Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

During a vulnerability assessment of an enterprise infrastructure, a scanner flags a critical unpatched remote code execution vulnerability on a core database server. The system administrator requests to mark the finding as risk-accepted without patching, citing that an inline Network Intrusion Prevention System (NIPS) is active on the network segment. Which of the following best describes the primary operational risk of relying on this compensating control instead of applying the vendor patch?

Attackers who gain access to the internal network can potentially bypass the intrusion prevention system using encrypted channels or lateral movement, leaving the unpatched flaw exposed.

Network-level inline inspection acts as a permanent corrective control that automatically remediates the underlying application source code error.

Applying network filtering rules alters the software's attack surface such that future authenticated vulnerability scans will fail to execute.

Inline network inspection devices automatically reclassify server-side execution vulnerabilities as client-side script execution flaws.

Show answer & explanation

Answer: Attackers who gain access to the internal network can potentially bypass the intrusion prevention system using encrypted channels or lateral movement, leaving the unpatched flaw exposed.

Answer

Attackers who gain access to the internal network can potentially bypass the intrusion prevention system using encrypted channels or lateral movement, leaving the unpatched flaw exposed.

Relying on a Network Intrusion Prevention System (NIPS) as a compensating control reduces exposure but does not remediate the vulnerability. If threat actors establish a presence within the network or encrypt their exploit payloads, the NIPS may fail to block the attack, allowing the unpatched server to be compromised.

Step-by-Step Solution

Analyze the proposed risk response

The administrator proposes using an inline NIPS as a compensating control instead of remediating the software vulnerability with a vendor patch.

Compensating controls provide temporary risk reduction but do not address the root cause of a vulnerability.

Evaluate the limitations of network compensating controls

NIPS devices inspect traffic based on signatures and plain-text patterns; they can be bypassed via encryption, novel evasion techniques, or local attack vectors inside the network boundary.

Vulnerabilities remain active on the host as long as the underlying software code remains unpatched.

Determine the primary operational risk

Relying solely on NIPS leaves the host exposed if an attacker achieves internal position or uses encrypted channels to bypass network inspection.

Effective vulnerability management prioritizes patching root-cause flaws over relying exclusively on perimeter or inline filtering.

Key Concept

Vulnerability Remediation vs. Compensating Controls

Estimated Time:1m 30s

Question 622Question →

An enterprise security analyst is configuring an automated vulnerability scanner to conduct routine compliance assessments across internal production database servers. To ensure accurate vulnerability identification while preventing system downtime or account lockouts, which of the following configuration options should the analyst implement? (Select TWO.)

Select all that apply

Provide read-only service account credentials to allow host-based local package and configuration inspection.

Configure rate throttling and non-intrusive scan settings to limit concurrent query loads on target systems.

Enable active exploitation modules to automatically verify if identified vulnerabilities can be successfully compromised.

Set network firewalls to automatically trigger corrective blocking rules whenever scanner probes match SQL injection signatures.

Show answer & explanation

Answer: Provide read-only service account credentials to allow host-based local package and configuration inspection.; Configure rate throttling and non-intrusive scan settings to limit concurrent query loads on target systems.

Answer

The analyst should provide read-only service account credentials for host-based package inspection and configure rate throttling with non-intrusive scan settings to protect target systems.

Credentialed (authenticated) scanning gives the scanner low-privilege access to target OS and software inventories, producing accurate vulnerability reports without generating high risk. Simultaneously, employing rate throttling and non-intrusive scan modules ensures that production services remain stable and operational throughout the assessment window.

Step-by-Step Solution

Determine the optimal scan authorization mode for accurate results.

Using low-privilege audit credentials allows safe internal package and configuration audits without relying on risky or inaccurate external network banner guessing.

Credentialed scanning dramatically reduces false positives and provides deeper visibility into system patch levels.

Establish scan performance and safety controls.

Enabling non-intrusive checks and throttling request rates prevents resource exhaustion on delicate production databases.

Vulnerability assessments in production environments must minimize operational impact.

Key Concept

Vulnerability Scanning Methods and Configuration Controls

Estimated Time:1m 30s

Question 623Question →

An organization's security operations center observes that newly provisioned virtual servers in a public cloud environment consistently lack mandatory security monitoring agents and feature non-standard firewall configurations. An investigation reveals that system administrators are manually launching instances from legacy local image templates instead of using approved central images. Which of the following operational practices should the organization implement to MOST effectively prevent future configuration drift?

Applying host-based firewall rules to restrict remote management access to the virtual servers

Enforcing automated deployment pipelines that instantiate virtual machines exclusively from version-controlled Infrastructure as Code (IaC) baseline templates

Scheduling monthly manual compliance reviews to identify and remediate baseline deviations across virtual instances

Isolating the cloud management console using dedicated virtual private network (VPN) tunnels

Show answer & explanation

Answer: Enforcing automated deployment pipelines that instantiate virtual machines exclusively from version-controlled Infrastructure as Code (IaC) baseline templates

Answer

Enforcing automated deployment pipelines that instantiate virtual machines exclusively from version-controlled Infrastructure as Code (IaC) baseline templates

Automating virtual machine provisioning through version-controlled Infrastructure as Code (IaC) templates ensures that all new cloud instances adhere to predefined, tested security baselines and automatically include required monitoring agents upon deployment.

Step-by-Step Solution

Analyze the root cause of the configuration drift identified in the scenario.

The root cause is manual provisioning from unapproved, legacy templates.

Manual processes allow administrators to bypass baseline configurations and deploy non-compliant virtual machines.

Evaluate potential solutions against the goal of preventing future drift.

Automated provisioning using Infrastructure as Code (IaC) eliminates manual template selection and enforces baseline compliance across all builds.

IaC defines target state configurations as code, ensuring consistent, repeatable deployments containing all required agents and security settings.

Key Concept

Patch and Configuration Management

Question 624Question →

A Security Operations Center (SOC) analyst is reviewing network security monitoring alerts generated by a Network Traffic Analysis (NTA) sensor inspecting perimeter egress traffic. The sensor triggers a high-severity alert for an outbound TCP session originating from an internal host ( $10.2.14.50$ ) to an external server ( $198.51.100.89$ ):

src_ip: 10.2.14.50
src_port: 51024
dest_ip: 198.51.100.89
dest_port: 443
transport: tcp
detected_protocol: ssh
expected_protocol: tls
alert_type: Protocol Mismatch / Evasion

Based on the log snippet provided, which of the following is the most accurate interpretation of this network security monitoring alert?

An internal host is attempting to bypass perimeter egress filtering by tunneling SSH traffic over standard HTTPS port 443.

A remote attacker is executing a SQL injection attack against an internal database server by encapsulating SQL commands in TLS payloads.

The perimeter network monitoring sensor functioned as a preventive control by dropping packets associated with an unverified TLS certificate.

A production honeypot triggered an alert after capturing an inbound unauthorized connection attempt on a deceptive service listener.

Show answer & explanation

Answer: An internal host is attempting to bypass perimeter egress filtering by tunneling SSH traffic over standard HTTPS port 443.

Answer

The alert indicates an internal host attempting to bypass perimeter egress filtering by tunneling SSH traffic over standard HTTPS port 443.

The NTA sensor alert highlights a protocol mismatch where an outbound session on TCP port 443 (typically allocated for HTTPS/TLS) contains SSH protocol signatures. Adversaries and users frequently attempt to evade perimeter security controls and firewall restrictions by encapsulating unauthorized protocols (such as SSH) over common outbound ports like 443.

Step-by-Step Solution

Analyze the source, destination, and port details in the alert log.

The source is internal host

10.2.14.50

sending traffic outbound to external IP

198.51.100.89

on destination port 443.

Establishing traffic flow direction confirms this is an outbound egress event.

Compare expected_protocol with detected_protocol.

Destination port 443 normally carries TLS/SSL traffic, but deep packet inspection detected SSH protocol banners/payloads.

Mismatched protocol and port signatures reveal an evasion technique intended to conceal non-HTTPS traffic inside a standard allowed egress port.

Determine the security significance of the protocol anomaly.

Adversaries or policy-violating users often run SSH servers on port 443 to tunnel restricted protocols out of a network.

Identifying protocol tunneling over non-standard ports enables analysts to investigate potential command-and-control (C2) or data exfiltration channels.

Key Concept

Network Security Monitoring and Protocol Anomaly Detection

Estimated Time:1m 30s

Question 625Question →

A network security analyst receives a high-severity alert from a Network Traffic Analysis (NTA) system regarding anomalous outbound encrypted communications originating from an internal workstation. Place the following incident triage and response steps in the correct sequential order from initial alert verification to containment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for triaging the network monitoring alert is: 1) Examine NetFlow data to confirm baseline deviation; 2) Inspect packet capture (PCAP) data to extract protocol metadata and destination IPs; 3) Query threat intelligence databases using extracted IP addresses to verify malicious activity; 4) Update firewall egress rules and place the host into a quarantine VLAN.

The standard security monitoring workflow dictates starting with broad alert validation (NetFlow baseline analysis), progressing to specific artifact extraction (PCAP inspection), contextualizing artifacts (threat intelligence correlation), and concluding with active mitigation (firewall blocking and VLAN quarantine).

Step-by-Step Solution

Verify initial alert validity using flow logs.

Confirmed baseline anomaly in traffic volume and session length.

Ensures the event is a true positive before dedicating technical resources to forensic capture analysis.

Perform full packet analysis on the flagged network stream.

Extracted destination IPs, port numbers, and TLS metadata artifacts.

Retrieves essential technical indicators required for threat identification.

Correlate collected indicators with reputational threat intelligence.

Confirmed destination IP belongs to known adversary Command and Control infrastructure.

Establishes threat severity and confirms the need for isolation controls.

Execute containment and isolation policies.

Blocked outbound connection attempts and isolated host from the internal network.

Prevents potential data exfiltration and halts lateral network movement.

Key Concept

Network Security Incident Triage and Response Workflow

Question 626Question →

A security analyst reviewing Network Intrusion Detection System (NIDS) alerts for an enterprise web server identifies multiple HTTP POST requests containing payload strings such as `<script>document.cookie</script>` submitted through an unauthenticated feedback form. Which of the following correctly identifies the type of attack detected by network monitoring?

Cross-Site Scripting (XSS), which attempts to execute malicious scripts in a client's web browser session

SQL Injection (SQLi), which attempts to manipulate backend database queries through unvalidated form inputs

Buffer Overflow, which attempts to overwrite system memory registers on the web server host

Honeypot redirection, which automatically filters and traps malicious web traffic into an inline isolation sandbox

Show answer & explanation

Answer: Cross-Site Scripting (XSS), which attempts to execute malicious scripts in a client's web browser session

Answer

Cross-Site Scripting (XSS), which attempts to execute malicious scripts in a client's web browser session

The alert payload contains `<script>` tags and JavaScript properties (`document.cookie`), which are classic indicators of a Cross-Site Scripting (XSS) attack. XSS targets client browsers that render untrusted user input without sanitization.

Step-by-Step Solution

Analyze the log payload in the NIDS alert

Identified HTML/JavaScript tags `<script>document.cookie</script>` in HTTP POST request parameters

Determining the target execution environment (client-side browser vs backend database or operating system) is essential for accurate alert triage

Classify the attack vector based on payload syntax

Script tag insertion targeting session cookies indicates a Cross-Site Scripting (XSS) attempt

XSS vulnerabilities allow attackers to inject client-side scripts to compromise user sessions when rendered by the web browser

Key Concept

Identifying web application attack signatures in Network Security Monitoring (NSM) alerts

Question 627Question →

A Security Operations Center (SOC) analyst reviewing network security monitoring (NSM) alerts identifies sustained IP protocol 47 (Generic Routing Encapsulation - GRE) traffic originating from an internal DMZ web server toward an unknown external IP address. NetFlow records confirm a high volume of asymmetric outbound data transfer. Which TWO of the following actions should the analyst take to address this network security incident?

Select all that apply

Isolate the compromised host from the network segment to halt active data exfiltration.

Configure perimeter egress firewall rules to block unauthorized GRE traffic from leaving the network.

Modify the web application code to enforce parameterized database queries.

Reconfigure an internal honeypot sensor to inline mode to drop unauthorized packets.

Show answer & explanation

Answer: Isolate the compromised host from the network segment to halt active data exfiltration.; Configure perimeter egress firewall rules to block unauthorized GRE traffic from leaving the network.

Answer

The analyst should isolate the compromised host from the network segment and configure perimeter egress firewall rules to block unauthorized GRE traffic.

Isolating the compromised server stops immediate outbound tunneling, while updating egress firewall rules prevents unauthorized GRE protocol traffic from crossing the enterprise boundary.

Step-by-Step Solution

Identify the network anomaly and attack vector from the NSM alert.

Unapproved IP protocol 47 (GRE) tunneling indicates network layer encapsulation and unauthorized data exfiltration.

Recognizing GRE misuse helps pinpoint containment actions at both host and network perimeter levels.

Apply host-level containment.

Network isolation of the DMZ web server stops immediate communication with the external endpoint.

Host isolation prevents lateral movement and halts outgoing exfiltration channels.

Enforce network-level egress filtering.

Perimeter firewall rules blocking unapproved GRE traffic stop similar covert tunneling attempts enterprise-wide.

Egress filtering ensures defense-in-depth across the network boundary.

Key Concept

Network Traffic Anomaly Detection and Egress Containment

Estimated Time:1m 30s

PreviousPage 32 / 32

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes