Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 461Question →

A Security Operations Center (SOC) analyst is reviewing the following syslog sequence captured from a Linux bastion server:

Jul 27 14:15:02 sec-srv01 sshd[18420]: Failed password for invalid user admin from 198.51.100.45 port 42102 ssh2
Jul 27 14:15:05 sec-srv01 sshd[18422]: Failed password for invalid user admin from 198.51.100.45 port 42108 ssh2
Jul 27 14:15:09 sec-srv01 sshd[18425]: Failed password for valid user devops from 198.51.100.45 port 42115 ssh2
Jul 27 14:15:14 sec-srv01 sshd[18429]: Accepted publickey for devops from 198.51.100.45 port 42122 ssh2 RSA SHA256:7b+x...

Based on these log entries, which of the following events has occurred?

Show answer & explanation

Answer: An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.

Answer

An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.
The log sequence demonstrates an initial set of failed password authentication attempts from IP address 198.51.100.45 targeting invalid accounts ('admin') and a valid account ('devops'). The final entry shows a successful logon for the user 'devops' using an SSH RSA public key from the same source IP.

Step-by-Step Solution

1
Analyze the log entries sequentially by timestamp and event message.
Entries show repeated failed password attempts from IP 198.51.100.45 for both non-existent ('admin') and existing ('devops') accounts.
Tracking account names and failure statuses identifies initial password guessing or account scanning behavior.
2
Evaluate the final log entry in the sequence.
The final entry records 'Accepted publickey for devops' from the same IP address.
This confirms successful identity verification using SSH key authentication following the failed password attempts.

Key Concept

SSH Authentication Telemetry and Log Analysis
Question 462Question →

An enterprise Endpoint Detection and Response (EDR) agent detects an unauthorized process attempting to read sensitive memory structures from the Local Security Authority Subsystem Service (LSASS) on a finance system host. In what sequence should the automated EDR response workflow process this security event from initial containment to post-incident analysis?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with detecting anomalous process behavior, followed by isolating the host via the EDR agent, terminating malicious processes and quarantining artifacts, and concludes with gathering forensic telemetry for fleet-wide IoC threat hunting.
The workflow follows standard EDR incident response methodology: first detect the malicious behavioral attempt on the endpoint, isolate the host to restrict lateral movement, kill malicious processes and quarantine binary components, and finally gather forensic telemetry to hunt for Indicators of Compromise (IoCs) enterprise-wide.

Step-by-Step Solution

1
Behavioral Alert Triggering
The EDR agent flags the LSASS memory access attempt as a high-severity alert.
Detection forms the entry point for automated incident playbooks.
2
Host Containment & Isolation
Network traffic to and from the host is restricted except for the security agent control server.
Isolating the endpoint prevents the attacker from utilizing dumped credentials laterally while investigation proceeds.
3
Active Mitigation & Artifact Quarantine
The rogue process handle is killed and file modifications are moved to secure quarantine.
Terminating process handles halts local code execution after network propagation risk is mitigated.
4
Forensic Telemetry & Fleet Hunting
Memory state telemetry is collected and IOC hashes are searched across all endpoints.
Broad threat hunting ensures the adversary has not established duplicate persistence on adjacent hosts.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Remediation Workflow
Question 463Question →

An enterprise Security Operations Center (SOC) detects unauthorized execution of encryption software across several internal host systems. Place the following incident response playbook actions in the correct chronological order according to NIST SP 800-61 guidelines, starting from initial detection.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response lifecycle steps is: 1) Validate initial alert and scope, 2) Isolate affected network subnet, 3) Terminate processes and purge artifacts, 4) Restore hosts from clean backups, and 5) Hold a post-incident review meeting.
According to standard NIST SP 800-61 guidelines, incident response follows a strict linear sequence: Detection and Analysis (scoping the incident), Containment (isolating affected network segments), Eradication (purging malicious binaries and persistence hooks), Recovery (restoring systems from clean backups), and Post-Incident Activity (documenting lessons learned).

Step-by-Step Solution

1
Analyze telemetry and validate the incident.
Confirm indicators of compromise and scope of affected host systems.
Accurate scope identification ensures containment measures target all affected systems without prematurely interrupting unaffected services.
2
Implement network containment controls.
Prevent active encryption threats from spreading laterally.
Stopping lateral movement and C2 communication limits potential operational damage.
3
Execute eradication actions.
Eliminate malware binaries, malicious persistence hooks, and unauthorized access.
Systems cannot be restored safely until threat actor access mechanisms and malware are completely removed.
4
Perform system recovery.
Rebuild or restore endpoints from verified, uncompromised backups.
Restoring validated clean states ensures business continuity without reintroducing hidden compromise.
5
Conduct post-incident review.
Document lessons learned and update Incident Response playbooks.
Analyzing response performance identifies procedural gaps and prevents recurrence of similar incidents.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 464Question →

A security administrator needs to ensure that all newly deployed enterprise servers strictly adhere to a standardized, hardened set of initial operational settings prior to production release. Which of the following should the administrator implement to establish these standardized settings?

Show answer & explanation

Answer: A security configuration baseline profile

Answer

The administrator should implement a security configuration baseline profile, which establishes standardized, pre-approved hardening settings for newly deployed systems.
A configuration baseline profile defines a mandatory minimum standard for operating systems and applications, ensuring consistent hardening across all deployed assets.

Step-by-Step Solution

1
Identify the goal in the scenario
The requirement is to define standard, hardened security settings across all newly deployed systems.
The system lifecycle requires consistent initial configurations to prevent security weaknesses before systems enter production.
2
Evaluate potential configuration management tools
A security configuration baseline defines the standard minimum security setup (e.g., CIS benchmarks, DISA STIGs) for systems.
Baselines ensure uniformity, simplify drift monitoring, and minimize misconfigurations.

Key Concept

Security Baselines and Configuration Management
Question 465Question →

A network security analyst is reviewing real-time alert logs from a Network Intrusion Detection System (NIDS). The analyst spots an alert flagging an HTTP GET request containing the following parameter string: GET /products.php?id=1%20UNION%20SELECT%20username,%20password%20FROM%20users--. Which of the following attack types has been detected by this monitoring alert?

Show answer & explanation

Answer: SQL injection

Answer

SQL injection
The network monitoring alert log contains standard database query keywords (`UNION SELECT`), which indicates an attempt to extract data directly from a backend database engine via SQL injection.

Step-by-Step Solution

1
Analyze the payload string reported in the NIDS alert log.
Identified database query keywords `UNION SELECT username, password FROM users--` within the HTTP GET request.
Network monitoring alerts provide packet or URI details that indicate the nature of the payload.
2
Match the payload features to known web application exploit vectors.
Recognized SQL query syntax designed to append unauthorized queries to existing database commands.
SQL syntax injected via input parameters characterizes a SQL injection attempt.

Key Concept

Identifying attack signatures in network intrusion detection logs
Estimated Time:45s
Question 466Question →

A Security Operations Center (SOC) team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle suspicious email attachments reported by end users. Place the following playbook execution steps in the correct operational sequence from initial alert ingestion to final incident closure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Parse the email artifact to extract IOCs, 2) Query threat intelligence feeds via APIs for reputation data, 3) Evaluate conditional branching logic against policy thresholds, 4) Execute automated response actions (email quarantine and host isolation), and 5) Update the ticketing system and notify the SOC team.
Automated incident response playbooks follow a structured lifecycle: Ingestion/Parsing → Enrichment → Decision Evaluation → Remediation → Documentation. The playbook must first parse the reported email to identify specific indicators of compromise. It then enriches those indicators using threat intelligence APIs. Next, it evaluates conditional logic to confirm threat thresholds. Once confirmed, automated containment (such as mailbox quarantine and endpoint isolation) takes place. Finally, the playbook logs all actions in the ticketing system and notifies analysts.

Step-by-Step Solution

1
Parse and Extract Indicators
Raw file hashes, domain names, and IP addresses are extracted from the raw email header and payload.
SOAR automation cannot query threat intelligence tools or execute targeted actions without specific extracted artifacts.
2
Perform Threat Intelligence Enrichment
Reputation scores and threat categories are added to the incident context via API integrations.
Contextual intelligence provides the factual basis needed for automated decision-making.
3
Evaluate Playbook Decision Rules
The workflow determines whether risk criteria match automated containment conditions or require human analyst intervention.
Policy rules prevent accidental execution of intrusive containment actions on benign or unverified alerts.
4
Run Automated Mitigation Actions
The malicious email is purged/quarantined across all mailboxes, and impacted endpoints are logically isolated.
Neutralizing active threats prevents lateral movement and protects the enterprise footprint.
5
Document Findings and Notify Analysts
The incident ticket is updated with execution logs and alerted to security analysts for review.
Proper documentation ensures compliance, tracking, and seamless handoff to human analysts if further investigation is needed.

Key Concept

SOAR Playbook Workflow Sequencing
Estimated Time:1m 30s
Question 467Question →

During a security evaluation of a segmented payment processing environment, an analyst runs an automated vulnerability assessment against a cluster of Linux servers holding cardholder data. The final report lists open network ports and service banners, but fails to identify installed software patch levels or local kernel flaws. Further inspection reveals that administrative SSH credentials were properly entered into the scanner configuration, but network access control lists blocked SSH protocol traffic while permitting HTTPS traffic between the scanner and targets. Which of the following best accounts for the missing host-level vulnerability data in the final report?

Show answer & explanation

Answer: The scanner fell back to an uncredentialed network assessment because it could not establish an SSH management session to query local package management databases.

Answer

The missing host-level vulnerability data occurred because the scanner fell back to an uncredentialed network assessment after network access control lists blocked its SSH authentication session.
Credentialed vulnerability scans require an active administrative session (such as SSH for Linux or WMI/WinRM for Windows) to inspect internal system configurations, patch levels, and installed packages. When network access control lists block the required protocol port, the scanner cannot authenticate and silently falls back to an uncredentialed network scan. Consequently, it can only report externally visible information like open ports and service banners, omitting internal host-level vulnerabilities.

Step-by-Step Solution

1
Analyze the scanner configuration and network path parameters in the scenario.
Administrative SSH credentials were configured on the scanner, but network ACLs blocked SSH traffic while allowing HTTPS traffic.
Establishing a credentialed scan requires successful end-to-end network connectivity on the administrative protocol (SSH port 22).
2
Evaluate how vulnerability scanners handle authentication session failure.
When authentication protocol traffic is blocked by a network firewall or ACL, the scanner cannot authenticate locally and degrades to an uncredentialed network probe.
Uncredentialed network scans rely only on banner grabbing and exposed network services, missing local OS patch states, file permissions, and kernel vulnerabilities.
3
Select the option that accurately describes this scanner fallback behavior.
The option explaining that the scanner defaulted to an uncredentialed network assessment due to failed SSH connectivity is correct.
It directly links the network ACL restriction on SSH to the absence of host-level patch and package vulnerability findings.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning
Question 468Question →

A security analyst is reviewing correlated events in a SIEM console generated from cloud audit logs:

text
[2026-07-27T10:14:22Z] AWS CloudTrail: eventName=ConsoleLogin, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=198.51.100.45, responseElements={ConsoleLogin=Success}, additionalEventData={MFAUsed=No}
[2026-07-27T10:14:25Z] AWS CloudTrail: eventName=CreateAccessKey, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=198.51.100.45, responseElements={accessKey={accessKeyId=AKIAIOSFODNN7EXAMPLE}}
[2026-07-27T10:15:01Z] AWS CloudTrail: eventName=DescribeInstances, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=203.0.113.88, userAgent=aws-cli/2.11.0

Based on the log sequence provided, which of the following conclusions and immediate mitigation steps are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The compromised identity logged into the console without multi-factor authentication before creating a persistent programmatic access key.; The incident response process should immediately revoke active IAM user sessions and deactivate access key AKIAIOSFODNN7EXAMPLE.

Answer

The correct conclusions and actions are that the user identity was authenticated without MFA prior to creating a programmatic access key, and that responders must deactivate access key AKIAIOSFODNN7EXAMPLE and revoke active user sessions.
The CloudTrail log sequence demonstrates that account `jdoe` logged into the management console without MFA (`MFAUsed=No`) and immediately created a long-term API access key (`AKIAIOSFODNN7EXAMPLE`). Shortly thereafter, that generated access key was utilized from a different IP address (`203.0.113.88`) to perform infrastructure enumeration (`DescribeInstances`). Effective incident containment requires deactivating the compromised access key and invalidating all active user sessions.

Step-by-Step Solution

1
Analyze the ConsoleLogin log telemetry
Identified that user `jdoe` authenticated successfully from IP `198.51.100.45` with `MFAUsed=No`.
Single-factor console login represents a primary vulnerability indicator in administrative audit trails.
2
Correlate chronologically subsequent API calls
Observed key generation (`CreateAccessKey` ID `AKIAIOSFODNN7EXAMPLE`) 3 seconds post-login, followed by AWS CLI recon (`DescribeInstances`) from a secondary IP (`203.0.113.88`).
Sequencing shows post-compromise persistence creation and immediate secondary IP access using programmatic credentials.
3
Determine containment requirements
Containment requires invalidating generated credentials (`AKIAIOSFODNN7EXAMPLE`) and terminating active session tokens.
Invalidating the key stops external CLI access, and revoking sessions prevents ongoing console persistence.

Key Concept

Cloud Audit Log Analysis and SIEM Event Correlation
Question 469Question →

An analyst is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to respond to API token abuse detected by a SIEM. The playbook must automatically mitigate active malicious access while minimizing operational disruption to critical cloud workloads. Which of the following automated actions should be incorporated into the playbook containment workflow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke the affected API access token via API calls to the Identity and Access Management (IAM) provider.; Quarantine active user sessions associated with the compromised credential to force re-authentication.

Answer

The correct automated containment actions are revoking the compromised API access token via IAM integration and quarantining active user sessions associated with the credential to force re-authentication.
Automated SOAR playbooks should execute targeted actions that eliminate unauthorized access without causing broad outages. Revoking the specific compromised API access token directly removes the attacker's entry mechanism. Simultaneously, invalidating active sessions associated with the user account forces re-authentication, preventing further exploitation while limiting operational impact to unaffected systems.

Step-by-Step Solution

1
Identify targeted containment controls for API token compromise.
Disabling the specific revoked token stops unauthorized API requests directly at the identity layer.
Targeted token revocation neutralizes the active threat vector immediately without impacting other infrastructure.
2
Enforce session invalidation.
Terminating active sessions linked to the identity prevents persistent session exploitation.
Forcing re-authentication validates user identity while cutting off stolen session tokens.
3
Evaluate potential side effects of over-broad automated actions.
Shutting down core API gateways creates self-inflicted downtime, while escalating roles increases security risks.
SOAR playbooks must balance automated response speed with service availability and least privilege principles.

Key Concept

SOAR Automated Containment and Playbook Safety Controls
Question 470Question →

A incident response analyst is performing evidence collection on a live enterprise server following an intrusion alert. According to the Order of Volatility standard, in what sequence should the analyst acquire the evidence sources, ordered from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and L1/L2 cache memory, followed by System RAM and active ARP routing tables, then Local solid-state persistent disk storage, and lastly Off-site archival backup tapes.
Forensic evidence acquisition follows RFC 3227 Order of Volatility: CPU registers and cache (most volatile) -> System RAM and network cache -> Local persistent disk storage -> Off-site archival backup tapes (least volatile).

Step-by-Step Solution

1
Assess the volatility of processor-level data structures.
CPU registers and caches change at nanosecond speeds and clear immediately upon CPU halt.
Processor memory represents the highest volatility tier in digital forensics.
2
Assess the volatility of main memory and active state information.
System RAM and ARP/routing caches hold volatile dynamic runtime data.
This data remains intact only while power is continuously supplied to the host.
3
Assess the volatility of local secondary storage media.
Local SSD and magnetic drives hold non-volatile data files.
Disk contents persist on physical media even after host power is removed.
4
Assess the volatility of offline long-term archives.
Archival backup tapes contain static snapshot data.
Offline backup media changes least frequently and retains data indefinitely.

Key Concept

Order of Volatility (RFC 3227)
Question 471Question →

A security analyst is implementing an out-of-band security patch for a critical database cluster following the discovery of an actively exploited zero-day vulnerability. Arrange the following steps of the emergency patch management process in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for emergency patch deployment is: 1) Validate patch authenticity and execute sandbox testing in staging, 2) Submit an Emergency Change Request with a rollback plan, 3) Deploy the patch to the production database cluster, 4) Perform post-implementation vulnerability scanning and health checks, and 5) Update the CMDB and system security baseline image.
The standard emergency patch management lifecycle follows a strict sequence to balance urgent vulnerability mitigation with operational risk management. First, validating and testing the patch in an isolated sandbox ensures it does not destabilize the software ecosystem. Second, submitting an Emergency Change Request (ECR) with a rollback strategy maintains change control governance. Third, the patch is deployed to production systems once approved. Fourth, post-implementation vulnerability scans and service health checks confirm the flaw is resolved without side effects. Finally, updating the CMDB records and baseline images preserves configuration integrity and prevents drift during future node provisioning.

Step-by-Step Solution

1
Perform initial pre-deployment testing and signature verification in a non-production environment.
The patch is verified as genuine and free from breaking application dependencies.
Applying unverified patches directly to production risks outage or malware injection.
2
Obtain formal emergency authorization via Emergency Change Advisory Board (ECAB).
Authorized emergency change ticket with mandatory fallback/rollback procedures established.
Change control governance prevents unauthorized alterations and ensures back-out plans exist.
3
Execute the patch deployment across production nodes.
Production servers receive and install the patch binaries.
Implementation executes the authorized changes on live production systems.
4
Conduct post-deployment validation scans and monitoring.
Confirmation that the target flaw is remediated and no regression issues exist.
Integrity checks confirm successful threat mitigation before closing the incident ticket.
5
Reconcile configuration management records and baseline artifacts.
CMDB and golden image templates reflect the new version compliance standard.
Updating baselines prevents future automated provisioning from reverting systems to an unpatched state.

Key Concept

Emergency Patch and Configuration Management Lifecycle
Question 472Question →

During routine operational monitoring of a Linux web application server hosting a customer portal, a security analyst identifies an unauthorized web shell script placed in the web root. Log entries confirm an external attacker is currently executing remote commands through the web shell to perform local privilege escalation. According to standard incident response procedures, which of the following actions should the security analyst take FIRST?

Show answer & explanation

Answer: Isolate the web application server from the network to prevent further unauthorized command execution and lateral movement.

Answer

Isolate the web application server from the network to prevent further unauthorized command execution and lateral movement.
In standard incident response frameworks (such as NIST SP 800-61), once an active incident is detected and analyzed, the immediate next step is Containment. Isolating the server from the network stops the attacker from continuing active remote command execution and prevents lateral movement into adjacent subnets.

Step-by-Step Solution

1
Analyze the scenario state within the Incident Response lifecycle framework.
The incident has been detected and analyzed; an active web shell is executing commands in real time.
Determining the current phase of the incident establishes the required sequence of technical actions.
2
Identify the immediate operational priority for an active compromise.
Containment must be executed immediately to restrict attacker access, stop ongoing command execution, and prevent lateral movement.
According to NIST SP 800-61 guidelines, containment limits incident damage before moving to root-cause removal.
3
Select the action that aligns with the containment phase.
Isolating the server from the network halts active attacker sessions while preserving system state for analysis and subsequent remediation.
Network isolation prevents external command and control traffic while keeping volatile evidence intact.

Key Concept

Incident Response Lifecycle Phase Ordering (Containment prior to Eradication and Recovery)
Estimated Time:1m 30s
Question 473Question →

A Security Operations Center (SOC) analyst is inspecting SIEM alerts originating from an internal web server hosting an enterprise customer portal. The SIEM correlated the following sequential Sysmon process creation events:

text
EventID: 1 (Process Create)
UtcTime: 2026-07-27 11:04:12.102
Image: C:\Windows\System32\inetsrv\w3wp.exe
CommandLine: w3wp.exe -ap "CustomerPortalPool"
User: NT AUTHORITY\NETWORK SERVICE

EventID: 1 (Process Create)
UtcTime: 2026-07-27 11:04:15.884
ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
Image: C:\Windows\System32\cmd.exe
CommandLine: cmd.exe /c powershell.exe -nop -w hidden -EncodedCommand aW52b2tlLXdlYnJlcXVlc3Q...
User: NT AUTHORITY\NETWORK SERVICE

Based on the log evidence provided, which of the following best describes the security incident taking place?

Show answer & explanation

Answer: A web application vulnerability was exploited to achieve remote code execution by spawning a command interpreter from the IIS worker process.

Answer

The incident represents web application exploitation resulting in server-side remote code execution, as demonstrated by the IIS web server process spawning a shell interpreter.
The correct analysis recognizes that `w3wp.exe` is the Internet Information Services (IIS) worker process responsible for serving web request code. When `w3wp.exe` acts as the parent process launching `cmd.exe` or `powershell.exe`, it signifies that an attacker exploited a web application flaw (such as command injection) to execute arbitrary commands on the host server.

Step-by-Step Solution

1
Analyze the parent-child process relationship in the Sysmon log entries.
The parent process is `w3wp.exe` (IIS Worker Process) and the child process is `cmd.exe` launching `powershell.exe`.
Web servers (`w3wp.exe`) should handle HTTP traffic and should not routinely launch interactive command prompt shells or PowerShell scripts.
2
Evaluate the command-line parameters and executed payload attributes.
The command includes `-nop -w hidden -EncodedCommand`, which are common evasive flags used to conceal malicious script execution.
Attackers frequently use Base64 encoding and hidden windows to bypass basic command-line monitoring.
3
Synthesize the log findings to classify the attack vector.
Spawning a system shell from a web daemon process confirms server-side Remote Code Execution (RCE) via web application vulnerability exploitation.
Exploits such as command injection or insecure deserialization force the web service account to execute arbitrary shell commands.

Key Concept

Identifying Remote Code Execution (RCE) and anomalous process lineage in web server and SIEM logs
Question 474Question →

Following a phishing simulation report, a security analyst reviews telemetry to identify systems where an unauthorized script executed via a native administrative tool without creating new executable files on disk. Traditional signature-based antivirus on the endpoints flagged no alerts. Which of the following Endpoint Detection and Response (EDR) capabilities allows the analyst to identify this activity?

Show answer & explanation

Answer: Process lineage tracking and behavioral telemetry collection

Answer

Process lineage tracking and behavioral telemetry collection
Process lineage tracking and behavioral telemetry collection allow EDR solutions to monitor process creation events, command-line arguments, and parent-child execution hierarchies. This enables analysts to spot suspicious activity, such as legitimate system binaries executing unusual commands, even when no malware binary is written to the disk.

Step-by-Step Solution

1
Analyze the incident context and attack vector.
Identified a fileless attack where native system binaries execute malicious scripts without saving new files to disk.
Traditional antivirus fails to detect this activity because no known malicious file signature is created on the filesystem.
2
Evaluate the required security capability to detect fileless activity.
Determined that monitoring runtime execution logic, parent-child process chains, and system behavior is necessary.
Fileless threats rely on legitimate binaries, requiring context-aware behavioral inspection rather than static file hash matching.
3
Select the EDR feature that provides this monitoring capability.
Process lineage tracking and behavioral telemetry collection.
EDR records the relationships between parent and child processes (such as a word processor launching a command shell), capturing anomalous behavior across endpoints.

Key Concept

Endpoint Detection and Response (EDR) behavioral telemetry and process lineage
Estimated Time:1m 30s
Question 475Question →

A system administrator is preparing to roll out a critical operating system patch across enterprise workstations. Which of the following tasks should be completed prior to deploying the patch into the broad production environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Test the patch in an isolated staging environment to verify system stability and application compatibility.; Establish a rollback plan and back up system configurations to ensure rapid recovery if the update fails.

Answer

Testing the patch in an isolated staging environment to verify system stability and establishing a rollback plan with backups prior to deployment.
Prior to deploying software updates across production environments, best practices require validating patch stability in a non-production staging environment and creating backups with a documented rollback plan to recover quickly if issues arise.

Step-by-Step Solution

1
Identify pre-deployment requirements in the patch management lifecycle.
Recognize that changes must be tested in a controlled staging environment before production release.
Testing mitigates the risk of unforeseen software incompatibilities or system crashes.
2
Determine risk mitigation procedures for patch deployment failures.
Establish backups and a clear rollback plan.
System snapshots and backups enable quick restoration if a patch introduces severe operational disruptions.

Key Concept

Pre-deployment Patch Staging and Rollback Planning
Question 476Question →

Following an automated alert indicating potential fileless malware activity on an operational database server, a security analyst must collect volatile digital evidence prior to server isolation. Adhering strictly to the standard order of volatility, which of the following data sources should the analyst acquire FIRST?

Show answer & explanation

Answer: CPU registers and cache contents

Answer

CPU registers and cache contents should be acquired first because they represent the most volatile data layer on a system.
The correct answer identifies CPU registers and cache contents as the most volatile components. According to the forensic order of volatility, evidence collection must begin with the shortest-lived data sources to prevent evidence destruction.

Step-by-Step Solution

1
Identify the data sources present in the scenario and rank them by volatility lifetime.
CPU registers/cache have lifetimes measured in nanoseconds; RAM in microseconds; swap/temp files in minutes/hours; disk drives persist until explicitly deleted.
Forensic evidence preservation must capture data at risk of immediate loss before capturing more stable data.
2
Apply the standard Order of Volatility guidelines (RFC 3227).
The sequence is: CPU registers/cache -> RAM/routing tables/process tables -> Swap/temp files -> Disk storage -> Remote logs/network traffic -> Archival media.
Following established forensic standards ensures evidence admissibility and integrity.
3
Select the highest priority item from the choices provided.
CPU registers and cache contents are at the top of the volatility hierarchy.
Acquiring CPU registers and cache first prevents critical CPU-bound execution artifacts from being overwritten during subsequent memory dumps.

Key Concept

Order of Volatility in Digital Forensics
Estimated Time:1m 15s
Question 477Question →

An enterprise systems administrator is troubleshooting a Kerberos authentication issue in an Active Directory environment. Place the steps of the Kerberos ticket exchange process in the correct order from initial user login to final resource access.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with the client sending an AS-REQ with pre-authentication data to the KDC, followed by the KDC returning an AS-REP with the Ticket Granting Ticket (TGT). Next, the client submits a TGS-REQ containing the TGT and target SPN to the TGS, which responds with a TGS-REP containing the Service Ticket. Finally, the client presents the Service Ticket to the target application server.
Kerberos follows a strict authentication flow: First, the client initiates authentication with the Authentication Server via AS-REQ and receives a TGT via AS-REP. Next, the client uses the TGT to request a service-specific ticket from the TGS via TGS-REQ and receives the Service Ticket via TGS-REP. Finally, the client presents the Service Ticket directly to the target application server for resource access.

Step-by-Step Solution

1
Initiate Authentication (AS-REQ)
Client contacts the KDC's Authentication Server with encrypted timestamp data.
Initial proof of identity is required before any tickets can be issued.
2
Obtain TGT (AS-REP)
Client receives the Ticket Granting Ticket and session key.
The TGT proves authentication status for subsequent service requests.
3
Request Service Ticket (TGS-REQ)
Client sends the TGT and target SPN to the TGS.
The client requests permissions for a specific service using its existing TGT.
4
Receive Service Ticket (TGS-REP)
Client receives a ticket encrypted with the service account's secret key.
The TGS validates the client's authority and grants a ticket tailored to the destination service.
5
Authenticate to Application Server (AP-REQ)
Client presents the Service Ticket to the target application server.
The application server verifies the ticket and authorizes access without contacting the KDC directly.

Key Concept

Kerberos Authentication Exchange Process
Question 478Question →

An enterprise security team manages a geographically distributed fleet of edge servers running containerized microservices. Following an emergency zero-day patch deployment, several edge nodes experience configuration drift, causing unauthorized modifications to local system baselines and security settings. Which TWO of the following technical controls should the security team implement to remediate this configuration drift and prevent future baseline deviations?

Select all that apply

Show answer & explanation

Answer: Redeploy validated Infrastructure as Code (IaC) templates through the automated deployment pipeline to restore systems to a compliant state.; Deploy continuous automated configuration auditing agents to monitor systems against established benchmarks and detect unauthorized changes.

Answer

The security team should redeploy validated Infrastructure as Code (IaC) templates through the automated pipeline and deploy continuous automated configuration auditing agents.
Redeploying validated Infrastructure as Code (IaC) templates through an automated pipeline guarantees that edge nodes return to a tested, immutable baseline without manual intervention. Combining this with continuous automated configuration auditing agents ensures ongoing compliance monitoring and instant detection of unauthorized modifications.

Step-by-Step Solution

1
Analyze the cause of system configuration drift after emergency patching.
Identified that out-of-band updates bypassed automated build pipelines, resulting in inconsistent baseline enforcement across edge nodes.
Understanding why drift occurred is necessary to select effective automated remediation strategies.
2
Restore standard system baselines using pipeline automation.
Nodes are returned to a verified, compliant state by executing validated IaC templates.
Automated deployment eliminates manual errors and enforces declarative, immutable configuration baselines.
3
Establish real-time visibility into system state deviations.
Automated compliance agents continuously evaluate system state against hardened baseline profiles.
Continuous auditing ensures rapid detection and notification when unauthorized local modifications or drift occur.

Key Concept

Configuration Baseline Enforcement and Drift Management
Question 479Question →

A security operations analyst is investigating an automated alert from a enterprise Identity Provider (IdP). An administrator attempted to access a critical production Kubernetes management console, generating the following log excerpt:

text
[TIMESTAMP: 2026-07-27T14:20:11Z] EVENT: Auth_Request | User: admin_ops | Source_IP: 10.240.12.88 | Protocol: SAML_2.0 | Auth_Result: SUCCESS (MFA Verified)
[TIMESTAMP: 2026-07-27T14:20:15Z] EVENT: Resource_Access | User: admin_ops | Target: Prod_K8s_Console | Action: EVAL_POLICY | Result: DENIED | Reason: Missing_Privileged_Role_Claim
[TIMESTAMP: 2026-07-27T14:20:18Z] EVENT: Privileged_Elevate | User: admin_ops | Request_ID: 99412 | Action: ASSUME_ROLE | Result: FAILED | Reason: No_Active_PAM_Approval_Ticket

Which of the following security operational concepts best explains why access was blocked after successful identity verification?

Show answer & explanation

Answer: The user successfully completed authentication, but the request was denied during authorization due to missing entitlement claims and unapproved PAM elevation requirements.

Answer

The user successfully completed authentication, but the request was denied during authorization due to missing entitlement claims and unapproved PAM elevation requirements.
The correct option identifies the fundamental separation between authentication and authorization in identity operations. The logs confirm that the user successfully authenticated using SAML 2.0 and MFA. However, when attempting to access the Kubernetes management console, the authorization check failed because the session lacked the required role claim and had no active, approved PAM elevation ticket.

Step-by-Step Solution

1
Analyze the log timestamp 14:20:11Z
The identity provider confirmed successful SAML 2.0 authentication and verified Multi-Factor Authentication (MFA).
This establishes identity (Authentication phase).
2
Analyze the log timestamps 14:20:15Z and 14:20:18Z
Policy evaluation failed due to a missing role claim and an absent Privileged Access Management (PAM) ticket.
This evaluates rights and privileges (Authorization phase).
3
Synthesize security controls
Distinguish that identity proofing (authentication) succeeded, but privilege enforcement (authorization) correctly blocked unauthorized access.
AAA security models separate identity verification from access privilege granting.

Key Concept

Authentication vs. Authorization in IAM Operations
Question 480Question →

A security engineering team is refining the vulnerability assessment strategy for a hybrid cloud environment. The team wants to obtain detailed patch and configuration status from cloud virtual machines while minimizing network bandwidth overhead and avoiding the transmission of privileged domain credentials across the network. Which TWO of the following configurations or approaches should the team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy host-based vulnerability scanner agents directly onto the virtual machines to conduct local authenticated assessments.; Leverage cloud API integration to perform offline disk snapshot and image vulnerability assessments.

Answer

The security team should deploy host-based scanner agents onto the virtual machines and leverage cloud API integration for offline disk snapshot assessments.
Deploying host-based vulnerability scanner agents directly on targets allows local execution without transmitting privileged credentials over the network or incurring heavy network scan traffic. Additionally, leveraging cloud API integration for offline disk snapshot scanning allows out-of-band analysis of host filesystems without impacting running workloads or needing network probes.

Step-by-Step Solution

1
Analyze requirements for zero network credential transmission and minimal network bandwidth overhead.
Identify that traditional remote network scans with elevated credentials expose network traffic and introduce significant overhead.
Host-based agents execute assessments locally, eliminating the need to transmit administrative credentials over the wire and drastically reducing network bandwidth consumption.
2
Evaluate cloud-native vulnerability assessment capabilities.
Determine that out-of-band snapshot scanning using cloud management APIs provides comprehensive visibility into OS vulnerabilities.
API-driven snapshot inspection assesses virtual machine disks without interacting with active production network interfaces or running live network probes.

Key Concept

Credentialed vulnerability assessment methods using host agents and cloud API integration
PreviousPage 24 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 24 | Examkin