Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 441Question →

An enterprise system administrator identifies suspicious administrative tool execution on a human resources endpoint. EDR telemetry reports that an unauthorized process is actively attempting lateral movement across internal subnets using compromised domain credentials. Which of the following actions should the security engineer take FIRST using the EDR platform to stop the attack while maintaining investigation capabilities?

Show answer & explanation

Answer: Initiate host isolation on the affected endpoint through the EDR agent console

Answer

Initiate host isolation on the affected endpoint through the EDR agent console.
Executing network host isolation directly through the EDR console immediately disconnects the compromised endpoint from all internal network resources, neutralizing lateral movement while maintaining EDR agent connectivity for SOC analysis and forensic triage.

Step-by-Step Solution

1
Analyze the EDR behavioral alert
Identified active lateral movement attempts originating from the endpoint
Immediate containment is required to prevent compromise of adjacent systems on the internal network.
2
Select the appropriate EDR response action
Apply network host isolation via the EDR platform agent
Host isolation disables internal endpoint networking while maintaining the management control channel for security analysis.

Key Concept

Endpoint Containment and Host Isolation
Question 442Question →

A security analyst is conducting live evidence acquisition on a compromised application server following a suspected data exfiltration attempt. The analyst needs to preserve network statistics, system RAM, swap space, and non-volatile storage while minimizing data alteration. According to the standard order of volatility, which of the following evidence types should the analyst acquire FIRST?

Show answer & explanation

Answer: Routing table and active network connections

Answer

Routing table and active network connections must be acquired first because they are the most volatile form of evidence listed.
In digital forensics, the order of volatility governs evidence collection sequence to prevent data loss. According to RFC 3227, highly dynamic system states—such as CPU registers, routing tables, ARP caches, kernel statistics, and active network connections—must be captured before secondary storage like swap space or local hard drives.

Step-by-Step Solution

1
Identify the volatility level of each evidence source listed in the scenario.
Network state (routing tables, open connections) is extremely fleeting, followed by physical RAM, swap space/temp files, non-volatile disk images, and remote archival logs.
The Order of Volatility principles dictate acquiring evidence starting from the most ephemeral (fastest changing) to the most persistent.
2
Compare the candidate options against the established order of volatility (RFC 3227).
Active network connections and routing tables rank higher in volatility than swap files, physical disk partitions, or remote log repositories.
Network states can disappear instantly if a network interface drops or a socket connection closes.

Key Concept

Order of Volatility in Digital Forensics
Question 443Question →

A security engineer analyzing packet telemetry from an inline Network Intrusion Prevention System (NIPS) notices a high-priority alert triggered by inbound traffic directed at a public-facing web server. The alert details contain the following HTTP payload snippet:

`GET /catalog.php?item_id=105%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--%20HTTP/1.1`
`Host: portal.example.com`

The engineer must select a targeted mitigation control that specifically blocks this attack payload while preserving uninterrupted HTTP/HTTPS access for legitimate users. Which of the following actions should the engineer take?

Show answer & explanation

Answer: Deploy a Web Application Firewall (WAF) rule to inspect layer 7 payload parameters and block requests containing SQL syntax tokens.

Answer

Deploying a Web Application Firewall (WAF) rule to inspect layer 7 parameters and block requests containing SQL syntax tokens effectively mitigates the SQL injection payload while keeping standard web services available.
The log snippet reveals a URL-encoded SQL injection string (`UNION SELECT ... FROM user_credentials`). Because SQL injection is an application-layer (Layer 7) vulnerability, a Web Application Firewall (WAF) is the appropriate control. A WAF inspects HTTP/HTTPS payload contents and parameter values to block malicious database query structures while allowing benign web traffic through.

Step-by-Step Solution

1
Analyze the NIPS log payload
Identified the URL-encoded payload `%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--` as a classic SQL Injection (SQLi) attempt aimed at extracting database records.
Accurate alert classification is necessary to choose an effective mitigation strategy.
2
Evaluate control layer requirements
SQL injection attacks occur at Layer 7 (Application layer) inside standard HTTP request parameters.
Traditional network firewalls Operating at Layer 3/4 cannot inspect application payloads and would block all legitimate traffic if port-level blocks were applied.
3
Select the precise security control
A Web Application Firewall (WAF) operates at Layer 7 to inspect parameter values against signature patterns (such as `UNION SELECT`) and block malicious attempts without disrupting valid traffic.
WAF rules provide target-specific inline protection against web application attacks.

Key Concept

Layer 7 Network Security Monitoring and WAF Mitigation
Question 444Question →

A Security Operations Center (SOC) team is deploying an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-risk suspicious email reports. To prevent accidental disruption to critical business communications while ensuring rapid response, the automated response workflow must follow strict SOC governance standards spanning ingest, threat intelligence enrichment, analyst review, containment, and post-incident cleanup. In what sequence should the SOAR playbook execute these operational steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order begins with alert payload ingestion and IOC parsing, followed by automated threat intelligence enrichment, triggering a Human-in-the-Loop (HITL) approval gate, executing automated host isolation and token revocation upon authorization, and concluding with perimeter blocklist updates and case closure.
In SOAR playbook architecture, incident response follows a structured sequence: initial data ingestion and IOC extraction, automated threat intelligence lookup, decision governance via Human-in-the-Loop (HITL) verification for high-impact remediations, automated execution of containment scripts, and final documentation with blocklist propagation.

Step-by-Step Solution

1
Parse input payload
Extracted URLs, domain names, and email headers ready for automated processing.
Automation workflows require structured data inputs before external API integrations can be invoked.
2
Enrich indicators using threat intelligence tools
Aggregated threat scores and reputation analysis metrics.
Enrichment provides the necessary contextual data to evaluate severity before decision-making.
3
Execute Human-in-the-Loop (HITL) authorization step
Analyst confirmation or rejection of the proposed mitigation actions.
High-impact containment actions require human oversight to prevent operational downtime on critical enterprise accounts.
4
Enforce endpoint containment and credential revocation
Host network isolation and invalidated active authentication tokens.
Approved remediation tasks stop active session abuse and lateral movement across the network.
5
Finalize incident documentation and feed defensive perimeter controls
Updated SIEM entries, synchronized firewall blocklists, and resolved SOAR tickets.
Final documentation ensures audit compliance and prevents repeat attacks across the enterprise edge.

Key Concept

SOAR Playbook Execution Lifecycle and Governance
Question 445Question →

A Security Operations Center (SOC) analyst receives an automated high-severity SIEM alert indicating suspicious outbound traffic from an internal database server containing sensitive customer records to an unknown external IP address over port 443. The analyst must follow network security monitoring and initial incident response procedures. In what chronological sequence should the analyst execute the following triage and containment actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of actions begins with analyzing NetFlow records and SIEM log correlations, followed by inspecting NIDS alerts and full packet captures (PCAP), then applying network isolation controls to the database host, and finally updating perimeter firewall rules to block the external destination IP address.
The triage process follows a logical sequence from high-level flow verification to payload inspection, host isolation, and perimeter defense. Flow telemetry (NetFlow/SIEM) is evaluated first to confirm the alert boundaries. NIDS alerts and PCAP files are then examined to identify IoCs and malicious payloads. Next, host containment stops active data exfiltration while preserving volatile evidence. Finally, blocking the external malicious IP at the perimeter safeguards the broader enterprise architecture.

Step-by-Step Solution

1
Analyze NetFlow records and SIEM log correlations
Establishes baseline traffic metrics and verifies anomalous session characteristics.
Initial triage requires confirming session duration, flow volume, and endpoints before launching detailed analysis.
2
Inspect NIDS alerts and full packet captures (PCAP)
Extracts protocol payload details, certificate info, and threat signatures.
Detailed packet inspection provides context on the attack payload and identifies actionable indicators of compromise.
3
Apply network isolation controls to the affected database host
Halts ongoing exfiltration from the compromised system while preserving forensic artifacts in memory.
Host containment must occur immediately once a compromise is confirmed to prevent further unauthorized data access.
4
Update perimeter firewall rules to block the external destination IP address
Prevents potential lateral exfiltration attempts from other enterprise hosts to the malicious destination.
System-wide perimeter blocking ensures enterprise defense after containing the immediate host threat.

Key Concept

Incident Response and Triage Workflow in Network Security Monitoring
Question 446Question →

A security operations team is deploying a enterprise cloud application integrated with an internal Identity Provider (IdP) using SAML 2.0. Arrange the operational steps of a Service Provider-initiated (SP-initiated) Single Sign-On (SSO) authentication sequence in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for SP-initiated SAML 2.0 SSO is: 1) Initial resource request to the SP, 2) Redirection with SAML AuthnRequest to the IdP, 3) User authentication at the IdP, 4) Redirection with signed SAML Assertion back to SP's ACS, and 5) Signature validation and session creation by the SP.
In SAML 2.0 SP-initiated Single Sign-On, the sequence begins with an unauthenticated request to the Service Provider. The SP redirects the user's browser with a SAML AuthnRequest to the Identity Provider. Next, the user authenticates directly at the IdP. Upon successful authentication, the IdP redirects the user back to the SP's Assertion Consumer Service (ACS) endpoint with a signed SAML Assertion containing identity attributes. Finally, the SP verifies the assertion signature and establishes the user session.

Step-by-Step Solution

1
Identify the entry point of the SP-initiated authentication workflow.
The user initiates contact by requesting access directly at the Service Provider application.
In SP-initiated SSO, the flow starts at the resource provider, unlike IdP-initiated SSO where the user visits the IdP portal first.
2
Determine how the Service Provider directs the user to the authentication authority.
The SP issues an HTTP redirect containing a SAML AuthnRequest targeted at the IdP SSO URL.
The SP cannot authenticate the user locally, so it delegates identity verification by redirecting the client browser.
3
Trace the primary authentication event at the Identity Provider.
The user supplies primary credentials and completes mandatory MFA challenges at the IdP portal.
Authentication occurs strictly between the user browser and the IdP, ensuring credentials are never exposed to the SP.
4
Trace the return path of identity claims to the Service Provider.
The IdP redirects the browser to the SP's Assertion Consumer Service (ACS) with a signed SAML Response assertion.
The SAML assertion serves as cryptographically verifiable proof that the user successfully authenticated at the IdP.
5
Finalize session establishment and access authorization.
The SP validates the digital signature using the IdP's public key certificate and logs the user into the local application context.
Verifying the signature ensures the assertion came from a trusted IdP and was not altered during transit by a man-in-the-middle.

Key Concept

SAML 2.0 SP-Initiated Authentication Flow
Question 447Question →

A Security Operations Center (SOC) analyst receives a high-severity alert from an enterprise Endpoint Detection and Response (EDR) platform. Telemetry indicates an unprivileged user account initiated a obfuscated command execution that attempted process injection into `lsass.exe` and established an encrypted outbound connection to an untrusted external IP address. Which TWO of the following actions represent capabilities native to an EDR solution that the analyst should execute to contain the threat and facilitate analysis?

Select all that apply

Show answer & explanation

Answer: Apply host network isolation through the EDR agent software to sever attacker communication while maintaining management console connectivity.; Issue a remote live response command via the EDR console to dump volatile RAM contents and terminate the malicious parent process tree.

Answer

The analyst should isolate the host via the EDR agent console and execute a remote live response action to dump volatile memory and kill the malicious process tree.
Host network isolation directly through the EDR console stops malicious communication while preserving management control, and remote live response tools enable analysts to capture volatile memory and terminate running processes on the target host.

Step-by-Step Solution

1
Identify EDR containment capabilities.
Host isolation via the EDR agent restricts host network traffic to only the EDR management channel, neutralizing network activity without disabling endpoint telemetry.
Prevents lateral movement and remote C2 without taking the host offline completely from the security team.
2
Identify EDR live response and forensic capabilities.
EDR consoles permit remote execution of administrative scripts to dump memory for forensic capture and kill process trees executing injected code.
Allows immediate threat eradication and forensic collection directly on the endpoint.

Key Concept

EDR Host Containment and Live Response Features
Estimated Time:1m 30s
Question 448Question →

A security technician is deploying monitoring sensors across an enterprise network. Which of the following statements correctly describe the features and operational behavior of a passive Network Intrusion Detection System (NIDS)? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: It analyzes mirrored network traffic from a switch port without introducing latency to live network packets.; It generates security alerts upon detecting signature matches but does not actively stop or alter packets in transit.

Answer

The correct options state that a passive Network Intrusion Detection System (NIDS) analyzes mirrored network traffic without introducing latency to live packets and generates security alerts without actively stopping or altering traffic in transit.
A passive Network Intrusion Detection System (NIDS) operates out-of-band by analyzing duplicated network traffic (such as traffic provided by SPAN ports or network TAPs). Because it processes copies of packets out-of-band, it does not add latency to production traffic flows and acts as a detective control by generating alerts when malicious signatures are matched, without interrupting packet transit.

Step-by-Step Solution

1
Identify the operational placement of a passive Network Intrusion Detection System (NIDS).
A passive NIDS is deployed out-of-band, receiving duplicated traffic from TAP or SPAN/mirror ports.
Out-of-band deployment ensures that monitoring activities do not add latency to active network communications.
2
Determine the control function and capabilities of a passive monitoring solution.
Passive NIDS devices act as detective controls by analyzing traffic against known signature sets and alerting administrators.
Since the NIDS receives copied packets out-of-band, it lacks inline capability to modify or drop malicious network traffic directly.

Key Concept

Passive Out-of-Band Network Intrusion Detection
Question 449Question →

A security technician is documenting the standard patch deployment workflow for enterprise operating systems. Place the following stages of the patch management lifecycle in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the patch management lifecycle is: 1. Identify and assess newly released vendor patches -> 2. Test the patch in a staging environment -> 3. Submit the patch deployment plan to the Change Advisory Board (CAB) -> 4. Deploy the patch to production systems -> 5. Perform post-installation auditing.
The standard patch management process follows a structured lifecycle: identification of updates, non-production testing, change management authorization, controlled production deployment, and post-deployment validation auditing.

Step-by-Step Solution

1
Identify available patches
Discovers vendor updates requiring evaluation.
Security operations must monitor vendor advisories and assess patch severity before taking operational action.
2
Perform staging and testing
Confirms patch compatibility without affecting live systems.
Testing ensures updates do not cause system crashes or application conflicts.
3
Request change authorization
Obtains formal CAB review and approval.
Change management governance mandates documentation and risk review prior to production modification.
4
Execute production deployment
Installs patches on production assets.
Deployment must occur during scheduled maintenance windows to minimize business impact.
5
Conduct post-patch verification and auditing
Confirms compliance and closure of vulnerability.
Auditing verifies that installation succeeded and configuration baselines remain secure.

Key Concept

Standard Patch Management Lifecycle Workflow
Question 450Question →

A security analyst reviews a network security monitoring alert generated by a Network Intrusion Detection System (NIDS). The alert log highlights the following HTTP GET parameter string:

`GET /login.php?username=admin'%20OR%20'1'='1'-- HTTP/1.1`

Which of the following best identifies the type of malicious activity captured in this alert?

Show answer & explanation

Answer: SQL injection attempt designed to bypass database authentication logic

Answer

SQL injection attempt designed to bypass database authentication logic
The URL-decoded string `admin' OR '1'='1'--` is a classic SQL injection payload. Attackers inject single quotes, boolean tautologies (like `'1'='1'`), and SQL comment flags (`--`) to force the backend database query to return true, bypassing authentication controls.

Step-by-Step Solution

1
Analyze the HTTP GET request parameter string in the NIDS alert log.
Identified the payload string: username=admin'%20OR%20'1'='1'--
URL-decoded payload represents admin' OR '1'='1'--, which manipulates SQL query logic.
2
Evaluate the attack vector and security monitoring classification.
Matches SQL injection (SQLi) syntax targeting the application backend database.
SQLi uses single quotes, boolean OR statements, and comment characters to alter backend database behavior.

Key Concept

Identifying SQL Injection Indicators in Network Security Alerts
Question 451Question →

During an on-site physical security review of a remote branch office, a security analyst discovers an unauthorized rogue wireless access point plugged into an active wall jack. The rogue device is actively broadcasting a duplicate corporate SSID to intercept wireless client credentials. Following standard incident response playbooks, which of the following immediate containment actions should the incident response team perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable the specific network switch port where the rogue access point is physically attached.; Apply a quarantine access control list (ACL) to isolate traffic from the affected network segment.; Re-image the enterprise core switch operating system to remove potential malicious persistence.; Clear the switch MAC address table and volatile system logs to reset network state.

Answer

The correct containment actions are disabling the connected switch port and applying a quarantine ACL to isolate traffic from the affected segment.
Disabling the physical switch port immediately blocks the rogue access point from transmitting data across the wired enterprise network. Concurrently, applying a quarantine access control list (ACL) isolates traffic on the affected segment, preventing unauthorized lateral movement. Both steps fulfill containment objectives by isolating the threat without destroying evidence.

Step-by-Step Solution

1
Identify the primary operational objective of the containment phase in incident response.
The containment phase focuses on limiting the scope and impact of an incident without destroying forensic evidence.
Containment prevents threat expansion while allowing responders time to collect volatile evidence and plan eradication.
2
Evaluate actions that immediately restrict rogue access point network traffic.
Disabling the switch port cuts off network connectivity at the access layer, and applying a quarantine ACL prevents lateral movement on the segment.
Both measures effectively isolate the threat without altering evidence on the rogue hardware or erasing infrastructure logs.
3
Differentiate containment phase actions from premature eradication or destructive evidentiary steps.
Re-imaging switch firmware belongs in the eradication phase, while clearing volatile system logs violates evidence preservation principles.
Proper lifecycle execution ensures evidence integrity and prevents operational disruption prior to full investigation.

Key Concept

Incident Response Containment Phase for Physical Security Incidents
Estimated Time:1m 30s
Question 452Question →

Security telemetry on a corporate workstation detects a suspicious living-off-the-land binary attempting to dump process memory and establish outbound command-and-control communication. Which feature of an Endpoint Detection and Response (EDR) agent should be executed FIRST to prevent potential lateral movement while preserving remote investigation capabilities?

Show answer & explanation

Answer: Apply host network isolation via the EDR agent console

Answer

Apply host network isolation via the EDR agent console
Host network isolation restricts all network traffic on the endpoint except for encrypted communication between the EDR agent and the management console. This effectively stops lateral movement and outbound command-and-control channels without interrupting live response triage capabilities.

Step-by-Step Solution

1
Analyze the security alert requirements.
The goal is to stop lateral movement and command-and-control traffic immediately while maintaining remote administrative access for triage.
Threat containment must prioritize stopping attack propagation without losing live analysis capabilities.
2
Evaluate EDR endpoint isolation capabilities.
EDR host isolation drops non-essential inbound and outbound traffic at the endpoint agent level while keeping the EDR control plane active.
This provides containment while preserving volatile memory and analyst access.

Key Concept

EDR Host Isolation and Incident Containment
Question 453Question →

A security engineer at a financial institution is establishing a patch and configuration management framework for dual-homed payment processing nodes. The environment requires continuous compliance enforcement against baseline images, strict change validation before production deployment, and protection against unauthorized system modifications. Which of the following strategies should the security engineer implement to maintain secure configuration baselines and control patch deployment risks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Utilize automated infrastructure-as-code configuration management tools to continuously audit system state and automatically remediate configuration drift back to approved baselines.; Staging patch updates in an isolated test environment and verifying cryptographic signature hashes prior to deploying updates into production.

Answer

The security engineer should utilize automated infrastructure-as-code tools to continuously audit and remediate configuration drift, and stage patch updates in an isolated environment while verifying cryptographic signature hashes before production deployment.
Automated infrastructure-as-code tools continuously validate system settings against established security baselines and automatically remediate configuration drift. Additionally, staging patches in an isolated environment combined with verifying cryptographic signatures prevents unstable or malicious update packages from compromising production systems.

Step-by-Step Solution

1
Analyze configuration maintenance requirements
Identified the need for continuous drift detection and enforcement using automated configuration baselines.
Manual baseline auditing is ineffective in dynamic environments, making automated remediation via configuration management essential for eliminating drift.
2
Evaluate patch deployment risk mitigation controls
Selected pre-deployment staging and cryptographic hash verification.
Testing patches in staging prevents unexpected service outages, and verifying signature hashes guarantees patch integrity against tampering.
3
Assess distractor validity
Rejected using firewalls as permanent patch replacements and misclassifying control categories.
Firewalls do not remediate system code flaws, and mislabeling control types invalidates risk governance modeling.

Key Concept

Continuous baseline configuration enforcement and staged patch verification
Question 454Question →

A security engineer at an e-commerce organization is investigating an alert indicating anomalous privileged activity on a production database cluster. The authentication and operational log snippet shows:

ParameterLog Entry Details
Timestamp2026-07-27T14:22:10Z
Accountadmin_jsmith
Source IP198.51.100.45 (External WAN)
AuthenticationRADIUS with MFA (Success)
Executed ActionGRANT ALL PRIVILEGES ON customer_db TO temp_user;
Matched PolicyDefault_Admin_Role

The organization's security policy mandates that all privileged administrative sessions on critical systems must be brokered exclusively through a Privileged Access Management (PAM) jump host with short-lived session checkout. Which of the following is the MOST effective operational control modification to prevent direct administrative command execution outside the PAM solution?

Show answer & explanation

Answer: Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Answer

Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.
Enforcing network access control lists (ACLs) and restricting authorization rules so that administrative access is accepted only from designated PAM jump host IP addresses provides a preventive control. This ensures all privileged sessions are brokered, recorded, and managed according to enterprise IAM operational policy.

Step-by-Step Solution

1
Analyze the log entries and identify the security policy violation.
The log shows a direct RADIUS-authenticated session executing privileged database commands from an external WAN IP address, bypassing the required PAM jump host.
Privileged access management policies require all administrative sessions to be brokered, audited, and isolated through a dedicated PAM proxy or jump server.
2
Evaluate the required security control type to eliminate direct access bypass.
Enforcing network-level Access Control Lists (ACLs) and authorization policies at the database listener layer ensures that only connections originating from the PAM jump host IP address are accepted for administrative accounts.
Preventive network and authorization controls stop unauthorized direct connections before session establishment occurs.

Key Concept

Privileged Access Management (PAM) Session Brokering & Enforcement
Question 455Question →

A cybersecurity analyst is preparing to transport a seized, powered-off desktop computer from a remote branch office to the central digital forensics laboratory. Which of the following procedures must be performed to maintain the chain of custody and preserve physical evidence integrity during transit? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Record the equipment serial numbers, transfer timestamps, and signatures of both the transferring and receiving custodians on a formal tracking form.; Place the hard drive in a tamper-evident anti-static bag and seal it prior to secure physical transport.

Answer

Maintaining chain of custody and physical evidence integrity during transportation requires documenting all transfer details with custodian signatures on a formal tracking log and securing evidence inside sealed, tamper-evident anti-static packaging.
Chain of custody requires continuous tracking of evidence possession via detailed logs containing timestamps, serial numbers, and signatures. Physical evidence must also be packaged in sealed, tamper-evident, anti-static containers to guard against physical damage and tampering.

Step-by-Step Solution

1
Identify chain of custody tracking requirements
Every physical transfer of digital evidence must record the date, time, unique identifiers (such as serial numbers), purpose of transfer, and signatures of both releasing and receiving custodians.
This establishes accountability and legally proves who had possession of the evidence at all times.
2
Identify physical evidence preservation standards
Physical components such as hard drives must be stored in tamper-evident anti-static bags to prevent electrostatic discharge damage and provide clear indicators of unauthorized access.
Ensuring physical protection prevents evidence contamination or damage during transit.
3
Evaluate prohibited modifications to original media
Actions that modify the drive contents (such as applying encryption) or boot the operating system directly (altering system logs/timestamps) corrupt original evidence.
Forensic evidence acquisition requires static bit-stream imaging using write-blocking technology in controlled lab settings, not live unblocked execution at a remote site.

Key Concept

Preserving chain of custody documentation and physical evidence integrity during transport
Question 456Question →

A system administrator updates a cluster of web servers with an emergency software patch. Immediately after the update, users report that web applications hosted on those servers are failing to load. Which of the following actions should the administrator take FIRST to restore system functionality?

Show answer & explanation

Answer: Execute the documented rollback plan to revert the servers to their known good baseline configuration.

Answer

Execute the documented rollback plan to revert the servers to their known good baseline configuration.
When a patch causes unexpected service outage or instability in production, the immediate action within configuration management is to execute a tested rollback plan to restore services to the last known good baseline.

Step-by-Step Solution

1
Identify the immediate operational impact following the patch deployment.
The newly applied patch caused application instability and service disruption.
When a patch causes system failure, immediate operational recovery is required.
2
Initiate the emergency rollback procedures associated with the patch deployment plan.
The servers revert to the previously verified baseline state.
Rollback plans ensure rapid recovery to a stable configuration minimalizing downtime.

Key Concept

Rollback Planning and Configuration Baselines
Question 457Question →

A security analyst is triaging log files collected by a SIEM system across web applications, authentication servers, and system logs. Match each log snippet on the left to the corresponding security event or attack vector on the right.

Click a left item, then click its matching right item

Items

192.168.1.50 - - [27/Jul/2026:10:14:32] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452
Jul 27 10:15:01 server1 sshd[4102]: Failed password for invalid user admin from 203.0.113.45 port 51234 ssh2 (repeated 450 times in 60s)
Event ID 4624: An account was successfully logged on. Logon Type: 10 (RemoteInteractive). Account Name: AdminUser.
10.0.0.15 - - [27/Jul/2026:10:20:00] "GET /../../../../etc/passwd HTTP/1.1" 403 220

Matches

Show answer & explanation

Answer

The HTTP snippet containing 'UNION SELECT' matches SQL Injection; the repeated SSH failed authentication log matches SSH Brute-Force; Windows Event ID 4624 with Logon Type 10 matches RDP Interactive Session; and the HTTP request with '../../' sequences matches Directory/Path Traversal.
Each log entry displays distinct forensic indicators: 'UNION SELECT' points directly to SQL injection; repeated SSH authentication failures indicate brute-force attempts; Windows Event 4624 with Logon Type 10 marks remote interactive RDP logons; and dot-dot-slash patterns indicate path traversal attempts.

Step-by-Step Solution

1
Analyze Web Application Logs
Identified SQL query keywords ('UNION SELECT') in the query string of the first log entry and directory navigation dot-dots ('../../') in the fourth entry.
Web logs reveal application-level attacks targeting backend databases or sensitive file paths.
2
Analyze Linux Authentication Logs
Identified high-frequency failed password entries for SSH targeting administrative users from an external IP.
Syslog authentication events with high frequency from single sources characterize automated password guessing.
3
Analyze Windows Event Logs
Correlated Event ID 4624 (Successful Logon) with Logon Type 10.
Logon Type 10 is reserved for RemoteInteractive connections such as RDP, distinguishing it from local (Type 2) or network share (Type 3) logons.

Key Concept

Log Telemetry Analysis and Threat Identification
Question 458Question →

A Security Operations Center (SOC) is designing an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle high-severity alerts triggered when an Amazon S3 storage bucket hosting confidential customer data is modified to allow public read access. The playbook must rapidly mitigate public data exposure while ensuring operational continuity for legitimate internal microservices that depend on the bucket. Which TWO of the following design choices should be incorporated into the automated response playbook to achieve effective containment without causing catastrophic service disruption?

Select all that apply

Show answer & explanation

Answer: Configure an automated playbook action to invoke cloud API webhooks that immediately apply an explicit 'Block Public Access' policy to the bucket while leaving authenticated IAM roles intact.; Include an automated enrichment step that queries cloud audit logs for recent policy change events and appends access metadata to the incident ticket prior to triggering analyst notifications.

Answer

The correct playbook design choices are to invoke cloud API webhooks that apply an explicit public access block to the S3 bucket while preserving authenticated IAM access, and to include automated enrichment that queries cloud audit logs for policy change events to context-enrich the incident ticket.
The correct options properly balance rapid automated containment with operational safety and forensic enrichment. Utilizing API webhooks to apply a public access block neutralizes the misconfiguration immediately without invalidating internal IAM roles required by microservices. Simultaneously, automating the retrieval of audit log metadata provides essential context to responders without delaying containment.

Step-by-Step Solution

1
Evaluate containment mechanisms for object storage exposure.
Identified that applying an explicit public block via API webhooks surgically eliminates internet exposure without disrupting internal IAM-authenticated services.
Containment actions in SOAR playbooks must isolate the threat vector without breaking production dependencies.
2
Assess the role of context enrichment in automated incident workflows.
Determined that gathering recent API audit log trails automatically enriches the ticket with attacker/user context for effective analyst triage.
SOAR platforms excel at aggregating threat intelligence and log metadata before escalating to human responders.
3
Analyze distractor containment and control options for operational risk and technical feasibility.
Rejected bucket deletion due to severe operational damage and rejected host IPS agent installation due to the architectural reality of cloud object storage services.
Automated playbooks must avoid destructive actions on production data assets and must respect cloud platform control boundaries.

Key Concept

SOAR Playbook Containment Logic and Context Enrichment
Question 459Question →

During an ongoing internal incident investigation, a security analyst suspects that a logged-in workstation is currently running an active malicious process in memory that is exfiltrating sensitive database records to an external server. The system is powered on and connected to the local network. To ensure maximum evidentiary value and legal admissibility for potential prosecution, which of the following actions should the analyst take FIRST?

Show answer & explanation

Answer: Capture the system's volatile memory (RAM) using an approved live acquisition tool before powering off or disconnecting the device.

Answer

Capturing the system's volatile memory (RAM) using an approved live acquisition tool before taking any action that modifies the system state.
According to standard digital forensics guidelines and RFC 3227 (Order of Volatility), evidence must be gathered starting from the most volatile items to the least volatile items. Active system memory (RAM) containing execution stacks, network connections, and unencrypted keys is highly perishable and must be preserved prior to powering down or performing disk-level imaging.

Step-by-Step Solution

1
Evaluate the current operational state of the compromised host system.
The target computer is powered on with active processes running in system memory.
Understanding host state determines which artifacts are most volatile and at risk of immediate loss.
2
Apply the Order of Volatility principles to sequence evidence acquisition.
System memory (RAM) and active cache/registers take priority over non-volatile hard disk storage and remote logs.
Volatile data disappears when the device loses power or shuts down, whereas disk data persists across reboots.
3
Execute live memory capture using an authorized forensic acquisition tool.
A cryptographically hashed RAM dump file is preserved for forensic analysis.
This captures the running malicious process, injected code, and active network connections without destroying evidence.

Key Concept

Order of Volatility in Digital Forensics
Question 460Question →

A Security Operations Center (SOC) analyst is investigating SIEM alert correlation logs for an internal endpoint with IP address 10.0.4.112. The log collector correlates recursive DNS resolver logs with outbound NetFlow records as shown below:

2026-07-27T11:02:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=a9f1b.data-sync-update.com rcode=NOERROR rdata="ZXhoYWlsZV9jMg=="
2026-07-27T11:03:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=c3k8p.data-sync-update.com rcode=NOERROR rdata="dHJhbnNtaXRfZGF0YQ=="
2026-07-27T11:04:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=e7m2q.data-sync-update.com rcode=NOERROR rdata="Y29tbWFuZF9hY2s=
2026-07-27T11:04:15Z NETFLOW_OUT src=10.0.4.112:49812 dst=203.0.113.88:443 bytes=148200 proto=TCP flags=ACK,PSH

Which of the following findings accurately interpret these network security monitoring logs and represent effective mitigation steps? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The pattern of periodic DNS TXT queries with encoded subdomain prefixes indicates DNS tunneling used for command-and-control (C2) communication or data staging.; Configuring DNS sinkholing or Response Policy Zone (RPZ) rules on the local recursive resolver provides immediate containment by blocking resolution of the malicious domain.

Answer

The telemetry indicates DNS tunneling for command-and-control (C2) beaconing, which is best contained by implementing DNS sinkholing or Response Policy Zone (RPZ) rules.
The correct options accurately identify the threat as DNS tunneling and select the appropriate remediation. DNS tunneling encodes binary command strings into DNS subdomains and TXT record responses, providing a covert C2 channel over standard port 53 traffic. DNS sinkholing (or RPZ) is the primary containment strategy because it intercepts resolution attempts for the adversary-controlled domain at the recursive resolver level.

Step-by-Step Solution

1
Analyze the DNS protocol behavior and query characteristics.
Identified high-frequency, randomized subdomain queries under a single domain (data-sync-update.com) requesting TXT records containing Base64-encoded strings at strict 60-second intervals.
Covert channels like DNS tunneling encode payload data into DNS subdomains or record fields to bypass perimeter firewall inspection.
2
Correlate DNS telemetry with outbound flow logs.
Confirmed outbound TCP connection spikes immediately following successful DNS TXT query responses.
The C2 agent receives instructions via DNS TXT record payloads and establishes secondary egress connections based on received commands.
3
Evaluate appropriate network monitoring containment strategies.
Select DNS sinkholing / Response Policy Zones (RPZ) at the internal resolver layer.
Sinkholing prevents the compromised host from resolving malicious C2 domains, isolating the host from external adversary control while logging blocked connection attempts.

Key Concept

DNS Tunneling Detection and DNS Sinkholing Mitigation
Estimated Time:2m 0s
PreviousPage 23 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 23 | Examkin