Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

A network security analyst receives a high-severity Network Intrusion Detection System (NIDS) alert signaling anomalous outbound data transfers from a internal web server to an unknown external IP address. Which of the following sequences represents the correct chronological order of network security monitoring and incident triage steps the analyst should follow from initial alert validation through enterprise protection?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for network security monitoring and triage is: 1) Correlate the NIDS alert with web server access logs and SIEM event streams to confirm a true positive condition; 2) Capture live network flow telemetry and analyze packet payloads to determine the scope of exfiltrated data; 3) Apply targeted network access control rules to isolate the compromised web server from external endpoints; 4) Extract network Indicators of Compromise (IoCs) and deploy updated NIPS signatures across the enterprise perimeter.

The standard network security monitoring triage workflow starts with alert validation against correlated SIEM and web logs to confirm a true positive. Following validation, packet payload and NetFlow telemetry are analyzed to establish the breach extent and extract threat characteristics. Once the attack profile is understood, network isolation controls are applied to block live exfiltration. Finally, derived network Indicators of Compromise (IoCs) are deployed to NIPS rules to prevent secondary attacks enterprise-wide.

Step-by-Step Solution

Verify Alert Authenticity

Confirmed true positive alert identifying the source web server and destination IP.

Initial network monitoring triage requires cross-referencing raw NIDS alerts with host logs and SIEM data to rule out false positives.

Analyze Telemetry & Packet Data

Determined exfiltrated data volume, protocols, and malicious payload characteristics.

Inspecting packet payloads and flow records provides detailed context regarding breach impact and specific Indicators of Compromise (IoCs).

Enforce Network Isolation

Active exfiltration path blocked without powering off host, preserving volatile RAM and active connection state.

Network containment halts ongoing unauthorized transmission once the nature of the threat is understood.

Update Defensive Signatures

Enterprise NIPS and firewall devices configured with new block rules and signatures.

Feeding extracted IoCs back into network intrusion prevention systems mitigates risk across the rest of the enterprise.

Key Concept

Network Security Incident Monitoring and Alert Triage Workflow

Question 482Question →

During an ongoing incident investigation, a security analyst suspects that a compromised workstation is executing fileless commands in memory and attempting to persist across reboots. Which of the following capabilities and telemetry sources provided by an Endpoint Detection and Response (EDR) solution should the analyst utilize to contain the threat and investigate the attack? (Select TWO)

Select all that apply

Initiating network isolation of the affected host while preserving agent-to-management console communication

Capturing real-time process execution lineage and parent-child relationship logs

Updating edge firewall stateless packet filtering rules to block internal host memory access calls

Relying strictly on scheduled static file signature updates to identify in-memory code injection

Show answer & explanation

Answer: Initiating network isolation of the affected host while preserving agent-to-management console communication; Capturing real-time process execution lineage and parent-child relationship logs

Answer

The correct response actions are isolating the affected host from the network while maintaining agent console connectivity, and collecting real-time process lineage telemetry to trace parent-child process execution.

Isolating the endpoint stops network-based propagation while maintaining EDR agent communication for analysis. Furthermore, process lineage logs provide behavioral visibility into parent-child process relationships, allowing analysts to detect fileless execution patterns.

Step-by-Step Solution

Identify the immediate containment capability required for an infected endpoint.

Network host isolation stops lateral network traffic while retaining remote management access for security staff.

Preventing lateral movement is critical during incident response without losing administrative control over the EDR agent.

Identify the telemetry source capable of diagnosing fileless memory execution.

Process lineage tracking captures the sequence of parent and child process creation.

Fileless scripts often run via legitimate binaries, requiring historical process trees to identify the root cause of execution.

Key Concept

Endpoint Detection and Response (EDR) Containment and Telemetry

Question 483Question →

A Security Operations Center (SOC) analyst detects suspicious internal SMB traffic and administrative share creation originating from an HR workstation after business hours. Further inspection reveals that the host is actively communicating with an external command-and-control (C2) server. According to standard incident response frameworks, which of the following actions should the incident response team perform during the Containment phase? (Select TWO.)

Select all that apply

Disconnect the host from the network by disabling its network interface or isolating its switch port.

Re-image the host operating system immediately and restore data from the latest clean backup.

Apply temporary network access control rules to block outbound traffic from the workstation to the suspected C2 IP address.

Reconfigure perimeter firewall rules to block all inbound HTTP and HTTPS connections across the enterprise.

Show answer & explanation

Answer: Disconnect the host from the network by disabling its network interface or isolating its switch port.; Apply temporary network access control rules to block outbound traffic from the workstation to the suspected C2 IP address.

Answer

The incident response team should disconnect the host from the network by disabling its network interface or isolating its switch port, and apply temporary network access control rules to block outbound traffic from the workstation to the suspected C2 IP address.

During the Containment phase of incident response, the primary goal is to isolate affected systems and prevent lateral movement or data exfiltration while preserving system state for volatile memory capture. Disabling the workstation network connection and blocking outbound connections to the external C2 address accomplish effective, targeted containment.

Step-by-Step Solution

Identify the target phase of the incident response lifecycle required by the scenario.

The question specifically requests immediate next steps for the Containment phase.

Containment focuses on limiting the scope, impact, and blast radius of an active security incident while preventing ongoing threat actor activity.

Evaluate technical actions that restrict attacker C2 activity and internal lateral movement without destroying evidence.

Isolating the workstation switch port/interface and blocking the specific C2 IP address at the firewall achieve containment.

These steps isolate the compromised system and cut off external communication while leaving volatile RAM intact for forensic analysis.

Eliminate options representing out-of-order IR phase actions or improper control scoping.

Re-imaging belongs in Eradication/Recovery, while blocking all enterprise HTTP/HTTPS traffic is an inappropriate control scope.

Wiping systems prematurely destroys forensic evidence, and global web blocks cause unnecessary business disruption.

Key Concept

Incident Response Containment Strategies

Question 484Question →

During a post-incident review of a cloud VPC environment, a network security monitoring (NSM) analyst inspects the following log generated by a monitoring sensor attached to a Virtual Network TAP:

text
[ALERT] 2026-07-27T14:22:05.112482 [GID: 1] [SID: 2049110] [REV: 3]
[Classification: A Network Trojan was detected] [Priority: 1]
{TCP} 10.150.4.52:49812 -> 198.51.100.77:8443
[Payload Snippet]: 47 45 54 20 2f 61 70 69 2f 76 31 2f 63 6f 6d 6d 61 6e 64 73
[TLS SNI]: c2.external-domain.invalid | [JA3 Fingerprint]: e7d705a3286e19ea42f589255019d675

Although the Snort/Suricata rule applied to the sensor was configured with a `drop` action, packet telemetry reveals the outbound C2 session established successfully and transferred data. Which of the following best explains why the malicious traffic was not blocked?

The sensor received mirrored traffic out-of-band via a TAP, limiting its capability to passive detection (NIDS) rather than inline prevention (NIPS).

The sensor misclassified the preventive control rule as a deterrent control because the SIEM correlation engine failed to map the priority header.

The sensor automatically diverted the unblocked connection into an isolation honeypot network due to a SIEM correlation rule override.

The analyst should have configured host-level egress firewall rules on the destination server instead of relying on network signature evaluation.

Show answer & explanation

Answer: The sensor received mirrored traffic out-of-band via a TAP, limiting its capability to passive detection (NIDS) rather than inline prevention (NIPS).

Answer

The sensor was deployed out-of-band via a network TAP interface, restricting it to passive Network Intrusion Detection System (NIDS) functionality, which cannot actively drop inline network traffic.

The correct answer correctly identifies that a sensor connected to a Virtual Network TAP operates out-of-band in a passive Network Intrusion Detection System (NIDS) role. Because traffic is mirrored to the sensor, the sensor has no physical or logical path to drop or modify packets passing between the source host and the remote destination.

Step-by-Step Solution

Analyze the sensor deployment topology described in the scenario stem.

Identified that the NSM sensor receives network telemetry from a Virtual Network TAP (Test Access Point).

TAP interfaces and mirrored SPAN ports copy network traffic for out-of-band analysis without inserting the monitoring device into the physical or virtual inline transit path.

Evaluate the functional difference between passive detection (NIDS) and active prevention (NIPS) capabilities.

Determined that `drop` or `reject` rule actions require an inline deployment (NIPS) to actively drop packets in transit.

An out-of-band sensor receives packet copies after or as they pass through switch fabrics; issuing a packet drop command on a mirror stream cannot halt the original packets.

Conclude why the malicious connection succeeded despite the rule configuration.

The failure to prevent traffic stems from architecture deployment limitations (out-of-band TAP), not software rule syntax errors.

Matching active block rules on passive tap monitoring sensors yields alerts but cannot enforce traffic inline.

Key Concept

Passive NIDS vs. Inline NIPS Deployment Architecture

Estimated Time:2m 0s

Question 485Question →

A security engineer is designing an enterprise Security Information and Event Management (SIEM) log pipeline to ingest data from heterogeneous sources. Place the stages of the log processing life cycle in the correct chronological order from initial log intake to incident detection notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of log processing within a SIEM pipeline is: Log Collection & Ingestion, Parsing & Normalization, Aggregation & Indexing, Correlation Engine Processing, and Alerting & Escalation.

In a modern SIEM architecture, log data must flow logically from capture (ingestion) to field mapping (normalization), centralized storage indexing (aggregation), threat pattern evaluation (correlation), and finally analyst notification (alerting).

Step-by-Step Solution

Gather raw telemetry from sources

Raw logs are retrieved via agents, Syslog streams, or cloud API integrations (Log Collection & Ingestion).

Log data must first enter the SIEM platform before any transformation or analysis can occur.

Standardize heterogeneous log formats

Raw syslog, JSON, and XML entries are translated into standardized fields such as source IP, destination port, and user ID (Parsing & Normalization).

Disparate logs must share a common schema so cross-platform rules can interpret them uniformly.

Store and structure data for searching

Normalized events are indexed into high-performance search databases and datastores (Aggregation & Indexing).

Indexing ensures efficiently structured data availability for rule engines and historical SOC investigations.

Evaluate data against detection logic

The correlation engine analyzes normalized, indexed log streams against behavioral patterns and complex conditional rules (Correlation Engine Processing).

Detection engines depend on multi-source normalized events to identify cross-system indicators of compromise.

Dispatch actionable security notifications

Matches exceeding risk thresholds generate SOC notifications, tickets, or automated SOAR triggers (Alerting & Escalation).

Notifications take place only after rule logic confirms a security event.

Key Concept

SIEM Log Processing Pipeline

Question 486Question →

A security analyst monitoring a Linux web server notices an alert indicating an unauthorized process was spawned in memory following a web application exploit. The process is actively attempting to establish outbound command-and-control (C2) communication. To minimize impact, the security analyst must stop the adversary's lateral movement and communication immediately without powering down the host or losing volatile RAM evidence. Which of the following EDR features best fulfills this requirement?

Initiating agent-based network isolation on the host to sever non-management network traffic while leaving the endpoint powered on

Updating edge perimeter firewall access control lists to block incoming HTTP requests to the web server

Pushing updated static antivirus hash signatures to quarantine the malicious binary on disk

Creating manual iptables host firewall rules on the compromised server to block the destination C2 port

Show answer & explanation

Answer: Initiating agent-based network isolation on the host to sever non-management network traffic while leaving the endpoint powered on

Answer

Initiating agent-based network isolation on the host to sever non-management network traffic while leaving the endpoint powered on is the correct action.

The correct answer leverages EDR agent host network isolation. This capability restricts network traffic at the endpoint driver level, blocking all unauthorized inbound and outbound network connections while maintaining a secure management tunnel for security analysts to collect forensic artifacts such as volatile memory (RAM).

Step-by-Step Solution

Identify the primary incident response containment objective.

The endpoint must be restricted from communicating outbound or laterally without destroying volatile evidence stored in RAM.

Shutting down or rebooting the server destroys critical forensic memory artifacts.

Evaluate EDR capabilities against legacy or network-level controls.

EDR host network isolation isolates the operating system at the software driver layer while maintaining agent telemetry management connectivity.

This allows remote analysts to perform containment instantly and collect volatile memory without allowing the attacker to navigate laterally.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation

Estimated Time:1m 30s

Question 487Question →

A security analyst monitoring identity provider logs identifies anomalous administrative API activity originating from an untrusted external IP address. Investigation reveals that a high-privilege user's OAuth refresh token was stolen via a session hijacking attack. The unauthorized actor is actively using this token to query and exfiltrate sensitive cloud database backups. Which of the following actions should the incident response team take FIRST to contain the breach?

Revoke the compromised OAuth token and invalidate all active sessions associated with the user account across the identity provider.

Re-image the user's primary endpoint computer and re-install all baseline enterprise applications.

Draft an updated access control policy mandating FIDO2 hardware tokens for all future user authentication.

Schedule a post-incident lessons-learned meeting with executive management to review response metrics.

Show answer & explanation

Answer: Revoke the compromised OAuth token and invalidate all active sessions associated with the user account across the identity provider.

Answer

Revoke the compromised OAuth token and invalidate all active sessions associated with the user account across the identity provider.

The correct response prioritizes immediate containment during an active incident. Revoking the compromised OAuth token and terminating active identity sessions immediately severs the attacker's access to the cloud environment, preventing further data exfiltration as prescribed in the containment phase of standard incident response frameworks.

Step-by-Step Solution

Analyze the active threat vector described in the scenario

Identified that an attacker is actively using a stolen OAuth token to exfiltrate cloud database backups.

Understanding the current phase of the breach determines which lifecycle stage must be prioritized.

Determine the required phase of the Incident Response lifecycle

The immediate priority is Containment to prevent further unauthorized exfiltration.

Per NIST SP 800-61 frameworks, active threats must be contained before attempting eradication or post-incident activities.

Select the action that immediately stops the active threat mechanism

Revoking the OAuth token and invalidating active sessions stops the unauthorized API access instantly.

Token revocation cuts off the attacker's active access window without waiting for longer host-remediation workflows.

Key Concept

Incident Response Containment Phase Actions

Estimated Time:1m 30s

Question 488Question →

A security operations team is reviewing identity and access management controls after an internal audit revealed two major vulnerabilities: third-party contractor sessions remain active for 24 hours without re-validation, and administrative users are executing high-risk privilege escalations from non-standard locations without step-up authentication. Which of the following IAM operational solutions should the security team implement to remediate these specific findings? (Select TWO.)

Select all that apply

Implement Conditional Access policies with Continuous Access Evaluation (CAE) to re-evaluate session risk and enforce real-time revocation.

Deploy a Privileged Access Management (PAM) solution enforcing Just-in-Time (JIT) access elevation and time-bound session limits for administrative functions.

Configure an internal IP address allowlist on the network perimeter firewall to grant trusted SSO access to all internal network segments.

Replace the identity provider authentication mechanism with a local authorization database on each target server.

Show answer & explanation

Answer: Implement Conditional Access policies with Continuous Access Evaluation (CAE) to re-evaluate session risk and enforce real-time revocation.; Deploy a Privileged Access Management (PAM) solution enforcing Just-in-Time (JIT) access elevation and time-bound session limits for administrative functions.

Answer

The security team should implement Conditional Access policies with Continuous Access Evaluation (CAE) and deploy a Privileged Access Management (PAM) solution enforcing Just-in-Time (JIT) access.

Implementing Conditional Access with Continuous Access Evaluation (CAE) directly addresses long-lived session risks by continuously evaluating context (such as location and device compliance) during active sessions. Deploying Privileged Access Management (PAM) with Just-in-Time (JIT) access restricts standing administrative privileges by granting temporary, elevated permissions only when needed.

Step-by-Step Solution

Analyze the identified vulnerability regarding long-lived active sessions across third-party contractor accounts.

Identify that traditional static token expiration times fail to account for mid-session risk changes.

Conditional Access combined with Continuous Access Evaluation (CAE) allows the Identity Provider (IdP) to revoke access immediately upon risk triggers like location changes or credential termination.

Analyze the vulnerability regarding unmonitored privilege escalation from non-standard locations.

Identify that administrative privileges should not remain assigned persistently to user accounts.

Privileged Access Management (PAM) implementing Just-in-Time (JIT) access ensures credentials are elevated only upon approval for a limited operational window, requiring MFA or step-up verification.

Key Concept

Operational IAM lifecycle controls including Conditional Access, Continuous Access Evaluation, and Privileged Access Management (PAM) JIT access.

Question 489Question →

During a routine vulnerability assessment, a security analyst reviews scan results targeting an internal web server farm behind a reverse proxy. The report highlights several high-severity remote code execution vulnerabilities based on outdated software version headers. However, an authenticated system audit confirms that security patches were fully applied and the underlying software was patched out-of-band without updating the exposed service header strings. Which of the following best explains why the vulnerability scanner reported these vulnerabilities?

The scanner produced false positives due to relying on non-credentialed banner grabbing rather than local inspection.

The network firewall failed to act as a compensating control to suppress the scanner payload.

The detective controls on the host misclassified administrative logins as malicious activity.

Cross-site scripting (XSS) scripts intercepted the scanner probes and altered database responses.

Show answer & explanation

Answer: The scanner produced false positives due to relying on non-credentialed banner grabbing rather than local inspection.

Answer

The vulnerability scanner generated false positives because it performed a non-credentialed scan that relied strictly on external banner grabbing, which failed to reflect internal patch state.

Non-credentialed vulnerability scans rely on remote inspection techniques such as banner grabbing. When operating system or application updates patch vulnerabilities without updating version headers, unauthenticated scanners misidentify host status and generate false positives. Performing credentialed scans resolves this by inspecting local software packages and file versions directly.

Step-by-Step Solution

Analyze the scanning method and reported indicators

The scanner flagged vulnerabilities based solely on exposed software version headers in network banners.

Unauthenticated or non-credentialed scans interact with services externally without host-level privilege.

Compare scanner findings against verified host configuration

Local host audits verified that patches were applied, meaning the software was not actually vulnerable.

Backported vendor fixes often patch underlying binaries without updating visible version strings.

Determine the scanner finding classification

The report incorrectly identified non-existent vulnerabilities, which constitutes a false positive.

Credentialed scans prevent banner-grabbing false positives by directly checking registry keys, package lists, and binary versions.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning and False Positives

Question 490Question →

A security analyst is investigating configuration compliance reports across an operational technology (OT) environment managed by an automated deployment framework. Although the centralized dashboard reports full compliance with the organization's hardened baseline template, manual vulnerability audits reveal that several controllers have unapproved network services active and customized settings configured locally. Further inspection indicates that local system administrators made manual adjustments directly on the devices, leading to configuration drift that was not detected or overridden by the centralized management tool. Which of the following actions should the security analyst perform FIRST to permanently address the configuration drift and restore baseline integrity?

Configure continuous automated enforcement and drift remediation within the centralized configuration management framework to automatically detect and overwrite unapproved local changes.

Deploy host-based firewall rules across the affected controllers to block traffic routed to the newly exposed service ports.

Reclassify the mandatory hardening benchmark as an optional administrative guideline for operational technology endpoints.

Issue an emergency out-of-band operating system patch deployment to update the firmware binaries on all OT controllers.

Show answer & explanation

Answer: Configure continuous automated enforcement and drift remediation within the centralized configuration management framework to automatically detect and overwrite unapproved local changes.

Answer

Configure continuous automated enforcement and drift remediation within the centralized configuration management framework to automatically detect and overwrite unapproved local changes.

Configuring continuous automated enforcement and drift remediation directly addresses the root cause of configuration drift. Centralized configuration management tools must actively audit state and automatically overwrite unapproved local modifications with the approved baseline, maintaining continuous compliance across infrastructure endpoints.

Step-by-Step Solution

Identify the root cause of the security failure.

The issue stems from unapproved local manual adjustments creating configuration drift that centralized auditing failed to enforce.

Understanding why the deviation occurred isolates configuration management logic from patch or network filtering issues.

Evaluate remediation controls against configuration drift governance principles.

Automated baseline enforcement guarantees that authoritative states are consistently synchronized across endpoints.

Centralized configuration management must actively enforce compliance and revert unauthorized local modifications.

Select the primary preventive and corrective action.

Enabling continuous automated enforcement remediates current drift and prevents future unapproved modifications.

This establishes continuous configuration compliance without relying on manual audits or secondary network blocks.

Key Concept

Configuration Baseline Enforcement and Drift Remediation

Question 491Question →

A Security Operations Center (SOC) analyst receives an Endpoint Detection and Response (EDR) alert indicating an unauthorized process injection attempt on a critical financial application server. What is the correct operational sequence of actions to take when responding to this incident, ordered from the initial containment step to the final system restoration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of EDR incident response actions is: 1) Initiate agent-based network isolation, 2) Terminate injected malicious processes, 3) Capture volatile process memory dumps and forensic telemetry, and 4) Execute automated EDR remediation playbooks to purge persistence mechanisms.

The standard EDR containment workflow prioritizes immediate threat isolation (isolating the endpoint from the network while maintaining agent control), followed by stopping active execution (terminating injected processes), collecting volatile forensics for investigation, and finally remediating persistence mechanisms and restoring system integrity.

Step-by-Step Solution

Network Isolation

The host is isolated from the enterprise network, restricting network traffic strictly to EDR control communications.

Immediate containment halts potential lateral movement and command-and-control (C2) communication before further escalation occurs.

Process Termination

Active malicious process execution and child processes are stopped.

Halting the injected process prevents ongoing unauthorized activity and potential local damage.

Forensic Data Collection

Volatile memory and telemetry are gathered for root-cause analysis.

Acquiring evidence from the contained host ensures indicators of compromise (IoCs) and root cause can be investigated safely.

Persistence Removal and Restoration

Malicious artifacts are removed and system integrity is confirmed.

Purging persistence artifacts prevents re-infection when the endpoint is un-isolated and restored to operational service.

Key Concept

EDR Automated Containment and Incident Response Workflow

Question 492Question →

An automated Security Orchestration, Automation, and Response (SOAR) workflow is triggered upon detecting malicious code execution on a workstation. In what order should the playbook execute the following response actions to ensure effective containment while preventing unauthorized operational disruption?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions for the SOAR playbook is: 1) Query EDR and threat intelligence APIs to enrich the alert, 2) Evaluate enriched incident data against conditional logic, 3) Issue an automated API call to isolate the workstation, 4) Submit a human-in-the-loop approval request for credential revocation, and 5) Update the ITSM ticket and close the alert.

Effective SOAR playbooks follow a structured lifecycle: enrichment, evaluation, containment, human-in-the-loop approval for high-risk actions, and final ticketing/closure. Gathering threat intelligence and endpoint details first provides the necessary telemetry. Evaluating conditional logic determines response severity. Performing automated endpoint isolation halts lateral movement immediately. Requesting analyst approval before identity credential revocation avoids unnecessary business downtime. Finally, updating and closing the ITSM ticket documents the full audit trail.

Step-by-Step Solution

Enrich alert context

Host criticality metrics and file reputation data are attached to the incident record.

SOAR workflows must gather requisite context from integrated security tools before executing decision logic.

Evaluate conditional rules

The playbook determines the containment pathway appropriate for the asset type and severity.

Contextual evaluation ensures low-risk automated actions are performed while high-impact steps are flagged for review.

Execute automated network containment

The host is isolated at the endpoint layer to prevent lateral movement.

Containment of compromised endpoints must happen immediately to halt threat spread.

Request human-in-the-loop authorization

Tier 2 analyst receives notification to review credential revocation details.

High-impact identity changes carry operational risk and require explicit human verification.

Record workflow metrics and close case

Execution logs are written to the ITSM ticketing platform and the case is closed.

Audit records and system metrics must be recorded post-remediation to finalize incident response operations.

Key Concept

SOAR Playbook Incident Response Execution Order

Question 493Question →

An internal audit of a web application server reveals the following entries within the web server access log file:

text
192.168.1.105 - - [27/Jul/2026:14:22:10 +0000] "GET /api/v1/users?id=101%20OR%201=1 HTTP/1.1" 200 4520
192.168.1.105 - - [27/Jul/2026:14:22:15 +0000] "GET /api/v1/users?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20accounts HTTP/1.1" 200 8940
192.168.1.105 - - [27/Jul/2026:14:22:18 +0000] "POST /api/v1/users?id=101%20EXEC%20xp_cmdshell('whoami') HTTP/1.1" 500 230

Based on these log entries, which of the following attack types has occurred, and what SIEM correlation logic should be deployed to detect similar future attempts?

SQL injection targeting back-end database queries, detectable by SIEM correlation rules that flag SQL syntax keywords within HTTP request parameters combined with successful HTTP 200 responses.

Cross-Site Scripting (XSS) targeting client browser contexts, detectable by SIEM correlation rules that identify client DOM modification events.

Broken authentication credential stuffing, detectable by SIEM correlation rules alerting on multiple HTTP 401 Unauthorized status responses from a single IP address.

Firewall misconfiguration permitting improper ingress traffic, detectable by SIEM correlation rules monitoring network layer control types and packet drop counts.

Show answer & explanation

Answer: SQL injection targeting back-end database queries, detectable by SIEM correlation rules that flag SQL syntax keywords within HTTP request parameters combined with successful HTTP 200 responses.

Answer

SQL injection targeting back-end database queries, detectable by SIEM correlation rules that flag SQL syntax keywords within HTTP request parameters combined with successful HTTP 200 responses.

The web log snippet contains explicit database query manipulation patterns such as `OR 1=1`, `UNION SELECT`, and `EXEC xp_cmdshell`. These signatures confirm a SQL injection (SQLi) attack. In SIEM log management, detecting this activity requires parsing URI query strings for database reserved words and correlating them with HTTP 200 OK status responses to catch successful data exfiltration.

Step-by-Step Solution

Analyze the request URI parameters in the log entries.

Identified URL-encoded SQL command structures: `%20OR%201=1` (boolean condition bypass), `%20UNION%20SELECT%20...` (data extraction), and `EXEC xp_cmdshell` (database system procedure invocation).

Log analysis requires inspecting raw string inputs to categorize attack signatures.

Differentiate the attack vector from other web vulnerabilities.

Confirmed the attack targets the back-end relational database (SQLi) rather than executing script code in a browser (XSS) or brute-forcing login endpoints (credential stuffing).

Proper threat classification ensures appropriate mitigation and correlation rules are implemented.

Formulate the SIEM correlation rule logic.

Combine HTTP request field parsing (looking for SQL keywords like `UNION`, `SELECT`, `EXEC`) with HTTP status code matching (`200 OK` indicating successful query execution and data return).

Effective SIEM rules correlate pattern indicators with response outcomes to minimize false positives.

Key Concept

SQL Injection Log Identification & SIEM Rule Logic

Question 494Question →

A security analyst is evaluating correlated SIEM telemetry generated by network security monitoring sensors for host 172.16.10.45:

NIDS Alert:
[ALERT] [1:1002941:2] WEB-ATTACK HTTP POST /api/v1/user?input=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1

Based on the network security monitoring telemetry provided, which of the following conclusions are accurate? (Select TWO).

Select all that apply

The NIDS alert indicates a Cross-Site Scripting (XSS) payload attempt targeting the Web API rather than a SQL injection attack.

The NetFlow telemetry pattern indicates potential Command and Control (C2) beaconing or DNS tunneling activity.

The NIDS alert identifies an active database exfiltration attempt utilizing SQL injection commands.

The recurring NetFlow UDP port 53 traffic represents a production honeypot configured to automatically inline-block perimeter traffic.

Show answer & explanation

Answer: The NIDS alert indicates a Cross-Site Scripting (XSS) payload attempt targeting the Web API rather than a SQL injection attack.; The NetFlow telemetry pattern indicates potential Command and Control (C2) beaconing or DNS tunneling activity.

Answer

The correct conclusions are that the NIDS alert indicates a Cross-Site Scripting (XSS) payload attempt targeting the Web API rather than a SQL injection attack, and the NetFlow telemetry pattern indicates potential Command and Control (C2) beaconing or DNS tunneling activity.

The NIDS payload decodes to standard JavaScript script execution (`<script>alert(1)</script>`), identifying it as an XSS attack vector. Meanwhile, the NetFlow record shows automated, fixed-interval outbound traffic over UDP port 53 (DNS) to an external host, which is a key indicator of compromise (IoC) for C2 beaconing or DNS covert channel tunneling.

Step-by-Step Solution

Analyze the NIDS alert HTTP POST request payload.

The URL parameter `input=%3Cscript%3Ealert%281%29%3C%2Fscript%3E` represents URL-encoded HTML/JavaScript `<script>alert(1)</script>`, confirming a Cross-Site Scripting (XSS) probe.

Differentiating client-side script injection (XSS) from server-side database commands (SQLi) is essential for accurate alert diagnosis.

Analyze the NetFlow telemetry log for connection patterns.

The log displays consistent outbound UDP port 53 traffic occurring at precise 30-second intervals with uniform low byte sizes to external IP 198.51.100.55.

Periodic small-byte traffic to external DNS servers indicates automated C2 beaconing or DNS tunneling network behavior.

Key Concept

Network Security Monitoring Log Analysis and Threat Identification

Estimated Time:2m 0s

Question 495Question →

A Security Operations Center (SOC) analyst receives an automated SIEM alert indicating high-priority authentication anomalies on a critical domain server. The analyst extracts the following log entries from the SIEM console:

text
2026-07-27T14:02:11Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:13Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:15Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:18Z Hostname: SEC-DC01 EventID: 4624 LogonType: 10 User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:19Z Hostname: SEC-DC01 EventID: 4672 User: admin_jdoe Privileges: SeDebugPrivilege

Based on these correlated log entries, which of the following security events has occurred?

A successful password guessing attempt resulting in an interactive Remote Desktop session with administrative privileges assigned.

An authorization control failure where an authenticated low-privilege user was denied permission to execute a system process.

A SQL injection attack targeting the domain controller database engine to bypass application authentication.

A network-level denial of service attack flooding port 3389 to exhaust connection pools on the domain controller.

Show answer & explanation

Answer: A successful password guessing attempt resulting in an interactive Remote Desktop session with administrative privileges assigned.

Answer

The log sequence represents a successful password guessing attempt resulting in an interactive Remote Desktop session with administrative privileges assigned.

The correct answer accurately interprets the chronological sequence of Windows Security Event IDs: multiple Event 4625 logs represent failed authentication attempts (brute force), immediately followed by Event 4624 with LogonType 10 indicating a successful Remote Desktop (RDP) session, and Event 4672 confirming administrative privilege elevation.

Step-by-Step Solution

Analyze initial failed authentication logs.

Multiple Windows Event ID 4625 entries occur in rapid succession from IP 192.168.10.45 for user admin_jdoe, indicating repeated failed logon attempts (credential guessing/brute force).

Event ID 4625 explicitly logs failed logon attempts in Windows Event Logs.

Analyze the subsequent successful logon entry.

Event ID 4624 indicates a successful logon. LogonType 10 specifies Remote Desktop (RDP) interactive network access from the same source IP.

LogonType 10 differentiates Remote Desktop logins from local interactive (LogonType 2) or network share (LogonType 3) logons.

Correlate privilege assignment.

Event ID 4672 immediately follows, logging special privileges assigned to the new user session (such as SeDebugPrivilege).

Event ID 4672 confirms the session has superuser or administrative control over the system.

Key Concept

Windows Security Event Correlation in SIEM (Event IDs 4625, 4624, and 4672)

Estimated Time:1m 30s

Question 496Question →

After detecting an active fileless malware infection executing via host memory scripts on a critical workstation, the Incident Response (IR) team initiates their initial handling playbook. Which of the following actions should the team perform immediately to contain the threat while preserving digital evidence? (Select TWO.)

Select all that apply

Disconnect the workstation from the local network via physical cable removal or port isolation while keeping system power on.

Acquire a full forensic capture of the host system's volatile memory (RAM) prior to any system shutdown or state modification.

Immediately reboot the host workstation into safe mode to stop active malicious process execution.

Re-image the workstation operating system using an enterprise golden master image.

Show answer & explanation

Answer: Disconnect the workstation from the local network via physical cable removal or port isolation while keeping system power on.; Acquire a full forensic capture of the host system's volatile memory (RAM) prior to any system shutdown or state modification.

Answer

The incident response team should isolate the host from the network while maintaining system power, and capture a full dump of volatile system memory (RAM).

Effective incident response playbooks mandate network isolation to stop threat expansion while keeping the machine powered on, followed by acquiring volatile RAM to capture memory-resident fileless payloads according to the order of volatility.

Step-by-Step Solution

Evaluate containment priorities during an active fileless malware incident.

Identify that network containment is essential to stop lateral movement and Command & Control (C2) communication without powering off the host.

Maintaining system power prevents volatile memory loss.

Apply forensic evidence preservation principles according to the order of volatility.

Prioritize capturing volatile system RAM before performing host changes, reboots, or drive imaging.

Fileless malware resides exclusively in memory and is wiped if the system reboots.

Distinguish containment phase steps from eradication and recovery actions.

Reject premature re-imaging or host wiping actions.

Re-imaging occurs in the eradication phase after evidence collection and root cause analysis are finished.

Key Concept

Incident Response Containment and Order of Volatility in Evidence Preservation

Estimated Time:1m 30s

Question 497Question →

An organization has expanded its remote workforce, resulting in laptops connecting to the enterprise network via VPN at unpredictable times. The security operations team observes that scheduled centralized network vulnerability scans routinely miss these endpoints because they are disconnected or powered off during scan execution windows. Which of the following scanning solutions best enables the security team to maintain continuous vulnerability visibility for these roaming endpoints?

Deploy host-based vulnerability scanning agents to locally assess system configurations and transmit results when connectivity is established.

Configure network firewall rules to block network access for any endpoint that has not completed a centralized network scan within 30 days.

Increase the frequency and concurrent thread density of active network vulnerability scans across the VPN subnet range.

Implement web application vulnerability scanning on corporate remote access portals to inspect incoming session payloads.

Show answer & explanation

Answer: Deploy host-based vulnerability scanning agents to locally assess system configurations and transmit results when connectivity is established.

Answer

Deploying host-based vulnerability scanning agents to locally assess system configurations and transmit results when connectivity is established.

Deploying host-based vulnerability scanning agents directly onto endpoints allows vulnerability data to be collected locally regardless of whether the machine is connected to the corporate network. When the roaming device connects to the internet or VPN, the lightweight agent securely transmits its local scan results back to the central management console, eliminating blind spots caused by rigid network scan windows.

Step-by-Step Solution

Analyze the operational constraints of the remote endpoint environment.

Identified that endpoints are frequently offline or off-network during scheduled centralized network scan windows, causing missing assessment data.

Centralized network scanners require active network reachability and host uptime during the scan execution window.

Evaluate vulnerability assessment methodologies suited for transient/roaming hosts.

Host-based agents execute assessments locally on the endpoint OS using local resources and cache scan reports until network connectivity is restored.

Agent-based scanning decouples vulnerability assessment timing from network availability.

Select the optimal solution that resolves the visibility gap without impacting operational workflows.

Deploying agent-based software ensures consistent, up-to-date vulnerability tracking across roaming laptops.

Host agents provide continuous visibility regardless of endpoint location or VPN connection schedules.

Key Concept

Agent-Based vs. Network-Based Vulnerability Scanning

Estimated Time:1m 30s

Question 498Question →

During an enterprise Security Operations Center (SOC) investigation, telemetry from various log sources is ingested into a SIEM platform. Match each log snippet on the left with the corresponding event description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings are: HTTP GET log with SQL payload matches the web application SQL injection description; Windows Event ID 4625 matches the failed network logon event; Firewall DROP entry targeting port 445 matches the blocked SMB traffic event; Linux SYSCALL audit log execve matching nc binary matches the executed netcat process description.

Each log entry contains distinctive indicators characteristic of its log source and activity type: HTTP GET request with SQL syntax indicates SQL injection; Windows Event ID 4625 indicates a failed logon; Syslog kernel DROP output targeting port 445 indicates blocked SMB traffic; and Linux auditd syscall 59 referencing /usr/bin/nc indicates netcat process execution.

Step-by-Step Solution

Analyze the web server access log snippet.

Identify HTTP GET method containing SQL logic syntax (admin' OR '1'='1), confirming a web application SQL injection attempt.

Log syntax matches standard Nginx/Apache log formatting with embedded web exploit strings.

Analyze the Windows Event log snippet.

Identify Event ID 4625 and Logon Type 3, pointing to an unsuccessful network authentication attempt.

Event ID 4625 standardly logs logon failures in Windows Security Event logs.

Analyze the firewall syslog snippet.

Identify action DROP and destination port 445 (DPT=445), denoting blocked SMB protocol traffic.

Firewall syslog outputs typically format dropped network traffic with directional IP/port flags.

Analyze the Linux auditd snippet.

Identify syscall=59 (execve) along with exe="/usr/bin/nc", pointing to process execution of the Netcat networking tool.

Linux audit daemon logs system calls related to process creation and command execution.

Key Concept

Log Identification and SIEM Telemetry Archetypes

Question 499Question →

A security analyst is examining the following aggregated syslog entries ingested into a SIEM platform:

text
Jul 27 11:02:14 jump-srv01 sshd[14201]: Failed password for invalid user admin from 203.0.113.88 port 49152 ssh2
Jul 27 11:02:16 jump-srv01 sshd[14205]: Failed password for invalid user root from 203.0.113.88 port 49154 ssh2
Jul 27 11:02:19 jump-srv01 sshd[14210]: Accepted password for deployer from 203.0.113.88 port 49158 ssh2
Jul 27 11:02:22 jump-srv01 sudo: deployer : TTY=pts/1 ; PWD=/home/deployer ; USER=root ; COMMAND=/bin/bash

Based on the correlated log sequence above, which of the following conclusions accurately describes the security event?

An external IP address successfully authenticated using valid credentials for an existing account after failed login attempts, followed by root privilege escalation.

The SSH daemon successfully prevented unauthorized access by rejecting authentication requests for invalid administrative user accounts.

An authorization failure occurred when the remote host failed to present valid identity credentials during the initial connection requests.

A detective security control failed to operate because the firewall did not implement preventive blocking for incoming remote connections.

Show answer & explanation

Answer: An external IP address successfully authenticated using valid credentials for an existing account after failed login attempts, followed by root privilege escalation.

Answer

An external IP address successfully authenticated using valid credentials for an existing account after failed login attempts, followed by root privilege escalation.

The log sequence demonstrates an attack timeline: initial failed authentication attempts for common administrative accounts ('admin', 'root') from IP 203.0.113.88, followed three seconds later by a successful SSH authentication for user 'deployer' from the same IP, and finally a `sudo` command execution spawning an interactive root shell (`/bin/bash`).

Step-by-Step Solution

Analyze initial log timestamps and event sources

Identified rapid, sequential SSH authentication failures from IP 203.0.113.88 targeting invalid usernames ('admin' and 'root').

Establishes baseline pattern of credential testing or automated brute-force activity.

Evaluate subsequent authentication logs

At 11:02:19, SSH accepted the password for the valid account 'deployer' from the same external IP address.

Confirms successful compromise of legitimate user account credentials.

Analyze post-authentication command execution telemetry

At 11:02:22, the 'deployer' user executed `sudo` to spawn `/bin/bash` as `root`.

Confirms successful local privilege escalation to root permissions immediately following remote access.

Key Concept

Sequential Log Correlation and Event Reconstruction

Question 500Question →

During a scheduled vulnerability assessment of an industrial processing facility, an active intrusive network scan caused several sensitive Programmable Logic Controllers (PLCs) on the Operational Technology (OT) network to crash. The security administrator needs to gather vulnerability data for these legacy devices without risking system instability or operational downtime. Which of the following scanning methodologies should the administrator implement?

Perform a non-intrusive, passive vulnerability assessment by monitoring network traffic via a SPAN port.

Deploy network-level firewall drop rules to filter active scan traffic while running intrusive exploits.

Execute a credentialed web application assessment focused on identifying client-side Cross-Site Scripting (XSS) vulnerabilities.

Reclassify the vulnerability scanner as a detective security control so it automatically blocks active probes from hitting the devices.

Show answer & explanation

Answer: Perform a non-intrusive, passive vulnerability assessment by monitoring network traffic via a SPAN port.

Answer

Perform a non-intrusive, passive vulnerability assessment by monitoring network traffic via a SPAN port.

Passive non-intrusive vulnerability scanning inspects mirrored network traffic without sending active request packets to target systems. This technique is ideal for sensitive or legacy Operational Technology (OT) networks and embedded systems, as it prevents system crashes while still providing visibility into active protocols and potential software vulnerabilities.

Step-by-Step Solution

Identify the environment constraints.

The target environment contains fragile legacy OT/PLC devices that crash when subjected to active intrusive network probes.

Active scanning can overload limited network stacks on embedded devices.

Evaluate safe vulnerability scanning methodologies.

Passive scanning captures and analyzes existing traffic (e.g., via a mirrored SPAN port) to identify host types, open ports, and potential vulnerabilities without transmitting packets to the target systems.

Passive assessment eliminates the risk of disrupting sensitive industrial control processes.

Key Concept

Passive vs. Active and Intrusive Vulnerability Scanning

PreviousPage 25 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept