Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

A SOC analyst is reviewing diverse log artifacts collected across enterprise infrastructure. Match each security log artifact signature to the corresponding incident activity or event type it indicates.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Matching pairs: (1) Windows Event ID 4625 with Status Code 0xC000006A corresponds to a failed user logon attempt due to an incorrect password. (2) HTTP GET request with path traversal characters corresponds to a directory traversal attack attempt. (3) NetFlow record with high-frequency, large UDP 53 payloads corresponds to potential DNS tunneling exfiltration. (4) Linux pam_unix sudo auth failure corresponds to an unauthorized privilege escalation attempt.

Each log snippet exhibits unique protocol and system signatures: Event ID 4625 with status 0xC000006A explicitly flags bad password logons; relative path sequences indicate directory traversal; abnormally large UDP 53 packets reflect DNS covert tunneling; and PAM sudo failure messages record elevated privilege execution blocks.

Step-by-Step Solution

Analyze Windows Event ID 4625 and its status code

Identify that Event ID 4625 records failed logons, with 0xC000006A denoting bad password entry.

Correlating event codes with specific Windows sub-status codes allows precise identification of authentication failure causes.

Inspect the web server access log string syntax

Recognize path manipulation patterns (`../`) pointing to sensitive system paths (`/etc/shadow`).

Dot-dot-slash characters are characteristic signature elements of directory/path traversal vulnerabilities.

Evaluate NetFlow protocol indicators

Associate large outbound UDP port 53 payloads with covert channel exfiltration.

DNS relies on UDP port 53 and normally transmits minor metadata; anomaly detection identifies large payload bursts as tunneling.

Examine Linux authentication daemon log entries

Connect `pam_unix(sudo:auth)` failure logs to elevated privileges execution attempts.

The `sudo` command allows standard users to run tasks with effective UID 0 (root), making failed sudo attempts indicators of unauthorized privilege escalation.

Key Concept

Log Analysis and Event Correlation

Question 102Question →

A security analyst is reviewing authentication logs from a Linux server (`/var/log/auth.log`) after a SIEM alert fired:

May 12 14:02:11 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49152 ssh2
May 12 14:02:14 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49154 ssh2
May 12 14:02:17 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49156 ssh2
May 12 14:02:22 auth-srv sshd[4102]: Accepted password for root from 192.0.2.45 port 49160 ssh2
May 12 14:02:23 auth-srv pam_unix(sshd:session): session opened for user root by (uid=0)

Based on the log snippet above, which of the following statements regarding the incident and appropriate response actions are correct? (Select TWO.)

Select all that apply

The event sequence demonstrates a successful password brute-force attack resulting in account compromise.

The affected host should be immediately isolated from the network as part of incident containment.

The log entries indicate a Cross-Site Scripting (XSS) injection attack against the SSH daemon service.

The 'session opened' entry confirms that role-based authorization was evaluated before identity verification took place.

Show answer & explanation

Answer: The event sequence demonstrates a successful password brute-force attack resulting in account compromise.; The affected host should be immediately isolated from the network as part of incident containment.

Answer

The correct conclusions are that the event sequence demonstrates a successful password brute-force attack resulting in account compromise, and the affected host should be immediately isolated from the network as part of incident containment.

The sequence of multiple failed password attempts from IP 192.0.2.45 followed immediately by a successful login for the root user indicates a successful brute-force attack. Because privileged access (root) was established by an untrusted source, the immediate incident response action is system containment via network isolation.

Step-by-Step Solution

Analyze the log entries chronologically to determine the pattern of activity.

Three consecutive failed password attempts for user 'root' from source IP 192.0.2.45 occur within seconds, followed directly by an 'Accepted password' entry from the same IP.

Rapid consecutive authentication failures followed by success indicate automated credential guessing (brute-force attack).

Determine the impact of the successful authentication entry.

The root session was opened (`session opened for user root`), confirming unauthorized administrative access.

Root access gives full privilege on a Linux system, making containment an urgent priority.

Identify the immediate incident response containment action.

Isolate the compromised system from the local network.

Host network isolation prevents the attacker from escalating privileges laterally across the network.

Key Concept

Identifying brute-force authentication indicators in log files and determining immediate incident containment steps.

Question 103Question →

A Security Operations Center (SOC) analyst receives a validated alert indicating unauthorized administrative credential usage and potential persistence mechanisms on a critical internal server. According to standard incident response frameworks and playbooks, the analyst must focus on immediate containment and evidence preservation. Which of the following actions should the analyst perform at this stage? (Select TWO.)

Select all that apply

Place the affected server into an isolated quarantine VLAN to prevent lateral movement while preserving volatile state.

Wipe the hard drive immediately and reinstall the operating system using a golden image.

Capture a full image of volatile memory (RAM) to preserve active network connections and running process artifacts.

Conduct a formal post-incident lessons learned session to update the enterprise incident response playbook.

Show answer & explanation

Answer: Place the affected server into an isolated quarantine VLAN to prevent lateral movement while preserving volatile state.; Capture a full image of volatile memory (RAM) to preserve active network connections and running process artifacts.

Answer

The analyst should isolate the server on a quarantine VLAN and capture a full image of volatile memory (RAM).

Isolating the compromised host on a quarantine VLAN halts lateral network movement while keeping the system powered, allowing analysts to capture volatile memory (RAM) to preserve ephemeral evidence such as running processes and active sockets before it is lost.

Step-by-Step Solution

Identify the active incident response phase requested in the scenario.

The scenario requires executing immediate containment and evidence preservation procedures.

Standard NIST and ISO incident response lifecycles mandate containing threats and securing volatile evidence before eradication or recovery.

Evaluate the choices to find actions that fulfill containment and preservation requirements.

Quarantining the network connection contains the attack, while RAM acquisition preserves volatile memory artifacts.

Placing the machine in a quarantine VLAN halts lateral movement without shutting down the host, allowing RAM to be captured following the order of volatility.

Eliminate options corresponding to out-of-order lifecycle phases.

Reimaging (eradication) and post-incident lessons learned (post-incident activity) are misaligned with initial containment.

Executing eradication or post-incident review steps out of sequence compromises forensic evidence and operational integrity.

Key Concept

Incident Response Containment and Evidence Preservation Lifecycle Phases

Question 104Question →

During a suspected breach investigation, a security handler observes that an API gateway server hosting sensitive internal workflows is attempting unauthorized outbound network traffic to a known command-and-control server following a successful zero-day exploit execution. According to standard NIST incident response guidelines, which of the following actions should the handler execute FIRST?

Isolate the API gateway server from the network via microsegmentation to prevent data exfiltration while preserving system volatile memory.

Delete the malicious payload executable and clear temporary directory paths on the server host file system.

Restore the API gateway host from a clean virtual machine snapshot to bring production services back online immediately.

Reconfigure network audit policies to establish a corrective control monitoring future exploit attempts on the gateway.

Show answer & explanation

Answer: Isolate the API gateway server from the network via microsegmentation to prevent data exfiltration while preserving system volatile memory.

Answer

Isolate the API gateway server from the network via microsegmentation to prevent data exfiltration while preserving system volatile memory.

In accordance with standard NIST incident response frameworks (NIST SP 800-61), once an active intrusion or C2 communication is confirmed, containment must occur before eradication or recovery steps. Isolating the system via microsegmentation halts outbound data exfiltration and lateral movement while keeping the system in a state suitable for volatile memory capture and forensic analysis.

Step-by-Step Solution

Identify the current incident response phase based on the scenario description.

The incident has been detected and confirmed active (active C2 communication), placing the handler at the transition into the Containment, Eradication, and Recovery phase.

Before performing active system modifications, the immediate priority is limiting breach scope and preventing exfiltration.

Evaluate containment actions against eradication and recovery actions.

Network isolation contains the threat immediately without altering host volatile memory needed for forensic capture.

Standard NIST SP 800-61 frameworks dictate containing the incident prior to executing eradication steps like deleting malicious binaries or performing host imaging.

Select the correct immediate next step.

Isolating the server using microsegmentation or host isolation controls is the required first response action.

This halts attacker interaction while preserving system state for evidence preservation.

Key Concept

Incident Response Lifecycle Order (Containment before Eradication/Recovery)

Question 105Question →

A security analyst is reviewing the following Linux authentication and system logs aggregated by an enterprise SIEM platform from host `srv-prod-02`:

syslog
2026-07-27T10:14:02Z srv-prod-02 sshd[8812]: Failed password for invalid user admin from 192.0.2.140 port 51102 ssh2
2026-07-27T10:14:05Z srv-prod-02 sshd[8815]: Failed password for invalid user root from 192.0.2.140 port 51106 ssh2
2026-07-27T10:14:12Z srv-prod-02 sshd[8820]: Accepted password for user svc_web from 192.0.2.140 port 51112 ssh2
2026-07-27T10:14:25Z srv-prod-02 sudo[8840]: svc_web : TTY=pts/1 ; PWD=/var/www/html ; USER=root ; COMMAND=/usr/bin/python3 -c 'import pty; pty.spawn("/bin/sh")'

Based on the SIEM event sequence above, which of the following statements correctly analyze the activity and impact of this security incident? (Select TWO.)

Select all that apply

The initial SSH activity shows a successful authentication following multiple rapid password failures from the same source IP address.

The sequence demonstrates horizontal initial access transitioning into privilege escalation to superuser (root) status via sudo.

The failed password entries represent an authorization failure caused by missing file-level permissions for remote users.

The log output identifies a reflected cross-site scripting (XSS) exploit targeting the host web application server.

Show answer & explanation

Answer: The initial SSH activity shows a successful authentication following multiple rapid password failures from the same source IP address.; The sequence demonstrates horizontal initial access transitioning into privilege escalation to superuser (root) status via sudo.

Answer

The incident involves a successful SSH authentication following multiple failed logon attempts from the same source IP, followed by privilege escalation to root via sudo.

The log sequence traces a classic intrusion trajectory starting with brute-force authentication attempts against SSH (failed logins from IP 192.0.2.140), leading to successful authentication as 'svc_web'. Subsequently, the attacker abuses sudo privileges to spawn a root shell using a Python PTY trick, completing privilege escalation.

Step-by-Step Solution

Analyze SSH authentication entries in the SIEM log snippet.

Identify multiple failed logins for invalid users ('admin', 'root') from source IP 192.0.2.140 followed by a successful login for 'svc_web' from the same IP.

This indicates a brute-force or credential stuffing attack that successfully gained initial access.

Analyze post-authentication command execution in the sudo logs.

Identify that account 'svc_web' executed `/usr/bin/python3 -c 'import pty; pty.spawn("/bin/sh")'` with `USER=root`.

Spawning an interactive shell via Python with sudo grants root administrative privileges, completing a privilege escalation attack vector.

Key Concept

Log Correlation & Incident Trajectory Analysis

Question 106Question →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an employee workstation is actively encrypting local files and attempting outbound communication with a malicious command-and-control server. According to standard incident response procedures, which of the following steps should the analyst perform FIRST?

Disconnect the workstation from the local network to isolate the threat.

Reimage the workstation using a standard enterprise baseline image.

Schedule a lessons-learned meeting with the incident response team.

Deploy an emergency patch across all enterprise endpoints to remediate the flaw.

Show answer & explanation

Answer: Disconnect the workstation from the local network to isolate the threat.

Answer

Disconnect the workstation from the local network to isolate the threat.

Isolating the workstation from the network is the critical first step during the containment phase of incident response. Disconnecting network access halts communication with command-and-control servers and prevents lateral movement to other enterprise endpoints.

Step-by-Step Solution

Determine the current phase of the incident response lifecycle.

The scenario describes an active malware infection requiring immediate containment.

An ongoing incident must be contained immediately to limit scope and prevent further damage.

Select the appropriate action for host containment.

Isolating the system from the network halts command-and-control traffic and stops lateral propagation.

Network disconnection prevents the spread of ransomware/malware while leaving system state intact for initial analysis.

Key Concept

Incident Response Containment Phase

Question 107Question →

A security analyst is reviewing the following firewall Syslog entries forwarded to a SIEM collector:

`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49152 DPT=22`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49153 DPT=80`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49154 DPT=443`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=3389 DPT=3389`

Which of the following network activities is best indicated by this log sequence?

Port scanning targeting multiple standard service ports on a single host

Cross-site scripting (XSS) payload execution against an exposed application

User authentication and authorization granting for an administrative session

SIEM correlation parser misinterpretation of encrypted log payloads

Show answer & explanation

Answer: Port scanning targeting multiple standard service ports on a single host

Answer

Port scanning targeting multiple standard service ports on a single host

The log entries show a single external source IP address (192.0.2.50) attempting connections to several well-known service ports (22 for SSH, 80 for HTTP, 443 for HTTPS, and 3389 for RDP) on a target host (10.0.1.10) at the exact same second. This pattern of rapidly probing multiple ports on a single host is the classic signature of a port scan.

Step-by-Step Solution

Examine the log source and event details

Identified packet drop entries ([FW_DROP]) logged by firewall host fw01.

Understanding the log component helps isolate network traffic events from application or host events.

Analyze source IP, destination IP, and timestamps across entries

Source IP 192.0.2.50 sent sequential packets to destination IP 10.0.1.10 at the exact same timestamp (10:15:01).

Rapid attempts from a single source host to a target host indicate automated reconnaissance.

Inspect destination ports (DPT) queried

Destinations include TCP ports 22 (SSH), 80 (HTTP), 443 (HTTPS), and 3389 (RDP).

Testing multiple well-known service ports sequentially is standard behavior for network port scanners.

Key Concept

Identifying port scanning behavior from firewall log parameters in SIEM monitoring

Question 108Question →

A security handler confirms that a cloud administrator host is actively exporting database backups to an unapproved external storage endpoint using hijacked API credentials. Following standard incident response procedures, which of the following actions should the security handler take FIRST?

Revoke the compromised API credentials and restrict the host's network connectivity.

Reimage the host operating system and restore database files from verified offline backups.

Deploy a web application firewall rule designed to block cross-site scripting attack payloads.

Initiate network-wide antivirus scanning to remove self-replicating network worm components.

Show answer & explanation

Answer: Revoke the compromised API credentials and restrict the host's network connectivity.

Answer

Revoke the compromised API credentials and restrict the host's network connectivity.

In standard incident response frameworks (such as NIST SP 800-61), once an active breach or exfiltration event is detected, containment is the immediate priority. Revoking compromised API keys and isolating the affected system prevents further data loss without altering offline forensic evidence.

Step-by-Step Solution

Analyze the incident scenario and determine the current phase of incident response.

An active data exfiltration incident is occurring via hijacked administrative credentials.

Immediate containment is required to minimize exposure and halt ongoing unauthorized access.

Select the appropriate immediate containment action according to standard NIST IR playbooks.

Revoking session keys/credentials and isolating the administrator host halts exfiltration immediately.

Containment actions must precede eradication (reimaging) or recovery (restoring from backups).

Key Concept

Incident Response Lifecycle - Containment Phase

Question 109Question →

A security analyst is investigating a high-fidelity SIEM alert generated from cloud infrastructure audit logs. The analyst retrieves the following sequential log events originating from external IP address 198.51.100.4:

text
2026-06-14T09:12:01Z cloudtrail: User="j.smith" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:03Z cloudtrail: User="m.davis" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:05Z cloudtrail: User="a.wilson" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:10Z cloudtrail: User="r.taylor" Event="ConsoleLogin" Status="Success" SourceIP="198.51.100.4"
2026-06-14T09:12:18Z cloudtrail: User="r.taylor" Event="CreateAccessKey" Status="Success" SourceIP="198.51.100.4"

Based on these log entries, which of the following security events has occurred?

A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.

A targeted single-account brute-force attack compromised user r.taylor after repeated failed login attempts against that specific account.

A SQL injection attack manipulated backend web application database queries to bypass identity verification controls.

An authorization failure occurred because account r.taylor lacked sufficient role privileges to perform the ConsoleLogin action.

Show answer & explanation

Answer: A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.

Answer

A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.

The correct option accurately identifies the log signature of a password spraying attack (multiple different target accounts tested from one IP address in rapid succession) leading to account compromise and post-exploitation persistence setup via API access key creation.

Step-by-Step Solution

Analyze the log entries for authentication activity patterns.

Identify that the same source IP (198.51.100.4) attempted login requests across multiple distinct user accounts (j.smith, m.davis, a.wilson, r.taylor) within seconds.

Sequential failed logins across multiple accounts from a single IP address indicate a horizontal brute-force technique known as password spraying.

Evaluate the outcome of the authentication attempts.

Account r.taylor logged in successfully at 09:12:10Z.

Determines that the password spraying attempt successfully identified a valid credential pair.

Correlate post-authentication actions.

Account r.taylor executed CreateAccessKey successfully 8 seconds after logging in.

Threat actors frequently create programmatic access keys immediately after account compromise to ensure persistent command-line or API access.

Key Concept

Log Correlation and Password Spraying Detection

Question 110Question →

A security operations team responds to an active breach involving a malicious third-party OAuth application that gained consent to access executive mailboxes in a cloud SaaS environment. The application is actively exporting sensitive financial emails via automated API calls. According to standard incident response playbooks for cloud containment, which TWO of the following actions should the team perform immediately? (Select TWO.)

Select all that apply

Revoke all active OAuth access and refresh tokens linked to the malicious application.

Disable the application registration and revoke permissions for its service principal in the identity tenant.

Initiate full re-imaging of the cloud provider's underlying hypervisor and virtual mail servers.

Purge all historical audit logs and user mailboxes affected by the unauthorized API access.

Show answer & explanation

Answer: Revoke all active OAuth access and refresh tokens linked to the malicious application.; Disable the application registration and revoke permissions for its service principal in the identity tenant.

Answer

The correct containment steps are revoking active OAuth access and refresh tokens and disabling the application registration with its service principal permissions.

In cloud identity environments, containing malicious third-party OAuth app activity requires severing active API authorizations. Revoking current access and refresh tokens immediately stops ongoing session traffic, while disabling the enterprise application registration and its service principal prevents the attacker from generating fresh tokens or maintaining persistent API access.

Step-by-Step Solution

Identify the vector of active exfiltration

Exfiltration is occurring via API calls using compromised OAuth tokens tied to an authorized application registration.

Containment must target the exact access vector without destroying system evidence or impacting unrelated services.

Invalidate existing session tokens

Revoking access and refresh tokens instantly severs current API connections established by the attacker.

Token revocation stops ongoing data transfer in real time during the containment phase.

Disable application credentials

Disabling the application registration and its service principal prevents the application from generating new authorization tokens.

This isolates the malicious application within the identity tenant, completing initial containment.

Key Concept

Cloud SaaS Incident Response and OAuth Application Containment

Estimated Time:2m 0s

Question 111Question →

Place the core stages of the Security Information and Event Management (SIEM) log processing pipeline in the correct sequential order from initial intake to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the SIEM log processing pipeline is Log Collection, followed by Parsing and Normalization, then Event Correlation, and finally Alert Generation.

The standard SIEM data ingestion workflow begins with raw Log Collection from enterprise systems. These logs undergo Parsing and Normalization so that events from diverse operating systems and security appliances fit a common data model. Once normalized, the SIEM executes Event Correlation across logs to detect complex multi-host attack patterns. When correlation threshold rules are met, the system performs Alert Generation to notify security analysts.

Step-by-Step Solution

Identify the initial data ingestion phase

Log Collection occurs first as raw logs must be collected from disparate endpoint and network sources before processing.

Downstream parsing and analysis tools require raw event data to operate.

Identify the data structuring phase

Parsing and Normalization occurs second to reformat incoming raw text logs into standard, structured fields.

SIEM engines require consistent field definitions across different log vendors to execute detection logic.

Identify the threat detection and analysis phase

Event Correlation occurs third to analyze structured logs against rule sets and baseline behaviors.

Correlation logic depends on pre-normalized fields to associate related events across different systems.

Identify the incident escalation phase

Alert Generation occurs last when correlation conditions indicate a potential security event.

Alerting informs analysts only after potential threat indicators have been identified and prioritized.

Key Concept

SIEM Log Processing Pipeline

Question 112Question →

During a routine traffic audit of an enterprise perimeter router, a security team examines the following network telemetry log generated by a passive Network Security Monitoring (NSM) sensor inspecting outbound UDP traffic:

Timestamp: 2026-07-27T14:22:01Z
Sensor_ID: NSM-PERIMETER-02
Src_IP: 10.4.18.99 (Internal Workstation)
Dst_IP: 198.51.100.45 (External Name Server)
Proto/Port: UDP/53
Query_Type: TXT
Query_String: a1b2c3d4e5f67890abcdef1234567890.sub.exfil-domain.example
Packet_Count: 14,250 queries/5 min
Avg_Payload_Size: 480 bytes

Which of the following is the most accurate assessment of the threat indicated by this alert and the security operational classification of the sensor mechanism?

The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a detective security control.

The traffic indicates an active SQL injection attack targeting an external database, and the monitoring sensor operates as a detective security control.

The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a preventive security control.

The traffic indicates a host memory buffer overflow exploit, and the incident should be remediated by deploying inline host-based application patches.

Show answer & explanation

Answer: The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a detective security control.

Answer

The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a detective security control.

The correct option accurately identifies the high-frequency UDP/53 TXT query anomaly as DNS covert tunneling used for exfiltrating data across network boundaries. It also correctly categorizes the passive network telemetry sensor as a detective security control because it gathers log evidence and triggers alerts without intercepting or dropping packets inline.

Step-by-Step Solution

Analyze the protocol, query type, payload length, and traffic volume in the telemetry log.

The log reveals an abnormally high volume (14,250 queries within 5 minutes) of UDP port 53 TXT record requests carrying long encoded subdomains to an external destination.

Legitimate DNS resolution consists of low-volume, short lookup requests. Large payloads sent rapidly via TXT queries strongly indicate DNS tunneling used for covert data exfiltration.

Differentiate between database/web application exploit traffic and network-level covert tunneling.

The payload is encoded data embedded inside domain subdomains for DNS routing, not relational database manipulation queries (SQL injection).

DNS tunneling encapsulates data within protocol packets to bypass perimeter firewalls, distinct from web application injection vulnerabilities.

Classify the operational role of the passive Network Security Monitoring (NSM) sensor.

The passive NSM sensor observes network traffic and records telemetry/alerts, serving a detective control function.

Preventive controls block traffic inline (like firewalls or NIPS), whereas passive network monitoring mechanisms detect and report events.

Key Concept

DNS Covert Tunneling Detection and Detective Security Controls

Question 113Question →

An incident response team is executing a playbook following the detection of an active unauthorized remote access Trojan on an enterprise workstation. Which of the following actions represent appropriate steps to take specifically during the containment phase of the incident response lifecycle? (Select TWO.)

Select all that apply

Isolating the compromised workstation from the local network by disabling its network interface

Blocking the remote command-and-control server's IP address at the perimeter firewall

Reimaging the affected workstation using an approved operating system baseline image

Holding a lessons-learned meeting with stakeholders to update the incident response playbook

Show answer & explanation

Answer: Isolating the compromised workstation from the local network by disabling its network interface; Blocking the remote command-and-control server's IP address at the perimeter firewall

Answer

The correct containment steps are isolating the compromised workstation from the local network by disabling its network interface, and blocking the remote command-and-control server's IP address at the perimeter firewall.

The containment phase aims to limit the blast radius of a confirmed security incident. Isolating the workstation from the network stops malware from spreading laterally across internal segments. Blocking command-and-control IP addresses at the firewall halts outbound control channels and data exfiltration while keeping evidence intact.

Step-by-Step Solution

Determine the core purpose of the containment phase in the incident response framework.

Containment focuses on restricting the spread of an active incident and mitigating damage while keeping systems stable and preserving evidence.

Stopping lateral movement and external C2 communications isolates the risk before permanent removal or rebuilding steps begin.

Map each option to its appropriate incident response lifecycle phase.

Host network isolation and perimeter firewall blocking limit breach scope (Containment). System reimaging purges the malware (Eradication). Post-incident reviews document lessons learned (Post-Incident Activity).

Distinguishing containment actions from eradication and post-incident activities ensures proper operational sequencing according to NIST SP 800-61 guidelines.

Key Concept

Incident Response Containment Strategies

Question 114Question →

A security analyst investigating a cloud-hosted infrastructure detects that an OAuth 2.0 refresh token assigned to an automated microservice was compromised. Real-time monitoring confirms an unauthorized external entity is actively exploiting this token to execute bulk queries and exfiltrate sensitive financial records from a database endpoint. According to standard incident response lifecycle frameworks, which of the following represents the IMMEDIATE next step the incident response team should take?

Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.

Deploy newly compiled container images and restore backend database tables from offline clean backups.

Reconfigure the intrusion detection system from passive monitoring to inline network blocking to act as a primary corrective control.

Apply web application firewall filtering to strip malicious JavaScript tags from API payloads to prevent client-side Cross-Site Scripting against the database.

Show answer & explanation

Answer: Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.

Answer

Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.

The correct response prioritizes containment above eradication and recovery during an active security incident. In standard frameworks (such as NIST SP 800-61), once an incident is detected and validated, the immediate priority is limiting the scope of impact and preventing further exfiltration. Revoking the compromised OAuth token invalidates the active credential, while temporary network isolation prevents further unauthorized API interaction.

Step-by-Step Solution

Analyze the current state of the security incident based on scenario telemetry.

Identified active data exfiltration occurring via a compromised OAuth token.

Determining whether an active threat is in progress dictates the immediate priority in the incident response process.

Determine the appropriate incident response phase according to standard NIST SP 800-61 / ISO 27035 guidelines.

The incident is actively occurring, requiring immediate Containment.

The priority during active breach scenarios is to limit damage and prevent further unauthorized data movement before initiating remediation.

Select the response action that fulfills the containment objective.

Revoking the compromised token and isolating the affected endpoint stops ongoing data leakage immediately.

Invalidating stolen active session/token credentials and isolating network pathways directly halts unauthorized data access without jumping ahead to eradication or recovery.

Key Concept

Incident Response Lifecycle Containment Phase Priorities

Question 115Question →

A security operations engineer is responding to an incident where an attacker maintained access to enterprise cloud resources after an employee reported a compromised password. The security analyst immediately performed a password reset, but log reviews show the attacker continued performing administrative actions using an active Single Sign-On (SSO) session and active refresh tokens for several hours afterward. Which of the following operations should the security team perform to remediate this vulnerability and ensure immediate containment during credential resets?

Enforce automated active session revocation and token invalidation workflows upon password resets.

Reconfigure Role-Based Access Control (RBAC) definitions to remove administrative privileges from the affected user account.

Restrict authentication requests exclusively to corporate perimeter IP ranges using network firewalls.

Reclassify identity audit logging controls from detective controls to preventive controls within the security framework.

Show answer & explanation

Answer: Enforce automated active session revocation and token invalidation workflows upon password resets.

Answer

Enforcing automated active session revocation and token invalidation workflows upon password resets.

When a password reset occurs, modern SSO identity providers must explicitly revoke issued session tokens and refresh tokens (such as OAuth tokens or SAML session keys). Without explicit token revocation, active sessions remain valid until their scheduled time-to-live (TTL) expires, allowing unauthorized access to persist.

Step-by-Step Solution

Analyze the incident evidence to determine how persistent access occurred.

Identified that password resetting alone left existing JSON Web Tokens (JWTs) and active SSO session cookies valid until their natural expiration.

Authentication protocols (OAuth 2.0/OIDC/SAML) decouple credential verification from session token lifecycles unless explicit revocation signals are sent.

Evaluate identity operational controls to force session termination across connected applications.

Automating session revocation invalidates all issued access and refresh tokens immediately upon credential change.

This prevents malicious actors from continuing to use cached identity tokens after authentication credentials are rotated.

Key Concept

Identity and Access Management Operations - Session Lifecycle and Token Revocation

Question 116Question →

An IT auditor inspects syslog entries forwarded to an enterprise SIEM aggregator from a Linux server. The log stream records the following sequential events:

`2026-07-27T14:15:02Z host1 sshd[4821]: Failed password for invalid user root from 198.51.100.45 port 42102 ssh2`
`2026-07-27T14:15:03Z host1 sshd[4825]: Failed password for invalid user admin from 198.51.100.45 port 42104 ssh2`
`2026-07-27T14:15:04Z host1 sshd[4830]: Failed password for invalid user service from 198.51.100.45 port 42108 ssh2`

Which malicious activity is most directly demonstrated by these log entries?

A brute-force authentication attack targeting system account names

An authorization control failure allowing access permissions misuse

A SIEM correlation engine parsing fault misordering event timestamps

A detective control acting as a preventive firewall rule

Show answer & explanation

Answer: A brute-force authentication attack targeting system account names

Answer

A brute-force authentication attack targeting system account names

The correct option correctly identifies the signature of an automated brute-force login attack. The syslog output captures sequential authentication failures from a single remote host testing multiple standard user accounts in rapid succession.

Step-by-Step Solution

Analyze the log source and process daemon

The entries come from sshd handling Secure Shell login requests

Identifies the core service receiving inbound traffic

Examine patterns in timestamps, source IPs, and status messages

Multiple failed attempts occur within seconds from IP 198.51.100.45 trying common administrative usernames

Rapid successive failures for different accounts from one origin indicate password guessing or brute-force scanning

Key Concept

Log Analysis and SIEM Management

Estimated Time:45s

Question 117Question →

An incident response specialist is preparing to collect evidence from an active, powered-on server involved in a security incident. In what sequence should the specialist acquire the following digital evidence sources to strictly adhere to the Order of Volatility, moving from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most volatile to least volatile is: CPU cache and registers, System Random Access Memory (RAM), Temporary swap space and pagefiles, and Local solid-state or hard disk drive storage.

Digital evidence acquisition must follow the Order of Volatility to prevent the loss of ephemeral data. The standard sequence begins with ultra-transient CPU cache and registers, proceeds to live system RAM, moves to temporary disk swap/pagefile space, and finishes with non-volatile local disk storage.

Step-by-Step Solution

Identify the data source with the shortest life expectancy.

CPU cache and registers are identified as the most volatile.

CPU registers and memory caches alter content with every clock cycle and instruction execution.

Identify active dynamic system memory.

System Random Access Memory (RAM) is placed second.

RAM holds volatile runtime environment details that vanish if power is disconnected or the operating system halts.

Identify secondary virtual memory files stored on disk.

Temporary swap space and pagefiles are placed third.

Swap/pagefiles contain memory artifacts written to storage, changing regularly during system operation but less ephemeral than physical RAM.

Identify non-volatile persistent storage media.

Local solid-state or hard disk drive storage is placed fourth.

Disk drives store non-volatile data that remains intact even after a system is powered off.

Key Concept

Order of Volatility (RFC 3227)

Question 118Question →

A security operations team has confirmed a active malware infection on a financial database administrator's workstation. Arrange the incident response playbook actions in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with host network isolation (containment), followed by volatile memory acquisition (forensics/preservation), followed by system sanitization and image restoration (eradication/recovery), and concludes with the post-incident review (lessons learned).

According to NIST SP 800-61 standards, once an incident is confirmed, the immediate step is Containment (isolating the host from the network). Next comes Evidence Preservation (capturing volatile RAM while the machine is running). Following evidence collection, Eradication and Recovery take place (removing malware and re-imaging from clean media). Finally, Post-Incident Activities (lessons learned) occur once operations return to normal.

Step-by-Step Solution

Isolate the infected host from the enterprise network.

Containment is achieved, halting active command-and-control communication and lateral propagation.

Immediate containment stops potential compromise progression before pursuing offline analysis.

Acquire volatile memory evidence prior to system shutdown.

RAM memory dump and volatile system state are preserved for investigation.

Volatile data resides in RAM and will be permanently lost if the machine is powered off or rebooted during remediation.

Perform eradication of threat artifacts and execute recovery procedures.

Malware persistence is removed and the system is safely restored to operational status from a verified baseline.

Eradication ensures the environment is clean before returning the system to production.

Hold a post-incident review and update documentation.

Lessons learned are compiled into an incident report to improve security operations.

Post-incident analysis evaluates performance metrics and identifies playbook improvements for future incidents.

Key Concept

NIST Incident Response Lifecycle (Containment, Evidence Preservation, Eradication/Recovery, Lessons Learned)

Question 119Question →

During a routine SOC escalation, an analyst discovers that a compromised staging CI/CD build server is executing unauthorized outbound SSH tunnels to an external IP address while pulling credentials from an internal vault. The server maintains active service accounts with administrative privileges to production clusters. Following standard NIST SP 800-61 incident response guidelines, which of the following actions should the analyst perform FIRST?

Isolate the build server from the network and revoke the associated service account credentials.

Re-image the build server operating system using a known-good baseline configuration file.

Modify network Intrusion Detection System (IDS) signatures to generate alerts on subsequent SSH tunneling attempts.

Initiate a full system forensic disk image copy while keeping all live network connections active to observe threat actor behavior.

Show answer & explanation

Answer: Isolate the build server from the network and revoke the associated service account credentials.

Answer

Isolate the build server from the network and revoke the associated service account credentials.

The correct action prioritizes the containment phase of the incident response lifecycle. Disconnecting the compromised system from the network and revoking elevated service credentials immediately mitigates the risk of lateral movement into production environments and halts active exfiltration.

Step-by-Step Solution

Identify the current incident response phase based on the scenario indicators.

The incident is actively occurring with ongoing unauthorized outbound traffic and lateral movement risk.

Determining the phase ensures adherence to standard incident handling frameworks (NIST SP 800-61 / ISO 27035).

Select the immediate containment step to stop active impact.

Network isolation of the host and revocation of compromised staging/production service accounts.

Containment limits the scope of damage and prevents attackers from pivoting into production before eradication begins.

Key Concept

Incident Response Containment Phase Priority

Question 120Question →

A Security Operations Center (SOC) analyst is evaluating DNS server query logs forward-collected by a SIEM platform after an internal endpoint exhibited anomalous egress bandwidth usage. The analyst extracts the following sample log entries from internal host 10.0.12.85 over a brief period:

text
2026-07-27T08:14:02Z client 10.0.12.85#49152 query: v1-dGhpcyBpcyBhIHRlc3Q.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:05Z client 10.0.12.85#49153 query: v1-c2VjcmV0IGRvY3VtZW50.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:09Z client 10.0.12.85#49154 query: v1-ZXhmaWx0cmF0ZWQgZGF0YQ.data.corp-update.net IN TXT + (10.0.0.2)

Standard volume-based DNS threshold alerts failed to trigger because the query frequency remained low. Which of the following SIEM correlation rule enhancements would be MOST effective for detecting this specific exfiltration technique while minimizing false positives?

Incorporate string entropy calculation and subdomain length evaluation combined with high unique TXT query ratios directed toward external second-level domains.

Lower the aggregate DNS query count threshold to trigger an alert whenever any internal endpoint exceeds 50 total DNS requests per minute across all record types.

Configure a Web Application Firewall (WAF) signature rule to perform deep packet inspection for SQL injection syntax embedded in outbound UDP port 53 packets.

Deploy a decoy honeypot DNS recursive resolver on the network perimeter to serve as a detective security control that automatically drops outbound UDP datagrams.

Show answer & explanation

Answer: Incorporate string entropy calculation and subdomain length evaluation combined with high unique TXT query ratios directed toward external second-level domains.

Answer

Incorporate string entropy calculation and subdomain length evaluation combined with high unique TXT query ratios directed toward external second-level domains.

The provided log snippet shows Base64-encoded strings placed within the host portion of DNS TXT queries targeting an external domain name. Because adversaries slow down request rates to evade basic query volume alerts, effective SIEM rules must evaluate statistical properties of the log data—specifically high character entropy (randomness), unusually long subdomain lengths, and high ratios of unique subdomains to a single domain destination.

Step-by-Step Solution

Analyze the log entries for specific structural patterns.

The queries feature highly variable, randomized prefixes (e.g., 'dGhpcyBpcyBh...') prepended to a common base domain ('data.corp-update.net') requesting TXT records.

This structural pattern indicates Base64-encoded payload fragments being transmitted outbound via DNS queries (DNS tunneling/data exfiltration).

Evaluate why standard SIEM correlation rules (volume thresholds) failed.

The query intervals (3–4 seconds apart) fall well below standard high-frequency burst detection metrics.

Adversaries intentionally throttle requests to bypass simplistic volumetric rate alerts.

Determine the optimal SIEM detection metric for low-and-slow DNS tunneling.

Calculating Shannon entropy (randomness of string characters), checking long subdomain labels, and tracking high counts of unique subdomains per domain name effectively flags encoded exfiltration payloads.

Encoded strings have significantly higher entropy than standard human-readable domain names, providing high detection fidelity with minimal false positives.

Key Concept

DNS Tunneling Detection and SIEM Rule Tuning

PreviousPage 6 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept