memory and system state for digital forensics.

Key Concept

SQL Injection Alert Diagnosis and Containment Correlation

Question 38Question →

An IAM administrator at an online payment processor is reviewing identity operational logs after an audit revealed that a terminated contractor retained administrative access to production API gateways 48 hours after offboarding:

Timestamp (UTC)	Event ID	Identity / Subject	System Component	Details / Status
2026-07-25 09:00:00	EVT-801	[email protected]	IdP Directory	User account status set to Disabled
2026-07-25 09:00:05	EVT-802	[email protected]	SCIM Engine	Provisioning push failed: Integration token expired
2026-07-25 09:05:00	EVT-803	[email protected]	API Gateway	Refresh token exchange succeeded (New access token issued)
2026-07-27 08:30:00	EVT-804	[email protected]	API Gateway	Administrative configuration change executed

Based on the log analysis, which of the following identifies the primary technical cause of the persistent access and the most effective operational fix?

The automated deprovisioning sync failed due to an expired SCIM integration token, and long-lived OAuth refresh tokens were not explicitly revoked upon account disablement; implementing Continuous Access Evaluation (CAE) or automated token revocation hooks is required.

The central identity provider failed to properly authenticate the contractor during the session refresh attempt; reconfiguring network-level conditional access policies to require step-up MFA will prevent unauthorized API access.

The internal API gateway relied on perimeter network boundaries to implicitly trust active backend connections; establishing IP-based firewall filtering rules for disabled vendor accounts is required.

The SCIM engine failed because it was misconfigured as a detective control rather than a corrective control in the governance framework; updating the identity control classification will resolve the provisioning pipeline.

Show answer & explanation

Answer: The automated deprovisioning sync failed due to an expired SCIM integration token, and long-lived OAuth refresh tokens were not explicitly revoked upon account disablement; implementing Continuous Access Evaluation (CAE) or automated token revocation hooks is required.

Answer

The persistent access was caused by an expired SCIM provisioning token preventing downstream account deprovisioning combined with active OAuth refresh tokens that were not invalidated; the operational fix requires implementing Continuous Access Evaluation (CAE) or automated token revocation hooks.

The logs clearly show that while the account was disabled in the directory (EVT-801), the SCIM engine failed to propagate this disablement due to an expired integration token (EVT-802). As a result, the API Gateway honored the user's existing OAuth refresh token (EVT-803), granting continued access. Remediating this requires repairing SCIM token authentication and enforcing Continuous Access Evaluation (CAE) or automated revocation webhooks to instantly invalidate active tokens when an account status changes.

Step-by-Step Solution

Analyze the log entries sequentially to trace the deprovisioning workflow failure.

Event EVT-801 shows account disablement in the primary Identity Provider at 09:00:00 UTC, but EVT-802 indicates that SCIM provisioning push failed due to an expired integration token five seconds later.

SCIM depends on valid API credentials/tokens to propagate identity lifecycle updates to relying applications.

Examine downstream authentication and authorization behavior following the failed SCIM push.

At 09:05:00 UTC (EVT-803), the API Gateway processed a valid OAuth refresh token request because it was never notified of the user's disabled status, issuing a new active access token.

OAuth refresh tokens remain valid until explicitly revoked or expired; disabling an account in the primary IdP does not automatically invalidate active downstream tokens without active revocation mechanisms.

Determine the required IAM operational remediation.

Fixing the SCIM integration credential maintenance and deploying Continuous Access Evaluation (CAE) / automated token revocation ensures real-time session invalidation across all relying parties.

CAE enables identity providers and reliance endpoints to communicate security events dynamically, stopping active sessions immediately upon account risk state changes.

Key Concept

Identity Provisioning, Lifecycle Synchronization, and Token Revocation Operations

Question 39Question →

A security operations team must implement appropriate vulnerability assessment methodologies across four distinct IT and operational environments. Which vulnerability scanning approach best matches each enterprise operational requirement?

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairing matches: Non-intrusive Credentialed Scan with auditing production database OS updates safely; Passive Vulnerability Monitoring with assessing sensitive OT/ICS networks without sending packets; Intrusive Exploitation Scan with confirming shell access from a remote code execution vulnerability in staging; and Authenticated Dynamic Application Scan with analyzing web vulnerabilities behind a login prompt.

Vulnerability scanner methodologies must align with system risk tolerance and application architecture. Passive monitoring avoids packet transmission for delicate operational technology. Non-intrusive credentialed scans safely query local package managers via host credentials. Intrusive scans perform real exploitation checks to confirm true positives in test environments. Authenticated dynamic scans execute web request payloads behind application login mechanisms.

Step-by-Step Solution

Evaluate the requirements and constraints for legacy OT/ICS networks.

Determine that packet injection can crash legacy SCADA controllers, making packetless monitoring necessary.

Passive vulnerability monitoring collects asset and vulnerability intelligence solely by sniffing network traffic.

Determine the safest method to verify patch compliance on production hosts during operational hours.

Select non-intrusive credentialed scanning.

Host credentials allow direct inspection of local package manifests without generating heavy or disruptive network attack traffic.

Identify the technique required to confirm functional exploitability of a critical flaw.

Select intrusive exploitation scanning.

Intrusive scans validate exploitability by actively executing exploit scripts against target vulnerabilities.

Match the web application testing requirement for authenticated areas.

Select authenticated dynamic application scanning.

DAST crawlers require session tokens to traverse and analyze access controls, session state, and input fields behind login interfaces.

Key Concept

Vulnerability Scanning Methodologies and Environmental Constraints

Estimated Time:2m 0s

Question 40Question →

During a routine security review of cloud identity operations, a security analyst discovers that an automated data synchronization process uses a legacy service account configured with a long-lived static API key. The key was inadvertently committed to an internal repository, allowing an unauthorized external entity to request access tokens and enumerate cloud resources. Which of the following operational controls should the security team implement to remediate this vulnerability and secure the service identity lifecycle? (Select TWO.)

Select all that apply

Migrate the automated service identity to use workload identity federation with short-lived, ephemeral tokens instead of hardcoded credentials.

Enforce strict network perimeter firewall rules at the local datacenter border to drop all external authentication requests.

Configure risk-based conditional access policies to evaluate request context and block token issuance from unexpected locations or anomalous sources.

Reassign the service account to a restricted role group while retaining the static key authentication mechanism.

Show answer & explanation

Answer: Migrate the automated service identity to use workload identity federation with short-lived, ephemeral tokens instead of hardcoded credentials.; Configure risk-based conditional access policies to evaluate request context and block token issuance from unexpected locations or anomalous sources.

Answer

The security team should migrate the service account to workload identity federation with short-lived tokens and implement contextual conditional access policies.

Migrating to workload identity federation eliminates static long-lived credentials by issuing short-lived tokens based on trusted identity relationships. Combining this with risk-based conditional access ensures token requests from untrusted origins or anomalous locations are blocked automatically.

Step-by-Step Solution

Identify the primary operational vulnerability.

The vulnerability stems from using long-lived static credentials (API keys) that can be leaked and abused externally.

Static credentials present a continuous risk of exposure and lack dynamic identity verification.

Select credential lifecycle remediation controls.

Replace long-lived keys with workload identity federation to issue short-lived, ephemeral access tokens.

Ephemeral tokens drastically reduce the window of opportunity for compromise.

Select adaptive access controls for identity operations.

Apply conditional access policies to inspect request context and block suspicious token requests.

Risk-based conditional access enforces Zero Trust principles for service account token requests.

Key Concept

Workload Identity Federation and Conditional Access Control in IAM Operations

PreviousPage 2 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept