Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 61Question →

An enterprise Security Operations Center (SOC) team is configuring an automated playbook within their Endpoint Detection and Response (EDR) solution to respond to an active ransomware outbreak involving credential dumping and process injection. Place the incident response steps in the correct operational order from initial containment through complete host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper operational sequence begins with network isolation via the EDR agent, followed by volatile memory collection, process tree termination and token revocation, enterprise-wide IOC block rule propagation, and finally system integrity remediation prior to network restoration.
The correct sequence prioritizes halting threat spread first through EDR agent network isolation, preserving perishable volatile memory next before process termination, killing active malicious code execution third, deploying global block rules to protect other network assets fourth, and finally cleaning host artifacts before restoring network connectivity.

Step-by-Step Solution

1
Isolate the endpoint network connection via EDR software filters.
Halts lateral spread and data exfiltration instantly while keeping EDR communication open.
Immediate containment is mandatory prior to evidence collection or termination.
2
Acquire volatile memory image (RAM capture).
Preserves volatile injected DLLs, unwritten encryption keys, and active process handles.
Terminating malicious processes prior to memory capture permanently destroys critical forensic artifacts.
3
Kill malicious process tree and revoke associated session credentials.
Stops threat execution on the endpoint.
Active threat execution must be halted once volatile forensic data is secured.
4
Propagate newly identified file hashes and network indicators to the global EDR tenant block list.
Protects all uncompromised endpoints across the organization.
Global containment prevents lateral reinfection across non-isolated endpoints.
5
Remediate modified system binaries, verify baseline integrity, and remove host network isolation.
Returns the endpoint safely to normal operational status.
Host un-isolation should only occur after complete cleanup and integrity verification.

Key Concept

EDR Incident Response Playbook Sequencing
Question 62Question →

An enterprise Endpoint Detection and Response (EDR) system alerts a security analyst to an active malicious code injection on a user workstation. Sequence the standard EDR response steps from initial detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with initial behavioral detection and alerting, followed by immediate endpoint network isolation, process termination and forensic telemetry collection, and concludes with host restoration.
The proper incident response workflow following an EDR alert begins with detection, moves immediately to containment (host network isolation), proceeds to eradication and evidence capture (terminating processes and dumping memory), and finishes with recovery (restoring endpoint network access).

Step-by-Step Solution

1
Identify initial threat detection
The EDR agent flags anomalous activity and alerts analysts.
Incident response workflows begin with detection and triage.
2
Contain the threat
Network isolation is applied to the workstation via EDR.
Immediate containment prevents lateral spread while maintaining management connectivity.
3
Eradicate and analyze
Malicious processes are killed and process/memory telemetry is gathered.
Stopping threat activity and capturing volatile evidence enables root cause analysis without losing host context.
4
Restore host operations
The endpoint is verified secure and un-isolated.
Host network access is restored only after containment, investigation, and cleanup are complete.

Key Concept

EDR Incident Containment and Response Sequence
Question 63Question →

A system administrator notifies the incident response team after discovering that a critical internal database server containing confidential customer records is actively opening outbound connections to an unknown remote IP address. Endpoint monitoring confirms an unauthorized background process executing with administrative privileges and sending encrypted data packages outside the enterprise network boundary. According to standard incident response frameworks, which of the following actions should the team take FIRST?

Show answer & explanation

Answer: Isolate the affected database server from the network segment to halt active data exfiltration.

Answer

Isolate the affected database server from the network segment to halt active data exfiltration.
According to the NIST SP 800-61 Incident Response framework, once an incident involves active data exfiltration or command-and-control activity, the immediate next phase is Containment. Isolating the server from the network stops active data exfiltration while preserving system state and volatile RAM for digital forensic analysis.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle based on the scenario.
The incident is actively occurring with ongoing data exfiltration detected.
Determining the phase ensures appropriate incident response playbook procedures are followed.
2
Select the immediate response priority following Detection and Analysis.
Containment must be executed prior to eradication or recovery.
The primary objective during active exfiltration is to minimize damage and prevent further unauthorized data transfer.
3
Determine the containment action that halts network communication without destroying volatile forensic evidence.
Network isolation detaches the compromised host from the network while preserving RAM and system logs.
Disconnecting or isolating network access stops malicious C2/exfiltration traffic while keeping volatile evidence intact for investigators.

Key Concept

Incident Response Containment Phase
Estimated Time:1m 30s
Question 64Question →

A Incident Response Team is responding to an ongoing breach where an adversary compromised an automated CI/CD pipeline build runner service account. The attacker injected malicious code into build scripts and is actively exfiltrating deployment credentials over an encrypted tunnel. Playbook analysis indicates the attack payload includes an automated anti-forensic wiper script that triggers upon service account termination or system reboot. Which TWO of the following immediate actions should the incident response handler perform to isolate the threat and preserve volatile evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply a hypervisor-level network isolation filter to block network traffic from the build runner host while keeping the virtual machine powered on.; Perform a volatile memory (RAM) capture of the compromised build runner system prior to terminating active sessions or credentials.

Answer

The incident response handlers should isolate the host at the hypervisor network boundary to cut off adversary connectivity without disturbing the operating environment, and take a full volatile RAM capture to preserve running processes and decryption keys before taking destructive actions.
Correct containment and evidence preservation strategy requires isolating the system from the network without altering volatile system state or powering off the machine. Hypervisor-level network isolation prevents command-and-control communication and data exfiltration while keeping the host active. Capturing volatile memory (RAM) prior to taking destructive actions ensures evidence integrity according to the RFC 3227 order of volatility.

Step-by-Step Solution

1
Assess incident risks and order of volatility preservation constraints.
Identified that rebooting or revoking credentials immediately will trigger anti-forensic wiping scripts and destroy RAM contents.
NIST SP 800-61 Rev. 2 guidelines mandate preserving volatile evidence and preventing active exfiltration before initiating intrusive eradication tasks.
2
Execute non-disruptive network containment.
Network communication between the CI/CD runner host and external networks is restricted at the hypervisor layer.
Hypervisor network isolation halts C2 and data exfiltration while avoiding OS-level signal triggers that could detonate destructive payloads.
3
Capture volatile RAM.
System memory image acquired and cryptographically hashed for forensic integrity.
Preserves memory-resident payloads, active network sockets, and temporary credentials prior to credential revocation or host destruction.

Key Concept

Incident Containment Strategy and Order of Volatility Preservation
Question 65Question →

A security engineer at a utility organization oversees a fleet of distributed industrial edge gateways. Following a vendor firmware patch rollout, a security audit reveals that multiple gateways experienced configuration drift, automatically re-enabling legacy, unencrypted management protocols that violate organizational hardening standards. The engineer must implement a solution that continuously detects non-compliant settings and automatically restores all gateways to their authorized security baseline without manual intervention. Which of the following is the BEST solution to meet these requirements?

Show answer & explanation

Answer: Deploy an automated configuration orchestration tool enforcing declarative baseline templates to continuously audit and remediate unauthorized setting changes.

Answer

Deploying an automated configuration orchestration tool enforcing declarative baseline templates is the best solution because it continuously monitors for configuration drift and automatically restores system settings to the authorized security baseline without manual intervention.
Deploying an automated configuration orchestration tool using declarative baseline templates directly addresses configuration drift. It continuously audits device configurations against the golden baseline standard and automatically enforces compliance by reverting unauthorized setting changes, ensuring endpoints remain hardened without requiring manual intervention.

Step-by-Step Solution

1
Analyze organizational requirements
Identified the need for continuous configuration drift detection and automated remediation to enforce hardening baselines.
The scenario highlights host-level setting changes resulting from a patch deployment that must be automatically rectified.
2
Evaluate control types for configuration management
Configuration orchestration (such as IaC or configuration management agents) directly maintains system state against baseline templates.
Preventive and compensating network controls (NIPS, firewalls) or periodic detective tools (vulnerability scanners) do not restore local endpoint baselines automatically.
3
Select the optimal solution
Chosen automated configuration orchestration tool enforcing declarative templates.
This fulfills both continuous auditing and automated remediation requirements.

Key Concept

Configuration Baseline Enforcement and Automated Drift Remediation
Estimated Time:2m 0s
Question 66Question →

A security administrator at a financial institution is auditing Privileged Access Management (PAM) logs following an automated night-shift batch job failure. The log analysis reveals that a dedicated service account was locked out because a recently updated global security baseline enforced interactive multi-factor authentication (MFA) and a 30-day password expiration policy across all privileged identities. Which of the following is the MOST appropriate operational remedy to ensure unattended batch processing succeeds without compromising privileged security controls?

Show answer & explanation

Answer: Migrate the process to use a Group Managed Service Account (gMSA) with automated password rotation, excluding non-interactive identities from interactive MFA enforcement rules.

Answer

Migrate the batch process to utilize a Group Managed Service Account (gMSA) with automated password rotation while scoping interactive MFA policies strictly to human interactive logins.
Automated batch processing requires non-interactive identity controls. Group Managed Service Accounts (gMSAs) automate password management within domain environments and allow organizations to exempt service identities from interactive human prompts while maintaining strong credential protection.

Step-by-Step Solution

1
Identify the operational cause of the authentication failure.
Recognize that automated non-interactive service accounts cannot fulfill interactive Multi-Factor Authentication (MFA) challenges.
Policy baselines requiring interactive prompts break automated, unattended scheduled tasks.
2
Evaluate identity lifecycle and IAM operational management options for service accounts.
Determine that Group Managed Service Accounts (gMSAs) or managed workload identities provide centralized, programmatic credential rotation.
gMSAs eliminate static passwords and human management overhead while fulfilling security control requirements.
3
Adjust Identity Provider (IdP) Conditional Access policies.
Enforce interactive MFA specifically on user identities, using non-interactive certificate-based or workload identity controls for service accounts.
Ensures strong authentication controls without breaking unattended system operations.

Key Concept

Privileged Account Lifecycle and Service Account Management
Estimated Time:1m 30s
Question 67Question →

A security analyst is configuring an internal vulnerability assessment for a enterprise web platform located behind a reverse proxy. The platform includes legacy application services that are highly sensitive to traffic spikes. The analyst needs to obtain precise host vulnerability data while preventing service outages on legacy components. Which of the following scanner configurations and techniques should the analyst implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Utilize credentialed scanning parameters to inspect local software package registries directly on host operating systems.; Configure scan rate throttling and select non-intrusive check modules during the scan execution.

Answer

The analyst should use credentialed scanning to examine internal package registries on hosts directly, while enabling scan rate throttling and non-intrusive checks to safeguard legacy services.
Credentialed scanning provides direct, internal access to host package managers and OS registries, yielding accurate vulnerability identification. Combining credentialed access with scan rate throttling and non-intrusive test modules ensures high detection fidelity while maintaining service stability on sensitive legacy infrastructure.

Step-by-Step Solution

1
Determine the scanning method that provides high host accuracy without relying on proxy responses.
Selecting credentialed scanning allows the scanner to log into target systems and inspect local package manager databases and configurations directly.
Unauthenticated network scans behind a reverse proxy only observe front-end proxy headers, leading to high false-positive rates.
2
Establish operational parameters to protect fragile legacy backend systems.
Enabling scan throttling and non-intrusive vulnerability test modules prevents excessive concurrent traffic and unsafe payload delivery.
Legacy systems are vulnerable to denial-of-service conditions when exposed to high request volumes or intrusive test vectors.

Key Concept

Vulnerability scanning configuration parameters (credentialed vs unauthenticated scanning and intrusive vs non-intrusive test controls)
Estimated Time:1m 30s
Question 68Question →

An organization notices that several corporate laptops used by remote employees have failed to apply a critical operating system security patch dispatched by the patch management server. Investigation reveals that the employees continuously opted to defer the required system restart, causing their devices to fall out of compliance with the enterprise security configuration baseline. Which of the following technical controls would most effectively enforce compliance and ensure the required patch installation before granting endpoints access to internal network resources?

Show answer & explanation

Answer: Configure Network Access Control posture assessment policies to isolate non-compliant devices to a remediation network until the update is installed.

Answer

Configure Network Access Control posture assessment policies to isolate non-compliant devices to a remediation network until the update is installed.
Network Access Control (NAC) posture assessment performs pre-admission or continuous checks on connecting devices to verify compliance with configuration baselines (such as installed OS patches and updates). Devices failing posture checks are placed in a quarantined or remediation network segment where required updates can be completed before full network access is granted.

Step-by-Step Solution

1
Analyze the security operational requirement
Identified the core requirement: enforcing patch compliance and reboot completion on non-compliant endpoints before allowing access to network resources.
Remote devices falling behind on security baselines create vulnerable entry points into the enterprise network.
2
Evaluate technical controls for posture evaluation and enforcement
Network Access Control (NAC) posture checking validates patch status, antivirus signatures, and configurations during host connection.
If an endpoint fails the health check (posture assessment), NAC can restrict access or place the device into a quarantined remediation VLAN where patches and restarts are executed automatically.
3
Distinguish between technical enforcement and administrative or misapplied controls
Select the NAC posture assessment control over WAF rules, system rollbacks, or administrative reminders.
NAC provides automated technical enforcement directly aligned with patch management and host configuration baseline compliance.

Key Concept

Endpoint Posture Assessment and Remediation via Network Access Control (NAC)
Estimated Time:1m 30s
Question 69Question →

A security analyst reviewing a Security Information and Event Management (SIEM) log aggregator observes the following consecutive Kerberos event entries generated by internal endpoint `10.0.12.88` within a 90-second time window:

text 2026-07-27T11:02:14Z | EventID: 4769 | TargetUser: [email protected] | ServiceName: MSSQLSvc/sql01.corp.local:1433 | TicketEncryption: 0x17 (RC4-HMAC) | Status: 0x0 2026-07-27T11:02:41Z | EventID: 4769 | TargetUser: [email protected] | ServiceName: BackupSvc/storage01.corp.local | TicketEncryption: 0x17 (RC4-HMAC) | Status: 0x0 2026-07-27T11:03:12Z | EventID: 4769 | TargetUser: [email protected] | ServiceName: HTTP/webserver01.corp.local | TicketEncryption: 0x17 (RC4-HMAC) | Status: 0x0

Based on the log output, which attack technique is taking place, and what correlation rule condition should the analyst configure in the SIEM to detect this activity?

Show answer & explanation

Answer: Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.

Answer

Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.
The provided log snippet shows multiple Windows Security Event ID 4769 (Kerberos Service Ticket Request) events returning status code 0x0 (Success) within a 90-second window. All requests target service accounts (`svc_*`) with SPNs and explicitly request encryption type `0x17` (RC4-HMAC). This pattern is characteristic of Kerberoasting, an attack where an adversary requests Kerberos service tickets for accounts with SPNs to extract the ticket hashes from memory and attempt offline password cracking. Effective SIEM detection requires creating a correlation rule that flags a single IP or user requesting multiple 4769 events with RC4 (0x17) encryption over a short time threshold.

Step-by-Step Solution

1
Analyze the event codes and fields in the log entries.
Identified Event ID 4769 (A Kerberos service ticket was requested) with successful status 0x0, target users designated as service accounts (`svc_*`), and ticket encryption type 0x17.
Event ID 4769 logs specifically track TGS ticket requests submitted to Domain Controllers for accessing resources bound to Service Principal Names (SPNs).
2
Evaluate the encryption type indicator (`0x17`).
Recognized `0x17` as the cipher identifier for legacy RC4-HMAC encryption in Windows Kerberos implementations.
Attacking tools (such as Rubeus or GetUserSPNs.py) explicitly request RC4 encryption because RC4-HMAC password hashes are significantly faster to crack offline using brute-force tools compared to AES-128/256.
3
Correlate the observed pattern to determine the attack vector and detection strategy.
Rapid sequential TGS requests for multiple service accounts requesting legacy RC4 encryption from a single host indicates a Kerberoasting reconnaissance/extraction phase. A SIEM correlation rule looking for multiple Event ID 4769 events with encryption type 0x17 within a short time frame directly identifies this threat.
Normal enterprise traffic utilizes modern AES encryption for Kerberos tickets unless legacy constraints exist; rapid bursts of RC4-encrypted TGS requests across diverse SPNs are a signature indicator of Kerberoasting.

Key Concept

Kerberoasting Log Analysis and SIEM Correlation Rule Logic
Question 70Question →

A security engineer is optimizing the vulnerability assessment program for a enterprise high-frequency transaction cluster located behind inline firewalls and web application firewalls (WAFs). Non-credentialed network scans previously returned zero high-severity findings, but network traffic analysis revealed several outdated service daemons running on internal nodes. The engineer must obtain accurate, detailed patch level and configuration data across all hosts while preventing latency spikes, network congestion, and false-positive results caused by network security controls. Which of the following assessment strategies should the engineer implement to meet these requirements?

Show answer & explanation

Answer: Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.

Answer

Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.
Deploying agent-based vulnerability scanners is the most effective approach for high-availability, low-latency production environments. Agents execute authenticated audits directly on the host operating system, providing complete visibility into missing security patches, registry settings, and local software inventories without generating network traffic spikes or being impacted by inline network firewalls and WAFs.

Step-by-Step Solution

1
Analyze the operational constraints and requirements of the environment.
Identified high-frequency transaction cluster requiring zero latency impact, minimal network overhead, and immunity to network security control interference (firewalls/WAFs).
Network-based scanning can be blocked, throttled, or distorted by inline network security controls and can introduce latency.
2
Compare credentialed scanning methods (network-based credentialed vs. agent-based).
Agent-based scanners execute locally on host OS resources, leveraging local administrative context without generating heavy network scan traffic.
Local agents provide deep visibility into patch levels and local configurations while bypassing network security boundaries safely.
3
Select the optimal vulnerability scanning architecture.
Agent-based scanning satisfies all requirements by ensuring accurate vulnerability identification without network performance degradation.
It addresses both the failure of non-credentialed scans and the performance/firewall constraints of network-based scanning.

Key Concept

Agent-Based vs. Network-Based Credentialed Vulnerability Scanning
Estimated Time:2m 0s
Question 71Question →

A security operations team is reviewing credentialed vulnerability scan reports for an enterprise hybrid cloud architecture. The report reveals missing operating system kernel security patches on high-availability backend database servers and unvalidated input parameters on public-facing web API endpoints. To address these findings effectively while preventing service interruption and maintaining security integrity, which of the following actions should the team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply operating system kernel updates using rolling node restarts during off-peak scheduled maintenance windows.; Deploy web application firewall input sanitization rules to block malicious parameter payloads at the API boundary.

Answer

The correct actions are applying operating system kernel updates using rolling node restarts during off-peak maintenance windows and deploying web application firewall input sanitization rules at the API boundary.
Remediating database kernel vulnerabilities through rolling restarts ensures that nodes receive required security patches sequentially without taking down the entire database cluster. Concurrently, deploying web application firewall parameter sanitization rules provides virtual patching at the API perimeter to protect against input manipulation attacks.

Step-by-Step Solution

1
Analyze the vulnerability scan findings and host environments.
Identified two distinct issues: system-level kernel flaws on database hosts and application-level input parameter flaws on web API endpoints.
Remediation strategies must address both system and application layers independently while respecting uptime requirements.
2
Select appropriate remediation and mitigation strategies for high-availability database infrastructure.
Rolling updates maintain cluster availability while applying OS patches during maintenance windows.
Host patching addresses the root cause of OS vulnerabilities without incurring total cluster downtime.
3
Select appropriate edge security controls for API input validation vulnerabilities.
Deploying WAF parameter sanitization rules filters attack payloads at the network perimeter.
WAF rules mitigate exploit vectors immediately without requiring instantaneous code refactoring.

Key Concept

Vulnerability Remediation and Compensating Controls Prioritization
Question 72Question →

An enterprise security team deploys an automated vulnerability scanner to conduct network-based discovery across a newly created subnet housing microservices. Although monitoring tools verify that the microservices are online and actively serving traffic, the scanner's report indicates zero active hosts were discovered on the target subnet. Which of the following best explains why the vulnerability scanner failed to identify the active hosts?

Show answer & explanation

Answer: Network security controls or host firewalls on the target subnet are blocking the initial ICMP echo requests and TCP/UDP discovery probes.

Answer

The vulnerability scanner failed to identify active hosts because network security controls or host firewalls on the target subnet dropped the ICMP echo requests and initial TCP/UDP discovery probes used during host identification.
Vulnerability scanners initiate assessments with a host discovery phase using ICMP echo requests and TCP/UDP probes to identify active targets. When firewalls or network access control lists (ACLs) silently drop these discovery packets, the scanner concludes that no hosts are live at those IP addresses, resulting in a scan report showing zero active systems despite services running.

Step-by-Step Solution

1
Analyze the scanning phase described in the scenario.
The scanner failed during the initial host discovery phase before vulnerability identification took place.
Vulnerability scanners first send lightweight network probes (ICMP, ARP, or standard TCP SYN packets to common ports) to determine if target IP addresses are alive.
2
Evaluate how firewalls impact network discovery probes.
Firewalls configured to drop ICMP packets and unsolicited port requests cause the scanner to register the hosts as unreachable or inactive.
When discovery probes receive no response or are silently dropped, the scanner assumes no host is bound to that IP address and skips further vulnerability assessment on those targets.

Key Concept

Host Discovery Suppressions and Firewall Interferences in Vulnerability Scanning
Question 73Question →

A security technician is setting up a Security Information and Event Management (SIEM) log processing pipeline. Match each SIEM log management phase to its corresponding core function.

Click a left item, then click its matching right item

Items

Parsing
Normalization
Correlation
Aggregation

Matches

Show answer & explanation

Answer

Parsing matches extracting key data fields; Normalization matches mapping attributes into a single standardized schema; Correlation matches linking related log events across sources; Aggregation matches combining repetitive identical event records.
Each SIEM log processing stage performs a distinct function: Parsing extracts structured data fields from raw logs; Normalization maps extracted data to a standardized schema; Correlation connects multiple event streams using logic rules to detect security incidents; and Aggregation deduplicates log volume.

Step-by-Step Solution

1
Identify the data extraction phase
Parsing separates unstructured log lines into discrete elements like IP addresses and event IDs.
SIEM parsers read raw log strings and extract structured fields.
2
Identify the standardization phase
Normalization translates varying field names from different vendors into a unified schema.
Consistent naming conventions enable effective cross-platform querying.
3
Identify the event analysis and rule evaluation phase
Correlation connects separate events over time to detect multi-stage attacks.
Correlation engines combine data streams from multiple sensors to trigger security alerts.
4
Identify the deduplication and volume reduction phase
Aggregation consolidates identical entries into a single summary record.
Grouping duplicate logs saves bandwidth and storage while reducing noise.

Key Concept

SIEM Log Processing Pipeline
Question 74Question →

A security analyst reviews the following web server access log entry:

192.168.1.45 - - [27/Jul/2026:14:32:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 4523

Which of the following attack types is indicated by this log entry?

Show answer & explanation

Answer: SQL Injection (SQLi)

Answer

SQL Injection (SQLi)
The option identifying SQL Injection (SQLi) is correct because the URL parameter contains explicit SQL command structures ('UNION SELECT') designed to query backend database tables.

Step-by-Step Solution

1
Inspect the requested URL parameters in the log entry
The parameter id contains '%20UNION%20SELECT%20username,password%20FROM%20users--'
URL decoding reveals SQL query syntax appended to the input parameter.
2
Identify the underlying attack mechanism
SQL keywords like UNION SELECT attempt to extract data directly from backend database tables
Manipulating backend database SQL queries via unsanitized parameter inputs defines a SQL Injection attack.

Key Concept

Identifying SQL Injection attack signatures in web access logs
Estimated Time:45s
Question 75Question →

A security analyst is configuring a new Security Information and Event Management (SIEM) solution. Place the core stages of the SIEM log processing pipeline in the correct sequential order from initial log entry to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of stages in a SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
In a standard SIEM processing pipeline, raw log data is gathered via Log Collection, extracted into data fields via Parsing, converted to a unified taxonomy during Normalization, cross-analyzed against rules during Correlation, and dispatched to analysts during Alerting.

Step-by-Step Solution

1
Identify the initial log ingestion activity.
Log Collection occurs first as raw data must be received from source devices before processing.
Data cannot be parsed or analyzed until it is ingested by the SIEM collector.
2
Extract raw fields from collected logs.
Parsing splits unstructured log strings into discrete key-value pairs.
Specific attributes must be recognized within raw log strings before standardizing formats.
3
Standardize variable names and field formats.
Normalization converts heterogeneous fields into a unified system schema.
Standardized data structures allow consistent cross-source log analysis.
4
Evaluate normalized data against rule engines.
Correlation cross-references standardized events across different logs to identify indicators of compromise.
Pattern identification requires normalized inputs from multiple security sources.
5
Dispatch notification of identified incidents.
Alerting informs analysts or triggers security orchestration when correlation logic fires.
Alerting is the final outcome of pipeline processing intended to initiate human or automated incident response.

Key Concept

SIEM Log Processing Pipeline
Question 76Question →

A security analyst is investigating a alert on an internal Linux server and reviews the following authentication log entries:

text
Jul 27 14:10:02 auth-server sshd[4102]: Failed password for root from 203.0.113.5 port 49152 ssh2
Jul 27 14:10:03 auth-server sshd[4105]: Failed password for root from 203.0.113.5 port 49154 ssh2
Jul 27 14:10:04 auth-server sshd[4109]: Failed password for root from 203.0.113.5 port 49156 ssh2
Jul 27 14:10:05 auth-server sshd[4112]: Failed password for root from 203.0.113.5 port 49158 ssh2

Which type of security event is directly indicated by these log entries?

Show answer & explanation

Answer: An SSH password brute-force attack against the root user account

Answer

An SSH password brute-force attack against the root user account
The correct answer is correct because the SSH log entries (`sshd`) show repeated, consecutive `Failed password` messages for the privileged `root` user originating from the same source IP (`203.0.113.5`) in one-second intervals, which is a classic signature of an automated brute-force login attack.

Step-by-Step Solution

1
Examine the log service process and message type.
The process `sshd` indicates Secure Shell daemon logs reporting `Failed password` for the user `root`.
Identifying the daemon and status clarifies that authentication attempts are failing.
2
Analyze timestamps and source address pattern.
Consecutive login failures occur every second from IP `203.0.113.5`.
Rapid, automated repeat attempts from a single source address confirm an automated password brute-force pattern.

Key Concept

SSH Authentication Log Analysis
Question 77Question →

During the deployment of a new Security Information and Event Management (SIEM) system, a security engineer is configuring the automated pipeline for handling enterprise security events. Arrange the stages of the SIEM data processing pipeline in the correct chronological order from initial log intake to final analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the SIEM log processing pipeline is: Log Collection and Ingestion -> Parsing and Normalization -> Event Correlation -> Alert Generation and Dispatch.
The correct sequence reflects the standard data lifecycle within a SIEM: raw log streams are ingested from hosts and networks, normalized into standard field formats, evaluated by correlation logic to detect multi-event attack patterns, and finally dispatched as actionable alerts to security analysts.

Step-by-Step Solution

1
Identify the initial data intake phase
Log Collection and Ingestion occurs first as raw data must be gathered from sources before processing.
Without raw log intake, no downstream parsing or analysis can occur.
2
Identify the data formatting phase
Parsing and Normalization occurs second to standardize field names and structures across disparate sources.
Correlation rules require standardized fields (like source IP or username) to evaluate events across different log sources.
3
Identify the detection and rule evaluation phase
Event Correlation occurs third as normalized data is evaluated against threat logic and correlation rules.
SIEM rules analyze relationships between parsed events to identify multi-source security incidents.
4
Identify the notification phase
Alert Generation and Dispatch occurs last when correlation rules trigger security alerts for SOC analysts.
Alerting is the output produced after an incident scenario is identified by correlation logic.

Key Concept

SIEM Log Processing Pipeline
Question 78Question →

A security analyst is investigating an automated SIEM threshold alert triggered by unusual outbound network activity from an internal host (192.168.10.114). The analyst reviews the following DNS query log entries within the SIEM dashboard:

text
27-Jul-2026 14:15:01.123 queries: info: client 192.168.10.114#49152 (a1g4z9x8q.exfil.attacker-domain.com): query: a1g4z9x8q.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.450 queries: info: client 192.168.10.114#49152 (b9k2m8p3w.exfil.attacker-domain.com): query: b9k2m8p3w.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.890 queries: info: client 192.168.10.114#49152 (c3r7v1q5n.exfil.attacker-domain.com): query: c3r7v1q5n.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:02.210 queries: info: client 192.168.10.114#49152 (d4m9p2k7x.exfil.attacker-domain.com): query: d4m9p2k7x.exfil.attacker-domain.com IN TXT +

Based on the log data, which of the following security events is MOST likely taking place?

Show answer & explanation

Answer: DNS tunneling used for data exfiltration or command-and-control communication

Answer

The log entries indicate DNS tunneling used for data exfiltration or command-and-control communication.
The correct answer identifies DNS tunneling. The log snippet reveals an internal host generating rapid, high-frequency DNS queries requesting TXT records with encoded, randomized subdomains appending an external domain. Because DNS traffic often bypasses strict firewall filters, attackers encapsulate data or C2 traffic inside DNS request and response fields.

Step-by-Step Solution

1
Examine the log structure and source client
Identified client host 192.168.10.114 issuing rapid, high-frequency outbound queries to an external destination domain (attacker-domain.com).
Determining the origin and frequency of requests helps distinguish automated host behavior from regular user browsing.
2
Analyze the query record type and hostname patterns
Queries request TXT records containing randomized/encoded alphanumeric subdomains (e.g., a1g4z9x8q.exfil...).
TXT records allow arbitrary text payload retrieval, and dynamic subdomains are commonly encoded chunks of data sent to an attacker's authoritative name server.
3
Correlate patterns with known threat tactics
High-volume, encoded TXT queries targeting a single sub-domain structure match the signature of DNS tunneling for covert data exfiltration or C2.
DNS traffic is often allowed through firewalls, making it an ideal vector for protocol encapsulation and stealthy data transfer.

Key Concept

DNS Tunneling Detection via SIEM Log Analysis
Question 79Question →

A security analyst is defining operational procedures for a Security Information and Event Management (SIEM) deployment. Match each SIEM log management concept on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Items

Log Aggregation
Log Normalization
Event Correlation
Log Retention

Matches

Show answer & explanation

Answer

Log Aggregation matches centralizing raw log data from disparate hosts; Log Normalization matches transforming heterogeneous log entries into a standardized schema; Event Correlation matches analyzing relationship patterns between distinct log events; and Log Retention matches storing historical log data for specified timelines to satisfy regulatory requirements.
Each concept aligns with its precise SIEM function: Aggregation collects raw logs into a central location, Normalization standardizes field syntax across vendor logs, Correlation analyzes relationships across events to flag attacks, and Retention maintains historical log archives for compliance.

Step-by-Step Solution

1
Identify the mechanism for collecting raw logs centrally.
Centralizing raw log data from disparate systems corresponds to Log Aggregation.
Aggregation brings scattered log sources together into a central SIEM collector.
2
Identify the process for unifying varied log formats.
Transforming heterogeneous logs into a standardized schema corresponds to Log Normalization.
Normalization ensures that different log syntax structures share identical field names (e.g., standardizing 'src_ip', 'SourceAddress', and 'src' to a single common field).
3
Identify the analytical process for connecting multi-system events.
Analyzing relationships across distinct log entries corresponds to Event Correlation.
Correlation engine rules detect threat scenarios spanning multiple log sources across time windows.
4
Identify the policy governing historic data storage.
Storing historical logs to satisfy regulatory requirements corresponds to Log Retention.
Retention schedules dictate how long logs remain accessible in hot, warm, or cold storage.

Key Concept

SIEM Core Log Management Operations
Estimated Time:1m 30s
Question 80Question →

A security analyst inspecting a Security Information and Event Management (SIEM) console reviews the following web server log snippet:

`10.0.4.15 - - [27/Jul/2026:14:15:33 +0000] "GET /cgi-bin/status.sh?cmd=cat%20/etc/passwd HTTP/1.1" 200 1420`

Which of the following cyber attack vectors is directly indicated by this log entry?

Show answer & explanation

Answer: Command injection

Answer

The command injection option is the correct answer.
The correct answer is Command injection because the log entry shows the parameter `cmd=cat%20/etc/passwd`, where `%20` represents a space. This attempts to invoke an operating system command (`cat /etc/passwd`) on the backend web server via a CGI script.

Step-by-Step Solution

1
Analyze the request URI parameters within the log entry.
Identified URL-encoded shell syntax `cat%20/etc/passwd` passed to parameter `cmd`.
Log analysis requires inspecting user input passed to CGI endpoints to determine intent.
2
Determine the target system and impact of the parameter payload.
The payload attempts to execute the system binary `cat` on the Linux file `/etc/passwd` directly on the web host.
Executing arbitrary operating system commands through web application inputs defines command injection.

Key Concept

Identifying web application attack indicators in SIEM access logs
PreviousPage 4 / 32Next